CMMC Level 2: Requirements, Scoring, and the Path to Certification

CMMC Level 2 is the certification tier for defense contractors and subcontractors that handle Controlled Unclassified Information (CUI). Its security requirements are not new or bespoke — Level 2 is, by rule, the 110 requirements of NIST SP 800-171, the same safeguarding standard DFARS 252.204-7012 has required by contract for years. What the CMMC program adds is verification: for most CUI-handling contracts, an independent assessment by a C3PAO replaces the honor system, as defined in 32 CFR Part 170.

If you are still establishing whether Level 2 applies to you at all, start with who needs CMMC — the short version is that FCI-only contractors need Level 1, and CUI brings Level 2.

The 110 requirements span fourteen families, and each requirement breaks into assessment objectives defined by NIST SP 800-171A — roughly 320 objectives in all, every one of which an assessor can verify by examining artifacts, interviewing your people, or testing the system. That objective-level granularity is why documentation and evidence discipline decide assessments: it is not 110 yes/no questions, it is 320 provable statements.

The fourteen families:

Level 2 comes in two assessment flavors under the rule: a certification assessment conducted by a C3PAO, and a self-assessment path that applies only where the contract allows it — the Department has indicated the C3PAO route will cover the large majority of CUI-handling work. Which one a given contract requires is stated in the solicitation. The assessment itself is conducted against your System Security Plan by an accredited team — our C3PAO explainer covers how those organizations work and how to engage one, and our assessment walkthrough covers what the week actually feels like.

Level 2 uses the DoD assessment methodology’s weighted scoring: a perfect implementation scores 110, and each unimplemented requirement subtracts 1, 3, or 5 points depending on its weight — so a score can run deep into negative numbers, and primes read SPRS scores as a seriousness signal long before any assessment.

The rule permits a conditional certification with a Plan of Action & Milestones, inside strict limits defined in 32 CFR § 170.21: only lower-weighted requirements are eligible, the minimum score is 0.8 of the total (88 of 110), and every POA&M item must close within 180 days, verified by a closeout assessment. In practice that means a POA&M is a short runway, not a parking lot — and the highest-weight requirements must be done on day one.

• Budgeting the gap: the Level 2 cost guide breaks down preparation and assessment economics with cited figures.
• Sequencing the work: the step-by-step checklist is the order of operations we use on real programs.
• Shrinking the problem: a well-scoped enclave — see the enclave guide — is the single biggest lever on both score and cost.

CMMC requirements reach contractors through a phased rollout as the clause appears in solicitations — and program dates have shifted more than once, so treat any specific deadline you read (including in search results) as a claim to verify against the current rule text and official DoD announcements. Our program-status analysis tracks the moving parts.

The planning answer, though, has not moved: preparation time is measured in months, assessor calendars fill, and primes ask for SPRS scores today. Contractors who wait for a date certain are planning to be last in line.

• Scope CUI honestly and draw the smallest defensible boundary — the enclave decision comes first.
• Remediate against all 110 requirements, hardest-weighted first, inside that boundary.
• Build the body of evidence — SSP, policies, procedures, records — the full catalog is on our CMMC documentation page, with samples.
• Self-assess with the 800-171A objectives, file the honest SPRS score, and burn down the gap.
• Engage the C3PAO, support the assessment week, close any POA&M on the 180-day clock — the full journey is mapped in the complete certification guide.