CMMC Level 2: 110 NIST SP 800-171 Requirements for Protecting CUI
What Does CMMC Level 2 Require?
CMMC Level 2 requires organizations that handle Controlled Unclassified Information to implement all 110 security requirements in NIST SP 800-171 Rev. 2 across the defined CMMC assessment scope. Organizations must be able to show documented and technical evidence, maintain an accurate System Security Plan, complete the applicable assessment, enter required information in SPRS, and affirm continued compliance annually
CMMC Level 2 Status in 2026: Phase I Self-Assessments Remain Active
CMMC implementation is currently paused in Phase I. On July 13, 2026, the Department suspended the transition to Phase II and the broad Level 2 C3PAO rollout that had been scheduled for November 10, 2026. During the pause, Level 2 self-assessment remains part of the active Phase I model.
The regulatory framework still defines Level 2 (Self) and Level 2 (C3PAO) statuses, but contractors should not assume the old phased timeline will resume unchanged. Review your solicitation, contract, prime flow-down, and current official guidance before determining the assessment status required for an award.
Important: The pause does not eliminate DFARS 252.204-7012 or the requirement to protect CUI in accordance with the applicable NIST SP 800-171 baseline. Security and readiness work should continue.
Who Needs CMMC Level 2?
CMMC Level 2 is intended for contractor information systems that process, store, or transmit Controlled Unclassified Information. It can apply to primes, subcontractors, external service providers, cloud- supported environments, manufacturers, engineering firms, technology providers, and other organizations supporting defense programs when CUI is in scope.
Company size does not determine Level 2. A 20-person subcontractor can have the same 110- requirement baseline as a much larger contractor if both handle CUI within the assessed environment.
Key point: The first Level 2 decision is not which tool to buy. It is where CUI exists, how it moves, and which assets, people, facilities, service providers, and security protections are part of the CMMC assessment scope.
CMMC Level 2 Protects Controlled Unclassified Information
Controlled Unclassified Information is information that the government creates or possesses - or that an organization creates or possesses for or on behalf of the government - that requires safeguarding or dissemination controls under law, regulation, or government-wide policy.
CUI can move through engineering systems, file shares, email, collaboration platforms, cloud applications, endpoints, remote-access solutions, manufacturing environments, support systems, and external service providers. If the organization cannot accurately map those flows, it cannot reliably define Level 2 scope.
Callout: Treat CUI discovery and scoping as an architecture exercise, not a paperwork exercise.
The 110 CMMC Level 2 Security Requirements
CMMC Level 2 uses all 110 security requirements from NIST SP 800-171 Rev. 2. The requirements are organized into 14 security families. Passing readiness depends on more than having policies: assessors and self-assessment teams need evidence that the required practices are implemented and operating within the assessment scope.
Access Control
Control who can access systems and CUI, what they can do, remote access, wireless access, mobile devices, external connections, and information flows.
Awareness & Training
Train users and privileged personnel to recognize security risks and perform their roles securely.
Audit & Accountability
Create, protect, review, and retain audit records that support monitoring, investigations, and accountability.
Configuration Management
Establish secure baselines, manage changes, enforce least functionality, and control software/use configurations.
Identification & Authentication
Uniquely identify and authenticate users/devices and apply required authentication protections, including MFA where applicable.
Incident Response
Establish operational capabilities to detect, analyze, contain, recover from, document, and report incidents.
Maintenance
Control system maintenance, tools, remote maintenance, and maintenance personnel.
Media Protection
Protect CUI on system media, control access, transport, storage, sanitization, and disposal.
Personnel Security
Screen individuals and protect systems during personnel actions such as termination and transfer.
Physical Protection
Limit and monitor physical access to systems, facilities, devices, and operating environments.
Risk Assessment
Assess organizational risk and vulnerabilities, including regular vulnerability scanning and remediation priorities.
Security Assessment
Assess security controls, track deficiencies, maintain the System Security Plan, and monitor ongoing effectiveness.
System & Communications Protection
Protect system boundaries, communications, cryptographic functions, sessions, network architecture, and CUI in transit.
System & Information Integrity
Identify flaws, manage patches, protect against malicious code, monitor advisories, detect attacks, and maintain system integrity.
CMMC Level 2 Assessment Paths: Self-Assessment vs. C3PAO
The CMMC framework defines two Level 2 assessment paths: Level 2 (Self) and Level 2 (C3PAO). Both use the same 110 NIST SP 800-171 Rev. 2 requirements. The difference is who performs the assessment and which CMMC status the contract requires.
Level 2 Self: The organization conducts its own assessment every three years, submits the required result to SPRS, and affirms compliance annually. This path is part of the current Phase I program.
Level 2 C3PAO: Under the defined regulatory model, an authorized or accredited C3PAO performs the certification assessment every three years, with annual affirmation. The broad Phase II rollout of this requirement is currently suspended while the Department reviews CMMC.
Bottom line: Do not select an assessment path based on preference. Confirm the CMMC status required by the applicable contract or flow-down and the current program guidance.
CMMC Level 2 Scoping: Where Most Readiness Programs Win or Lose
The CMMC assessment scope is the set of assets that will be evaluated against the applicable security requirements. For Level 2, scoping begins with CUI: where it is processed, stored, or transmitted, and which assets provide security functions or services to that environment.
Scope item 1: CUI assets: systems that process, store, or transmit CUI.
Scope item 2: Security protection assets: systems that provide security functions or capabilities to the CUI environment.
Scope item 3: Specialized assets and other asset categories treated according to current CMMC scoping rules.
Scope item 4: External service providers and cloud service providers that affect the security or handling of CUI.
Scope item 5: Facilities, identities, administrators, remote-access paths, management systems, and data flows that materially support the environment.
Callout: A smaller, well-designed CUI boundary can reduce complexity - but “enclave” architecture does not remove endpoints, users, integrations, or service providers from scope if they still process, store, transmit, or protect CUI.
CUI Users
Staff, admins and remote users who handle CUI
Managed Endpoints
Laptops, workstations and devices that touch CUI
CUI Enclave / Cloud
Where CUI is processed, stored and transmitted
Identity & Security Services
MFA, access control, endpoint protection, encryption
SOC & Monitoring
Logging, detection, response and evidence retention
Approved External Services
Providers that handle or protect CUI
SPRS, Scoring, and the Difference Between “Implemented” and “Documented”
CMMC Level 2 readiness requires a defensible assessment result, not a collection of policy documents. The organization must evaluate the 110 NIST SP 800-171 requirements using the applicable assessment methodology and maintain evidence that supports the result.
A strong score is meaningful only when the supporting controls are implemented in the environment described by the System Security Plan. If the documentation says MFA, logging, vulnerability management, incident response, or access controls operate one way while the technical environment operates another way, the discrepancy creates assessment risk.
MAD Security’s own environment has achieved a perfect SPRS score of 110 and CMMC Level 2 certification, giving our team direct experience with the level of technical implementation, documentation discipline, and evidence readiness required to defend a mature compliance posture.
Your System Security Plan Must Describe the Environment You
Actually Operate
The SSP is one of the central Level 2 artifacts. It should describe the system boundary, operating environment, how security requirements are implemented, connections to other systems, and relationships with service providers. An assessment-ready SSP is specific enough to guide an assessor to the supporting technical evidence and current enough to match the environment today.
Avoid: Do not build the SSP as a one-time document the team updates only before an assessment. Changes to architecture, users, cloud services, tools, responsibilities, and security processes should trigger updates.
Can You Use a POA&M for CMMC Level 2?
Limited use of a Plan of Action and Milestones is permitted under the CMMC rule for eligible Level 2 findings. A Conditional status requires the organization to meet the applicable scoring threshold and may not include certain prohibited requirements on the POA&M. Eligible items must be remediated and successfully closed within 180 days to reach Final status.
Practical direction: Treat POA&Ms as a constrained remediation mechanism - not a readiness strategy. The goal before an assessment should be to close known gaps and enter the assessment with evidence that critical controls are fully operating.
A Practical CMMC Level 2 Readiness Process
Step 1: Determine CUI applicability and contract requirements.
Step 2: Map CUI data flows and define the assessment boundary.
Step 3: Inventory in-scope assets, users, service providers, cloud services, and security responsibilities.
Step 4: Perform a NIST SP 800-171 / CMMC Level 2 gap assessment using the real operating environment.
Step 5: Prioritize remediation based on assessment impact and cyber risk - not easiest-to-close items first.
Step 6: Build or correct the SSP, policies, procedures, diagrams, responsibility matrices, and evidence.
Step 7: Validate technical controls through screenshots, configurations, logs, tickets, reports, interviews, and demonstrations.
Step 8: Conduct a readiness review that tests whether the evidence and control owners can support an assessment.
Step 9: Complete the applicable self or certification assessment and submit/maintain required SPRS information.
Step 10: Operate CMMC continuously: monitor controls, update evidence, manage changes, remediate vulnerabilities, and complete annual affirmation.
Why Organizations Struggle With CMMC Level 2
Failure 1: They start with policy writing before defining CUI scope.
Failure 2: The SSP describes an ideal environment instead of the production environment.
Failure 3: Technical controls exist, but the team cannot produce objective evidence quickly.
Failure 4: The MSP, MSSP, cloud provider, and internal team have unclear shared responsibilities.
Failure 5: Logs exist but are not consistently reviewed, retained, or tied to incident-response actions.
Failure 6: Vulnerability scanning identifies issues, but remediation ownership and deadlines are inconsistent.
Failure 7: Changes in systems, users, cloud tools, or data flows are not reflected in compliance documentation.
Failure 8: The organization treats the assessment as the finish line instead of proving a security program that must operate every day.
Why Security Operations Matter to CMMC Level 2
Many Level 2 requirements depend on operational capabilities: access control, logging, vulnerability management, incident response, system integrity, monitoring, and evidence retention. These requirements do not become effective because a policy exists; they become effective when people, process, and technology operate consistently.
MAD Security’s model combines compliance specialists with a 24/7 U.S.-based Security Operations Center. That allows readiness work to connect directly to day-to-day monitoring, detection, investigation, response, vulnerability management, and the evidence needed to demonstrate that controls remain active between assessments.
Proof line: Compliance tells you what must be true. Security operations help keep it true.
CMMC Level 2 Readiness From a Team That Has Been Through It
MAD Security is a CMMC Level 2 Certified organization with a perfect SPRS score of 110. We help DIB organizations prepare before the assessment, support evidence and technical validation during the assessment, and maintain the environment after the assessment.
Our support can include CMMC gap assessments, scoping, SSP and policy development, POA&M remediation, Virtual Compliance Management, vulnerability management, incident response, and 24/7 managed SOC services.
How many requirements are in CMMC Level 2?
What information does CMMC Level 2 protect?
Level 2 is focused on protecting Controlled Unclassified Information, or CUI, within the defined contractor assessment scope.
Is CMMC Level 2 still required in 2026?
Is CMMC Level 2 the same as NIST SP 800-171?
How often is a CMMC Level 2 self-assessment required?
How often is a CMMC Level 2 C3PAO assessment required?
Can we pass CMMC Level 2 with a POA&M?
What is a good SPRS score for CMMC Level 2?
What is the biggest CMMC Level 2 mistake?
Can an MSP or MSSP make us CMMC compliant?
A service provider can perform important technical and operational responsibilities, but the contractor retains responsibility for its CMMC status and must understand which requirements are implemented internally, which are supported by providers, and how that shared responsibility is evidenced.
Does using GCC High automatically make us CMMC Level 2 compliant?
No. A compliant cloud environment can support a CUI architecture, but CMMC Level 2 covers the full assessment scope, including endpoints, identities, configurations, processes, service-provider responsibilities, documentation, and the remaining applicable security requirements.
How can MAD Security help with CMMC Level 2?
MAD Security can support scoping, gap assessment, documentation, technical remediation, evidence readiness, assessment support, ongoing compliance management, and 24/7 security operations for organizations protecting CUI.
Build a CMMC Level 2 Program You Can Defend With Evidence
If your organization handles CUI, the goal is not to look compliant for one assessment. It is to build an environment where the technical controls, documentation, evidence, and day-to-day security operations tell the same story. MAD Security can help you define the scope, close the gaps, prepare for the applicable assessment path, and maintain readiness after it is complete.
Our support can include CMMC gap assessments, scoping, SSP and policy development, POA&M remediation, Virtual Compliance Management, vulnerability management, incident response, and 24/7 managed SOC services.