Compliance Guide · CMMC · 2026
CMMC Level 2 requires 110 NIST 800-171 controls, a System Security Plan, and a third-party C3PAO assessment. Most contractors don't know where to start. This guide tells you exactly what needs to be in place — technically and documentarily — before an assessor arrives.
The Cybersecurity Maturity Model Certification (CMMC) is the DoD's framework for verifying that defense contractors and subcontractors have implemented adequate cybersecurity practices to protect sensitive defense information. It was finalized as a rule in December 2024 and is being phased into contracts.
| Level | Practices | Information Type | Assessment Type | Who Needs It |
|---|---|---|---|---|
| Level 1 | 17 practices | Federal Contract Information (FCI) | Annual self-attestation | Contractors with FCI but no CUI |
| Level 2 | 110 practices (NIST 800-171) | Controlled Unclassified Information (CUI) | Third-party C3PAO (most); self-attestation for some | Most DoD contractors handling CUI |
| Level 3 | 110+ practices (NIST 800-172) | CUI in critical programs | DCSA government-led | Highest-priority defense programs |
Most defense contractors and subcontractors fall under Level 2. If your contract includes DFARS clause 252.204-7012, you are required to implement NIST SP 800-171 and are on the path to CMMC Level 2 certification.
CMMC Level 2 maps to all 110 controls across NIST 800-171's 14 domains. The domains most commonly associated with significant IT implementation work:
| Domain | Key IT Controls | Commonly Failed |
|---|---|---|
| Access Control (3.1) | Least privilege, unique accounts, remote access controls, privileged account management | Yes — shared accounts, excessive access |
| Audit and Accountability (3.3) | Event logging, log review, log protection, audit failure alerting | Yes — logging enabled but not reviewed |
| Configuration Management (3.4) | Baseline configurations, change control, least functionality principle | Sometimes |
| Identification and Authentication (3.5) | Unique identification, MFA (required for privileged access and remote access) | Yes — MFA gaps |
| Incident Response (3.6) | Incident response capability, incident reporting to DoD | Yes — untested procedures |
| Maintenance (3.7) | Controlled maintenance, sanitization of media used in maintenance | Sometimes |
| Media Protection (3.8) | Media access, media transport protection, media sanitization | Sometimes |
| Personnel Security (3.9) | Screening of individuals with CUI access, personnel actions | Rarely (HR domain) |
| Physical Protection (3.10) | Physical access authorization, visitor control, physical monitoring | Sometimes |
| Risk Assessment (3.11) | Periodic risk assessments, vulnerability scanning | Yes — missing documentation |
| Security Assessment (3.12) | Periodic security assessments, POA&M maintenance | Yes — SSP not current |
| System and Communications Protection (3.13) | Network segmentation, boundary protection, encryption in transit, key management | Yes — segmentation gaps |
| System and Information Integrity (3.14) | Malware protection (EDR), security alerts, patching, spam protection | Sometimes — patch management gaps |
The SSP is the document that describes how your organization implements each of the 110 NIST 800-171 controls. It is what C3PAO assessors review. A compliant SSP includes:
A DCSA assessor told one contractor that their documentation was better than 80% of companies reviewed. That's because their IT provider had done 30+ CMMC assessments and knew exactly what assessors want to see: not just that a control exists, but evidence it's operating. For audit logging: not just "logging is enabled" but a screenshot of the log configuration, a sample log export, and documentation of who reviews logs and how often.
No contractor achieves 100% of the 110 controls before their first assessment. The POA&M is the document where you document the gaps — controls not yet fully implemented — along with your plan and timeline to close them.
Key requirements for a defensible POA&M:
The single most important decision in CMMC preparation is defining your CUI boundary. The CUI boundary determines which systems, users, and data are in scope for the 110 controls. A smaller, well-defined boundary is significantly easier to certify than a broad, poorly-defined one.
Approaches to CUI boundary definition:
The Supplier Performance Risk System (SPRS) is where contractors self-report their NIST 800-171 implementation score. The scoring methodology assigns a maximum of 110 points and deducts points for unimplemented controls — with higher deductions for higher-risk controls. A perfect score is 110. Many contractors self-report without understanding the methodology and submit inaccurately high scores.
Your SPRS score is visible to DoD contracting officers and can affect contract award decisions. More importantly, submitting an inaccurate (inflated) SPRS score can expose you to False Claims Act liability — intentional misrepresentation of your cybersecurity posture to obtain government contracts has resulted in DOJ investigations and settlements.