CMMC Level 2 Readiness Guide: From Scoping to Assessment

Short answer: CMMC Level 2 readiness means you can show, with evidence, that all 110 requirements of NIST SP 800-171 Rev. 2 are implemented across the systems that handle your Controlled Unclassified Information (CUI). Getting there follows eight phases: confirm the requirement, scope, assess gaps, remediate in priority order, document, build evidence, rehearse the assessment, and stay ready. Most of the effort sits in scoping and remediation, and the order you do things in drives cost more than anything else.

This guide is the roadmap. Each phase links to a deeper article on that topic.

Who this guide is for

Level 2 applies when you process, store, or transmit CUI under a DoD contract. Your contract or solicitation specifies whether Level 2 is met through a self-assessment or a certification assessment by a C3PAO (an authorized third-party assessment organization). The preparation is the same either way: the requirements, scoring, and evidence standards don’t change with who assesses you.

If you handle only Federal Contract Information (FCI), Level 1 likely applies instead. See CMMC Level 1 vs. Level 2.

The roadmap at a glance

Phase 1: Confirm what you actually need

Before spending on tools, confirm the requirement from your own paperwork.

• Find the clauses. DFARS 252.204-7012 means you must protect covered defense information, including CUI, using NIST SP 800-171. DFARS 252.204-7021 is the CMMC contract clause; it states the required level and assessment type, such as Level 2 (Self) or Level 2 (C3PAO). Solicitations give notice of that requirement through DFARS 252.204-7025. See DFARS 252.204-7012 explained.
• Check flow-downs. If you’re a subcontractor, your prime’s requirements flow down to you when you handle the same CUI.
• Identify the information. Confirm that what you receive is actually CUI (marked or identified in the contract), not just FCI.
• Note the timeline. The date your next bid or option period needs a status is your real deadline.

Phase 2: Scope — the decision that sets your cost

Scoping decides which systems the 110 requirements apply to. A tight, well-documented boundary is the single biggest lever on cost and effort.

The CMMC rule (32 CFR Part 170) sorts every asset in a Level 2 environment into categories:

Three scoping decisions matter most for small contractors:

1. Whole company or enclave. Isolating CUI in a smaller environment can shrink the number of users, devices, and systems in scope. See CMMC enclaves.
2. Cloud services. A cloud service provider that processes, stores, or transmits CUI must meet the FedRAMP Moderate baseline or its equivalent.
3. Your MSP or IT provider. If your MSP or IT provider handles CUI or security data (such as administrator credentials or logs) for your in-scope systems, the services it provides are in your assessment scope. Document the relationship in your SSP and get a customer responsibility matrix that splits responsibility for each requirement.

Phase 3: Assess the gaps honestly

A gap assessment tests each of the 110 requirements against its assessment objectives in NIST SP 800-171A. Each requirement is met only when every one of its objectives is met. Assessors use three methods: examine documents and settings, interview the people who do the work, and test that controls actually function.

The output should be:

• A requirement-by-requirement finding: met, not met, or not applicable, with the evidence behind each
• An estimated score using the DoD Assessment Methodology, which starts at 110 and subtracts 1, 3, or 5 points for each requirement not met (see what an SPRS score is)
• A list of the gaps that can’t be left open at assessment time (Phase 4)

The most common mistake is scoring on intent (“we basically do that”) instead of evidence. An inflated score is a contractual and legal risk, not just an assessment risk.

Phase 4: Remediate in the right order

You rarely have the budget to fix everything at once, so sequence matters. Prioritize in this order:

1. Requirements that can’t be on a POA&M. For conditional Level 2 status, only 1-point requirements may be left open on a plan of action and milestones (POA&M). The exception is FIPS-validated encryption (3.13.11), which may be left open if encryption is in place but not FIPS-validated. Some 1-point requirements are also excluded, including the System Security Plan itself (3.12.4). Everything else must be fully met on assessment day.
2. High-weight requirements. 5-point and 3-point requirements both protect the most and move your score the most.
3. Foundations other controls depend on. Identity and multi-factor authentication, asset inventory, logging, and configuration baselines make later requirements easier to meet and prove.
4. Everything else, scheduled realistically with owners and dates.

Common Level 2 gaps for small contractors include multi-factor authentication, FIPS-validated encryption, centralized logging and log review, incident response testing, and controlling removable media. If an MSP is doing the technical work, someone still needs to own the compliance side: verifying each fix against its objectives and capturing the evidence as you go.

Phase 5: Document what you actually do

Documentation is assessed as carefully as technology. You need:

• A System Security Plan (SSP) that describes the boundary, the environment, and how each requirement is implemented. Without a current SSP, you can’t achieve Level 2. See System Security Plan.
• Policies and procedures for each requirement family, written for how your organization actually operates.
• A POA&M for any remaining eligible gaps, with owners and closure dates. See the POA&M guide.
• Diagrams and inventories of the network, data flows, and assets by category.

An SSP built from a template that doesn’t match your environment is a red flag to an assessor. Write what’s true, then keep it current.

Phase 6: Build the evidence package

For every assessment objective, you should be able to point to proof: a configuration screenshot, a log extract, a training record, a signed policy, a ticket showing a change was approved. Organize evidence by requirement so you, or an assessor, can find it in minutes.

Build evidence during remediation, not after it. Collecting it months later is slower and less convincing.

Phase 7: Rehearse, then schedule

• Run a mock assessment. Walk through every requirement the way an assessor will: examine, interview, and test. This exposes weak evidence and people who can’t explain their own controls.
• Prepare your staff. Assessors interview the people who perform the controls, not just leadership.
• Choose a C3PAO early if you need certification. Authorized C3PAOs are listed in the Cyber AB Marketplace. Assessor capacity is limited, so book ahead of your deadline. See what a C3PAO is.

Phase 8: The assessment, your status, and staying ready

• Results. A self-assessment score is entered in SPRS; C3PAO results are submitted to DoD and reflected in SPRS.
• Final or conditional status. Meeting all 110 requirements gives final Level 2 status. With a score of at least 88 out of 110 and only eligible items open on a POA&M, you receive conditional status, and you must close those items, confirmed by a POA&M closeout assessment, within 180 days.
• Affirmation. Your Affirming Official, a senior representative of your company, affirms continued compliance in SPRS after every assessment (including a POA&M closeout) and every year after that.
• Reassessment. Level 2 status is valid for three years.

Staying ready means keeping the SSP and inventory current, reviewing logs and vulnerabilities on schedule, training staff, testing incident response, and reassessing when your environment changes. Affirming compliance you no longer maintain carries legal risk.

Are you ready? A quick self-check

You’re likely close to assessment-ready if you can answer “yes” to all of these:

• We know exactly where CUI lives, and every asset is categorized and inventoried
• Our cloud services that handle CUI meet FedRAMP Moderate or its equivalent
• Every requirement has been tested against its assessment objectives, and our score reflects evidence
• No POA&M-ineligible requirement is open
• Our SSP is current and matches how the environment actually works
• Evidence is organized by requirement and current
• Our MSP’s responsibilities are documented and their evidence is available to us
• Staff can explain the controls they perform
• We’ve completed a mock assessment and fixed what it found

What about the Phase II suspension?

The Phase II suspension paused the phase that would have made third-party certification a condition of award for many contracts. It didn’t change the requirements: DFARS 252.204-7012 still requires NIST SP 800-171, CMMC Phase I self-assessment requirements remain where contracts include them, and voluntary C3PAO assessments are still available. Readiness work done now counts whenever certification requirements return. Check the DoD CIO CMMC page for the program’s current status.

Frequently Asked Questions

How long does CMMC Level 2 readiness take?

It depends on your starting point and scope. A gap assessment typically takes a few weeks. Reaching full readiness commonly takes many months, driven mostly by how many gaps exist and how quickly your IT team or provider can close them. A tight scope is the biggest time saver.

Can we prepare for Level 2 on our own?

Some organizations do, especially with a strong internal IT team. The common pitfalls are scoping too broadly, scoring on intent instead of evidence, and leaving POA&M-ineligible gaps open. An independent gap assessment early on is the cheapest way to avoid all three.

Can we pass with open items?

Only conditionally. You need a score of at least 88 out of 110, only eligible requirements can be open on the POA&M, and they must be closed within 180 days. Otherwise, all 110 requirements must be met.

Do we need a C3PAO right now?

Only if your contract or solicitation requires a Level 2 certification assessment. Otherwise, a self-assessment and annual affirmation apply. Voluntary C3PAO assessments are available if a customer asks for one.

What does Level 2 readiness cost?

It depends mostly on your scope and how many gaps you have. Remediation (tools and IT changes) is usually the largest cost, separate from assessment fees. See how much CMMC certification costs for DoD’s own estimates.

How USCIBER can help

USCIBER works through this roadmap with small defense contractors. A CMMC Level 2 Readiness Review (from $7,500) covers Phases 1–3: confirming your requirement, defining scope, a gap assessment against all 110 requirements, an estimated SPRS score, and a prioritized remediation roadmap. The End-to-End Readiness Program carries you through Phases 4–7 (documentation, remediation coordination with your IT team or MSP, evidence, and a mock assessment) and is scoped after the Review, with the Review fee credited. USCIBER is a readiness consultant; it is not a C3PAO and does not issue CMMC certifications.

Sources

• 32 CFR Part 170 — CMMC Program (eCFR)
• DoD CIO — CMMC program information
• NIST SP 800-171 Rev. 2 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
• NIST SP 800-171A (June 2018, the version incorporated by reference in 32 CFR Part 170) — Assessing Security Requirements for Controlled Unclassified Information
• DoD — NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1
• DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting
• DFARS 252.204-7021 — Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements
• DFARS 252.204-7025 — Notice of Cybersecurity Maturity Model Certification Level Requirements
• The Cyber AB — CMMC Marketplace

This article is general information, not legal advice. Review your specific contracts with your contracting officer or counsel.