Short answer: CMMC Level 2 requires you to implement all 110 security requirements of NIST SP 800-171 Rev. 2 in the systems that process, store, or transmit Controlled Unclassified Information (CUI). Those requirements are grouped into 14 families, from Access Control to System and Information Integrity. The program rule is 32 CFR Part 170. Depending on your contract, Level 2 is verified by a self-assessment or by a certification assessment from an authorized C3PAO. You can hold conditional status with a limited Plan of Action and Milestones (POA&M), but only if you score at least 88 of 110 and close the open items within 180 days.
What is CMMC Level 2?
CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense program that verifies contractors protect sensitive information. It has three levels:
- Level 1 protects Federal Contract Information (FCI) with 15 basic requirements. See CMMC Level 1 vs. Level 2.
- Level 2 protects CUI with the 110 requirements of NIST SP 800-171 Rev. 2.
- Level 3 adds selected requirements from NIST SP 800-172 for the most sensitive programs.
If you’re not sure whether you handle CUI, start with what CUI is and how to recognize it. Level 2 doesn’t add new controls beyond NIST SP 800-171. If your contract already includes DFARS 252.204-7012, you are already required to implement these 110 requirements. CMMC adds a way to verify that you did.
The 14 families of CMMC Level 2
| Family | Requirements | What it covers, in plain English |
|---|---|---|
| Access Control (AC) | 22 | Who can log in, what each person can reach, remote access, wireless, mobile devices, and limiting CUI to people who need it |
| Awareness and Training (AT) | 3 | Security awareness for all users, role-based training, and recognizing insider threats |
| Audit and Accountability (AU) | 9 | Creating and protecting logs, reviewing them, and tracing actions back to individual users |
| Configuration Management (CM) | 9 | Secure baseline configurations, change control, inventory, and disabling unneeded software and services |
| Identification and Authentication (IA) | 11 | Unique user IDs, multifactor authentication, and password and authenticator rules |
| Incident Response (IR) | 3 | An incident response capability, tracking and reporting incidents, and testing your response |
| Maintenance (MA) | 6 | Controlling system maintenance, maintenance tools, and remote maintenance sessions |
| Media Protection (MP) | 9 | Protecting, marking, transporting, and sanitizing media that holds CUI, including removable drives |
| Personnel Security (PS) | 2 | Screening people before access and protecting CUI when people leave or change roles |
| Physical Protection (PE) | 6 | Limiting physical access, escorting visitors, keeping access logs, and safeguarding alternate work sites |
| Risk Assessment (RA) | 3 | Periodic risk assessments, vulnerability scanning, and fixing what you find |
| Security Assessment (CA) | 4 | Assessing your controls, tracking fixes in a POA&M, continuous monitoring, and the System Security Plan |
| System and Communications Protection (SC) | 16 | Network boundaries, segmentation, encryption of CUI (FIPS-validated where cryptography protects CUI), and session controls |
| System and Information Integrity (SI) | 7 | Patching flaws, malware protection, security alerts, and monitoring systems for attacks |
| Total | 110 |
The families aren’t equal in effort. Access Control, System and Communications Protection, and Identification and Authentication contain 49 of the 110 requirements and usually drive most of the technical work.
Which requirements cause the most trouble?
In readiness work, the same gaps come up again and again:
- No System Security Plan (CA.L2-3.12.4). The SSP describes how each requirement is met. Without one, you can’t credibly score yourself, and it can’t be placed on a POA&M. See our SSP & POA&M service.
- Multifactor authentication gaps (IA.L2-3.5.3). MFA is required for privileged accounts and for network access to non-privileged accounts. Shared or service accounts often slip through.
- Encryption that isn’t FIPS-validated (SC.L2-3.13.11). Using encryption is not enough. The cryptographic module protecting CUI must be FIPS-validated.
- Logging nobody reviews (AU family). Logs are collected but not reviewed, correlated, or protected from tampering.
- Unclear scope. If you don’t know where CUI lives, every system may end up in scope. Tight scoping is often the biggest cost lever.
How is CMMC Level 2 scored?
Assessors score each of the 110 requirements as MET or NOT MET using the DoD assessment methodology. A perfect score is 110. Each NOT MET requirement subtracts 1, 3, or 5 points depending on its weight, so the lowest possible score is −203. The same score is what you report in SPRS. See what an SPRS score is and how it’s calculated.
Can you pass Level 2 with open items?
Sometimes. 32 CFR 170.21 allows a Conditional Level 2 status with a POA&M only when all of these are true:
- Your score is at least 80% of the 110 requirements (88 points or higher).
- No requirement on the POA&M is worth more than 1 point. The one exception is SC.L2-3.13.11 (CUI encryption), which may be on the POA&M if encryption is used but isn’t FIPS-validated.
- None of these six requirements are on the POA&M:
- AC.L2-3.1.20 External connections
- AC.L2-3.1.22 Control public information
- CA.L2-3.12.4 System Security Plan
- PE.L2-3.10.3 Escort visitors
- PE.L2-3.10.4 Physical access logs
- PE.L2-3.10.5 Manage physical access
Open items must be closed and confirmed by a POA&M closeout assessment within 180 days. If they aren’t, the conditional status expires.
Self-assessment or C3PAO assessment?
Your contract determines which applies.
| Level 2 (Self) | Level 2 (C3PAO) | |
|---|---|---|
| Who assesses | Your organization | An authorized CMMC Third-Party Assessment Organization (C3PAO) |
| How often | Every 3 years | Every 3 years |
| Annual affirmation | Yes, by a senior official, in SPRS | Yes, by a senior official, in SPRS |
| Requirements | Same 110 | Same 110 |
The July 2026 suspension of CMMC Phase II paused the planned move to C3PAO certification as a condition of award for many contracts. It did not remove Level 2 self-assessments, annual affirmations, SPRS scores, or DFARS 252.204-7012 obligations. See what the Phase II suspension means for you. Contractors can still pursue a C3PAO assessment voluntarily, often because a prime asks for it.
How to prepare for Level 2
- Confirm scope. Identify where CUI is created, stored, and sent, and which people, systems, and providers touch it. Consider whether an enclave can shrink the scope.
- Run a gap assessment. Score yourself honestly against all 110 requirements.
- Write or update the SSP. Document how each requirement is implemented in your environment.
- Build a POA&M and fix the high-value gaps first. Prioritize 3- and 5-point requirements and the six that can’t go on a POA&M.
- Collect evidence. Assessors look for policies, configurations, screenshots, logs, and interviews that show each requirement is actually met.
- Report an accurate SPRS score and keep it current.
Frequently Asked Questions
How many requirements are in CMMC Level 2?
- They are the security requirements of NIST SP 800-171 Rev. 2, grouped into 14 families. CMMC Level 2 adds no requirements beyond NIST SP 800-171 Rev. 2.
Does CMMC Level 2 use NIST SP 800-171 Rev. 3?
No. The CMMC rule references NIST SP 800-171 Rev. 2. Rev. 3 has been published by NIST, but CMMC Level 2 assessments are conducted against Rev. 2 unless DoD changes the requirement.
What is the minimum score for CMMC Level 2?
A full pass requires all 110 requirements to be MET. A Conditional Level 2 status is possible with a score of at least 88 out of 110, subject to the POA&M limits above, with open items closed within 180 days.
How long does it take to get ready for Level 2?
It depends on your starting point and scope. Organizations with an SSP and core controls in place may need a few months. Starting from scratch typically takes longer, especially if encryption, MFA, or logging need to be rebuilt.
For the full path from scoping to assessment day, see the CMMC Level 2 Readiness Guide.
How USCIBER can help
USCIBER is a CMMC readiness consultant. We are not a C3PAO and don’t certify. Our CMMC Readiness Review scores you against all 110 requirements, flags the items that can’t go on a POA&M, and gives you a prioritized remediation plan. From $7,500. If you need the documentation itself, our Compliance Documentation Project delivers your SSP and POA&M. Engagements are led by security leadership holding CISSP, CISA, and CISM credentials.
Sources
- eCFR — 32 CFR Part 170, Cybersecurity Maturity Model Certification (CMMC) Program, including § 170.21 (POA&M requirements) and § 170.24 (scoring methodology)
- NIST — SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- DoD CIO — CMMC program page and Level 2 Assessment Guide
- eCFR — DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
This article is general information, not legal advice.