CMMC Level 2 Requirements

CMMC Level 2 requirements: 110 controls from NIST SP 800-171 Rev 2

CMMC Level 2 adds no new controls of its own. 32 CFR 170.14 says the Level 2 requirements are identical to the requirements in NIST SP 800-171 Rev 2, which has 110 requirements ²¹. If you already have DFARS 252.204-7012 in your contracts, you have been required to implement the same standard for years ⁷.

Level 2 applies to the systems, people and facilities that handle controlled unclassified information (CUI), plus the assets that protect them. Which assets count, and how a smaller enclave can shrink the scope, is covered in our GCC High and CUI enclave guide. For the full picture of the program, start with the CMMC overview.

NIST has since published Rev 3 of SP 800-171 ⁹, but CMMC and DFARS 7012 still use Rev 2. Our NIST 800-171 guide explains the difference and the pending transition rule.

CMMC Level 2 checklist: the 14 requirement families

The 110 requirements are grouped into 14 families in NIST SP 800-171 Rev 2 ⁸. The counts below come from the Rev 2 publication; the requirement numbers (3.1.1 and so on) are what you will see in your system security plan and SPRS score.

Most companies find the heaviest work in Access Control, Audit and Accountability, Configuration Management and System and Communications Protection. Those families need technical changes and ongoing operation, often from a managed security provider or a SOC service for log review.

Level 2 self-assessment vs C3PAO certification

Your contract decides which Level 2 assessment you need: Level 2 (Self) or Level 2 (C3PAO) ³⁶. Both use the same 110 requirements and the same scoring; the difference is who does the assessment.

• Level 2 (Self). You assess yourself every three years, enter results in SPRS, and a senior official affirms compliance at assessment and annually after that ³¹⁰.
• Level 2 (C3PAO). An authorized or accredited CMMC Third-Party Assessment Organization performs the assessment, results go into CMMC eMASS, the status is valid for three years, and you affirm at assessment and every year ⁶.

When the rule was written, DoD estimated 8,350 medium and large entities would need Level 2 C3PAO assessments as a condition of award ¹¹. Some companies have already been certified: the Cyber AB reported 2,362 Final Level 2 certificates as of September 29, 2026, according to a tracker of its town hall data ¹². How an assessment runs and how to choose an assessor is on our C3PAO assessment page.

Phase 2 status: C3PAO assessments are not required in contracts for now

Contracts cannot require a C3PAO assessment right now ⁴. C3PAO certification was due to become a contract requirement on November 10, 2026, when Phase 2 was scheduled to begin, but DoD suspended Phase 2 on July 13, 2026, and DoD CIO says CMMC implementation is paused in Phase 1 ¹.

What that means for Level 2:

• Contracting officers may designate only Level 1 (Self) or Level 2 (Self). They may not designate Level 2 (C3PAO) or Level 3, and existing C3PAO requirements are to be removed by contract modification ⁴.
• No waivers will be granted during the program review ⁴.
• NIST SP 800-171 Rev 2 is still enforced. DoD CIO says it will enforce Rev 2 compliance during the pause, and DFARS 252.204-7012 remains in effect ¹⁴.
• No restart date. As of late September 2026, no task force report or Phase 2 restart date had been released ¹³.

The practical answer is to keep building toward a full 110 of 110. If C3PAO assessments return, the same evidence carries over, and a documented self-assessment is what contracts can require today. The schedule may change; check the DoD CIO CMMC page for the current status ¹.

SPRS scoring for Level 2

Level 2 scoring starts at 110 and subtracts points for each requirement that is NOT MET ¹⁴. Each requirement is worth 5, 3 or 1 points, so a company with many gaps can end up with a negative score ¹⁴.

Two requirements earn partial credit ¹⁴:

• Multifactor authentication. 5 points are subtracted if MFA is not implemented for any users, and 3 if it covers only remote and privileged users.
• Encryption of CUI. 3 points are subtracted if encryption is used but not FIPS-validated, and 5 if it is not used.

Your score and the date of your assessment are what primes and contracting officers look at. DFARS 252.204-7019 requires a current assessment, no more than three years old, posted in SPRS ¹⁵. The NIST 800-171 and SPRS guide covers how to post it.

POA&M rules: minimum score, 180 days and which items qualify

A plan of action and milestones (POA&M) lets you reach Conditional Level 2 status with some gaps open, but only under strict limits in 32 CFR 170.21 ⁵:

• Minimum score. Your score divided by 110 must be at least 0.8, which means at least 88 points.
• Only 1-point requirements. No requirement worth more than 1 point can be on the POA&M. The one exception is SC.L2-3.13.11 (CUI encryption), allowed when encryption is used but not FIPS-validated.
• Six requirements can never be deferred: AC.L2-3.1.20 (external connections), AC.L2-3.1.22 (publicly accessible content), CA.L2-3.12.4 (system security plan), and PE.L2-3.10.3, 3.10.4 and 3.10.5 (escorting visitors, physical access logs, managing physical access devices).
• 180 days to close. Every POA&M item must be closed and confirmed by a closeout assessment within 180 days of the Conditional status date. If not, the Conditional status expires.

In practice, that means you cannot start an assessment with large gaps. Fix the 5-point and 3-point items first, then use the POA&M only for a few small items you can close quickly. A gap assessment from one of the CMMC compliance services usually produces this priority list. For budget figures, see CMMC cost, and for an IT partner that can run the controls day to day, a co-managed IT arrangement can work alongside your own staff.