CMMC Level 2 Requirements: The Complete 2026 Guide for DIB Contractors

What Is CMMC Level 2?

CMMC Level 2 (Cybersecurity Maturity Model Certification Level 2) requires organizations to implement all 110 security controls from NIST SP 800-171 Revision 2. It applies to any Defense Industrial Base (DIB) contractor that processes, stores, or transmits Controlled Unclassified Information (CUI) on Department of Defense contracts.

Unlike CMMC Level 1 (which covers 15 basic practices from FAR 52.204-21), Level 2 demands a comprehensive cybersecurity program with documented policies, trained personnel, and verifiable evidence.

Who Needs CMMC Level 2?

If your organization handles CUI under a DoD contract (and most subcontractors do), you will need Level 2 certification. This affects an estimated 80,000+ contractors across the defense industrial base, including:

• Prime contractors with direct DoD contracts involving CUI
• Subcontractors who receive CUI flow-down from primes
• Suppliers who manufacture components with CUI markings
• IT service providers who manage systems containing CUI

How to Know If You Handle CUI

Check your contract for DFARS clause 252.204-7012 (Safeguarding Covered Defense Information). If it's in your contract, you handle CUI and need CMMC Level 2.

The 110 Controls Organized by Family

NIST SP 800-171 organizes its 110 controls into 14 families:

Family	Code	Controls	Description
Access Control	AC	22	Limit system access to authorized users and functions
Awareness & Training	AT	3	Ensure personnel understand security responsibilities
Audit & Accountability	AU	9	Create, protect, and review system audit logs
Configuration Management	CM	9	Establish and maintain system configurations
Identification & Authentication	IA	11	Verify identities of users, processes, and devices
Incident Response	IR	3	Detect, report, and respond to security incidents
Maintenance	MA	6	Perform timely system maintenance
Media Protection	MP	9	Protect and control system media
Personnel Security	PS	2	Screen personnel and protect CUI during changes
Physical Protection	PE	6	Limit physical access to systems and facilities
Risk Assessment	RA	3	Identify and manage organizational risk
Security Assessment	CA	4	Assess security controls and monitor continuously
System & Communications Protection	SC	16	Protect communications and system boundaries
System & Information Integrity	SI	7	Identify and correct system flaws promptly

SPRS Score: What It Is and Why It Matters

Your Supplier Performance Risk System (SPRS) score is a numerical representation of your NIST SP 800-171 compliance posture. The score ranges from -203 to 110:

• 110 = all controls fully implemented
• 0 = baseline (no POA&M items, partial implementation)
• Negative scores = significant gaps requiring remediation

The DoD assigns each control a weight of 1, 3, or 5 points. High-weight controls (like access control and system hardening) have the most impact on your score.

How SPRS Is Calculated

1. Start at 110 (perfect score)
2. For each not implemented control: subtract its DOD weight
3. For each partially implemented control with a POA&M: no deduction (but must have a documented plan)
4. Controls without a POA&M that aren't fully implemented: subtract the weight

You are already required to submit your SPRS score to SPRS.mil per DFARS 252.204-7019. A tool like CMMC Command calculates this automatically using the official DOD weight table.

The CMMC 2.0 Timeline

Key Milestones

• December 2024: CMMC final rule published (32 CFR Part 170)
• November 10, 2025: Phase 1 begins. Select contracts require Level 1 and Level 2 self-assessments; C3PAO Level 2 assessments may be required at contracting officer discretion
• November 10, 2026: Phase 2 begins. C3PAO Level 2 third-party assessments more broadly required in DoD solicitations
• November 10, 2027: Phase 3. Level 2 (C3PAO) and Level 3 (DIBCAC) broadly required across applicable solicitations
• November 10, 2028: Phase 4. Full CMMC implementation complete

What the Phase Timeline Means for You

Starting November 10, 2026 (Phase 2), the DoD will more broadly require CMMC Level 2 C3PAO assessments in solicitations involving CUI. This means a C3PAO (Certified Third-Party Assessment Organization) must conduct an independent assessment of your cybersecurity program.

There are currently fewer than 100 authorized C3PAOs in the ecosystem. With 80,000+ contractors needing assessments, scheduling will be extremely competitive. Starting early is not optional; it's a strategic necessity.

The C3PAO Assessment Process

A CMMC Level 2 assessment typically involves:

1. Pre-assessment: C3PAO reviews your SSP, POA&M, and evidence artifacts
2. On-site assessment: 3-5 days of interviews, demonstrations, and evidence review
3. Finding resolution: 180 days to address any identified deficiencies. Organizations scoring 88+ of 110 practices MET receive Conditional CMMC Status and have 180 days to complete POA&M remediation and a closeout assessment.
4. Certification decision: C3PAO submits results to CMMC Accreditation Body (Cyber AB)
5. Certificate issued: Valid for 3 years

What Assessors Look For

C3PAO assessors evaluate your compliance against all 320 assessment objectives from NIST SP 800-171A. For each of the 110 controls, there are 1-5 specific objectives that must be MET, NOT MET, or NOT APPLICABLE.

Key areas assessors focus on:

• Documented policies and procedures for each control family
• Technical evidence that controls are implemented (screenshots, configurations, logs)
• Personnel awareness of security responsibilities
• Incident response capability and testing
• Continuous monitoring practices

Getting Audit-Ready: A Practical Approach

Step 1: Baseline Assessment (Week 1-2)

Assess all 110 controls honestly. Mark each as Implemented, Partially Implemented, or Not Implemented. Calculate your SPRS score. This gives you a clear picture of your gaps.

Step 2: Gap Analysis & Prioritization (Week 2-3)

Focus on high-weight controls first (weight 5). A single weight-5 control is worth five weight-1 controls. Prioritize by SPRS impact and implementation difficulty.

Step 3: Remediation (Week 3-10)

Close gaps systematically. Document everything: your SSP narrative, your evidence, your POA&M timelines. The documentation is as important as the technical implementation.

Step 4: Evidence Collection (Ongoing)

Build your evidence vault: policy documents, configuration screenshots, training records, audit logs, incident response plans. Organize by control family.

Step 5: SSP & POA&M Finalization (Week 10-12)

Your System Security Plan and Plan of Action & Milestones should be living documents. Finalize them before scheduling your C3PAO assessment.

Step 6: Mock Assessment (Week 12)

Run a readiness review. Can you answer assessor questions for every control? Is your evidence organized and accessible?

Common Mistakes That Delay Certification

1. Starting too late: most contractors need 60-90 days minimum
2. Underestimating documentation: technical controls without evidence don't count
3. Ignoring policies: assessors review policies first
4. Not training staff: AT controls require documented awareness training
5. Spreadsheet-based tracking: doesn't scale, prone to errors, no audit trail

How CMMC Command Helps

CMMC Command automates the compliance journey from self-assessment to audit-ready:

• Free tier: Full 110-control assessment with real-time SPRS scoring
• Starter ($249/mo): Evidence vault, SSP/POA&M generation, policy templates
• Professional ($749/mo): 9 AI features, security tool integrations, remediation task board

The platform calculates your exact SPRS score using official DOD weights, generates DOD-format documents, and uses AI to identify gaps and recommend specific remediation steps.

Start your free assessment today, no credit card required.