CMMC Level 2

Does Level 2 apply to you?

Three questions decide it:

1. Do you hold a DoD contract (or subcontract) that involves CUI? If yes, Level 2 is the relevant baseline.
2. Does the contract require a certification, or a self-assessment? Both exist. The clause in your contract says which.
3. Is all your CUI inside a scope you can actually control? If CUI is spread across personal devices and unmanaged cloud accounts, the programme starts with scoping, not with tools.

If you only handle Federal Contract Information — not CUI — Level 1 is the relevant level, and it is 15 practices rather than 110.

What "Level 2" actually consists of

For the assessment process and the evidence an assessor will ask for, see the CMMC Level 2 assessment guide.

Component	Detail
Requirements	110 security requirements from NIST SP 800-171 Rev. 2, across 14 families
Scoring	SPRS score, 110 maximum, -203 minimum, 313 points total
Core documents	System security plan (3.12.4), POA&M, evidence per requirement
Assessment	Self-assessment and/or C3PAO assessment depending on the contract
Validity	Certification lasts three years; assessments older than three years are no longer current

Where to start, in order

1. Get your number. Score all 110 before you decide anything else. The calculator takes about 15 minutes and needs no signup.
2. Read the checklist by family. AC and SC together carry 96 of the 313 points — if you fix anything first, fix those. See the breakdown.
3. Understand the assessment path. Self-assessment and C3PAO certification are different mechanisms with different evidence demands. The assessment guide covers both.
4. Decide whether to buy software. Often you should not, at least not yet. What each tool actually does.

Common questions

Is CMMC Level 2 the same as NIST SP 800-171?

Level 2 assesses against the 110 requirements of NIST SP 800-171 Rev. 2. The difference is the assessment mechanism and the consequence: 800-171 is the requirement, CMMC is the certification around it.

What score do I need?

There is no official passing SPRS number. Certification requires the requirements to be met, with only limited POA&M exceptions. A score below 110 means there are gaps to close before an assessment, not that you failed.

How long does it take?

Remediation is the long pole: typically 3–9 months for a small contractor starting from a low score. The assessment itself is 4–8 weeks.

Can I do it without a consultant?

Yes, and some contractors do. It depends on whether anyone in-house can own the SSP, the evidence collection and the remediation backlog. If nobody can, a consultant is cheaper than a failed assessment.