DoD Memo Clarifies CMMC Level 2 Requirements: What Defense Contractors Need to Know

The Importance of CMMC Compliance

Cyber threats targeting the defense supply chain continue to grow more sophisticated, putting sensitive government data at significant risk. To address these challenges, the Department of Defense (DoD) established the Cybersecurity Maturity Model Certification (CMMC), a framework that ensures contractors implement strong, standardized cybersecurity practices. This framework protects everything from basic contract data to more sensitive technical information by requiring contractors to meet specific security levels based on the nature of the data they handle. 

The DoD memo released on January 17th, 2025, provides essential guidance for determining the appropriate CMMC level. Specifically, it confirms that any organization handling information listed under the National Archives and Records Administration (NARA) CUI Registry, particularly Controlled Technical Information (CTI), must obtain at least a Level 2 Certification. Essentially, this certification must be verified by a third-party assessor; self-assessment alone is insufficient or not. 

This update strengthens expectations for defense contractors and urges immediate action to review data handling practices and begin preparing for third-party certification. 

DoD Memo: Key Clarifications for Contractors

The DoD's updated CMMC implementation memo serves as a roadmap for contractors to determine which level of certification is required based on the data they work with. It emphasizes stronger safeguards around CTI and other sensitive unclassified data. 

One of the most important takeaways is the confirmation that organizations handling CTI must obtain a Level 2 Certification, assessed by a certified third-party assessor (C3PAO). This requirement reflects the sensitivity of the data and the potential national security implications if it were to be compromised. Self-assessments are not an option for this data type. 

Additionally, the memo aligns with existing cybersecurity regulations. Contractors covered by DFARS 252.204-7012 are already expected to implement the controls in NIST SP 800-171 controls that form the foundation of CMMC Level 2. This guidance reinforces the government's push for stronger, more consistent cybersecurity across its contractor base. 

How to Determine Your Required CMMC Level

Choosing the appropriate CMMC level for your organization is critical to meeting Department of Defense (DoD) cybersecurity requirements and maintaining eligibility for defense contracts. The recent DoD memo helps simplify this decision by clearly mapping certification levels to the type of information your organization handles, especially when dealing with Controlled Unclassified Information (CUI) or Controlled Technical Information (CTI). 

CMMC Level 1: For Organizations Handling FCI

This entry-level certification applies to organizations that only manage Federal Contract Information (FCI) data that is not intended for public release but doesn't meet the threshold of requiring controlled protections. Governed by FAR 52.204-21, Level 1 requires 17 basic cybersecurity practices and can be met through self-assessment. 

CMMC Level 2: For Organizations Handling Sensitive Data

Level 2 is appropriate for organizations managing sensitive information such as engineering drawings, system specifications, and technical research. The memo clarifies if your organization handles CUI, a sensitive subset of unclassified information, you must undergo a third-party assessment to obtain this certification. 

This requirement replaces the previously accepted self-assessment model for CUI, reflecting the DoD's increased emphasis on verification and enforcement. 

CMMC Level 3: For Mission-Critical Data 

Reserved for organizations dealing with high-value data, Level 3 requires compliance with the more advanced controls found in NIST SP 800-172. This level is intended for contractors involved in work where a breach could pose serious national security threats. Certification must be verified through a rigorous government-led review. 

CMMC Phase-In Timeline: What to Expect

The DoD memo also provides a phased implementation timeline for CMMC levels tied to the finalization of the DFARS rule: 

CMMC Level 1: Effective immediately for all applicable contractors 

CMMC Level 2: Will be enforced one year after the final rule is published 

CMMC Level 3: Will be enforced two years after the final rule is published 

This timeline gives contractors a limited window to assess their current standing, identify gaps, and prepare for certification. For organizations handling CUI, the urgency is even greater because third-party assessments take time to schedule and complete; early action is critical to maintaining contract eligibility. 

CTI: Why Level 2 Certification Matters

CTI is now central to CMMC enforcement. As a critical subset of unclassified data, it includes highly sensitive technical details, such as schematics, specifications, or code, that could compromise defense readiness if exposed. 

Under the DoD's updated policy, any organization with this type of information must obtain a Level 2 Certification validated by a third-party assessor. The increased oversight reflects the strategic importance of the data and the need for heightened cybersecurity assurances. 

While this raises the bar for compliance by introducing new costs and requirements, it also strengthens an organization's cybersecurity posture. Investing in stronger defenses not only protects national interests but also helps contractors remain competitive and trusted within the defense supply chain. 

Steps to Determine Your Required CMMC Level

Understanding which CMMC level your organization needs to meet is crucial for maintaining compliance, protecting sensitive information, and staying eligible for DoD contracts. Based on the recent DoD memo, the following step-by-step guide will help you assess your data environment and determine the appropriate certification level. 

Step 1: Identify the Type of Information Your Organization Handles

Start by evaluating whether your organization processes, stores, or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

FCI refers to information provided by or generated for the government under a contract not intended for public release. 

CUI, on the other hand, includes a broad category of sensitive data that requires safeguarding, even though it is not classified, including items such as technical manuals, design documents, and communications regarding defense systems. 

If you only handle FCI, CMMC Level 1 may be sufficient. But if you handle any form of CUI, you are likely looking at CMMC Level 2 or higher. 

Step 2: Check if Your CUI Falls Under NARA's Defense Organizational Index

The next step is determining if the CUI you handle is categorized under the Defense Organizational Index of the National Archives and Records Administration (NARA) CUI Registry. Specifically, if your CUI is classified as Controlled Technical Information (CTI), which includes sensitive technical data relevant to DoD missions, you must obtain a CMMC Level 2 Certification through a third-party assessment. 

This is a critical distinction. CTI's sensitivity means self-assessments are unacceptable; only a C3PAO-certified evaluation will satisfy compliance requirements for CTI-related contracts. 

Step 3: Determine if Your Contract Includes DFARS 252.204-7012

Review your DoD contract to see if it contains the DFARS 252.204-7012 clause. This clause mandates that contractors protect CUI using the controls defined in NIST SP 800-171. If your contract includes this clause, your organization is already expected to meet these standards, and you'll need to demonstrate this through a formal certification under CMMC Level 2 if you handle CTI or other sensitive CUI. 

Step 4: Assess Whether You Need CMMC Level 2 or Level 3 Certification

While many contractors fall under Level 2, some may require CMMC Level 3 Certification. If your systems store mission-critical, highly sensitive, or aggregated CUI in a way that increases risk to DoD operations, you may be subject to Level 3. This level involves enhanced protections aligned with NIST SP 800-172, and certification is required through an in-depth third-party audit. 

Checklist: Is Your Organization Required to Obtain CMMC Level 2 Certification?

Still unsure whether your organization must meet CMMC Level 2 Certification requirements? Use the quick checklist below to help clarify your status. If you answer "yes" to most or all these questions, the recent DoD memo makes it clear that Level 2 Certification is not optional. 

✅ Do you handle Controlled Technical Information (CTI)? 

CTI includes sensitive technical data such as engineering drawings, specifications, or system designs. It's a subset of Controlled Unclassified Information (CUI) considered mission-critical to DoD operations and falls under stricter compliance requirements. 

✅ Is your contract subject to DFARS 252.204-7012? 

This Defense Federal Acquisition Regulation Supplement clause requires contractors to implement the 110 cybersecurity controls outlined in NIST SP 800-171 to protect CUI. 

✅ Are you required to comply with NIST SP 800-171? 

If you are handling CUI as part of a DoD contract, compliance with NIST SP 800-171 is already mandatory, and now it must be validated through third-party certification if that data includes CTI. 

✅ Is your CUI categorized under the NARA CUI Registry Defense Organizational Index? 

If your data falls into this grouping, such as CTI or other sensitive DoD-related information, you are in scope for CMMC Level 2 Certification. 

Preparing for CMMC Level 2 Certification: Best Practices

With the Department of Defense's (DoD) latest guidance making CMMC Level 2 Certification mandatory for contractors handling Controlled Technical Information (CTI), organizations must begin preparing to meet the stringent requirements. Certification is more than a one-time audit; it reflects your organization's ongoing commitment to protecting sensitive defense information. Here are the best practices to help you prepare for and achieve CMMC Level 2 compliance. 

Implement NIST SP 800-171 Controls

CMMC Level 2 is built upon the 110 security controls outlined in NIST SP 800-171, which are designed to protect Controlled Unclassified Information (CUI). These controls cover access control, incident response, system integrity, and more. Begin by reviewing your existing cybersecurity framework to ensure it aligns with these standards. Any gaps should be addressed as early as possible to avoid compliance delays. 

Conduct a CMMC Readiness Assessment

Before scheduling your third-party certification, conduct a CMMC Readiness Assessment. This internal evaluation helps identify weaknesses in your current security posture, prioritize remediation tasks, and validate that your organization meets each required control. A readiness assessment gives you a clear roadmap for reaching certification with fewer surprises. 

Partner with a CMMC Registered Provider Organization

Navigating CMMC compliance alone can be overwhelming. Partnering with a CMMC Registered Provider Organization (RPO) like MAD Security ensures you have access to experienced cybersecurity professionals who understand the full scope of CMMC, NIST, and DFARS requirements. An RPO can assist with gap analysis, remediation planning, policy development, and implementation of key security practices. 

Prioritize Documentation, Risk Assessments, and Monitoring

Documentation is a critical part of the certification process. Be prepared to demonstrate not only that security controls are in place, but that they are regularly reviewed and maintained. Conduct formal risk assessments, document findings, and implement continuous monitoring solutions to track your environment and respond to threats in real-time. These measures show auditors that your cybersecurity program is both mature and sustainable. 

Preparing for CMMC Level 2 Certification isn't just about passing an audit; it's about building a resilient cybersecurity foundation that protects your organization and supports the national defense mission. 

Common Pitfalls and How to Avoid Them

Achieving CMMC Level 2 Certification requires more than just checking boxes. It demands a clear understanding of the requirements and a proactive approach to cybersecurity. Unfortunately, many defense contractors fall into common traps that can delay certification or jeopardize contract eligibility. Here are two major pitfalls to watch out for and how to avoid them. 

Misclassifying Information

One of the most frequent errors is failing to correctly identify whether the information your organization handles qualifies as Controlled Unclassified Information (CUI), especially Controlled Technical Information (CTI). CTI is a subset of CUI defined in the NARA CUI Registry Defense Organizational Index and includes critical technical data like system schematics, weapon specs, or engineering designs. 

Misclassifying CTI as non-sensitive or failing to recognize it as CUI can lead to applying the wrong CMMC level, potentially resulting in non-compliance and disqualification from DoD contracts. To avoid this, thoroughly review the NARA CUI Registry and work with compliance experts to accurately classify all information types. 

Assuming a Self-Assessment Is Enough

Another common mistake is assuming that a self-assessment satisfies CMMC Level 2 requirements. While some CUI environments may permit self-assessments, the DoD memo clarifies that organizations handling CTI must undergo a third-party assessment by a Certified CMMC Third-Party Assessment Organization (C3PAO). Misunderstanding this requirement can cause significant delays and disrupt contract timelines. 

To avoid these pitfalls, ensure your team is well-informed, follow the latest DoD guidance closely, and engage with a trusted CMMC Registered Provider Organization (RPO) like MAD Security to guide you through the compliance journey with confidence. 

How MAD Security Can Support Your CMMC Journey

As a CMMC Registered Provider Organization, MAD Security is uniquely equipped to help defense contractors achieve and maintain CMMC compliance. Our team brings years of experience in DFARS, NIST, and federal cybersecurity regulations, providing tailored support that fits your organization's specific needs. 

We offer a full suite of services from Managed Security and Threat Monitoring to Virtual Compliance Management and CMMC Readiness Assessments. MAD Security is your trusted partner whether you're just beginning the compliance process or need help closing final gaps. 

Final Thoughts and the Path Forward

The Department of Defense's recent memo has reshaped the landscape for CMMC compliance, especially for contractors handling Controlled Technical Information (CTI) and other sensitive Controlled Unclassified Information (CUI). With third-party CMMC Level 2 Certification now a requirement for many organizations, taking proactive steps to understand your obligations and secure your systems is more critical than ever. 

Failing to comply with the latest DoD guidance not only risks disqualification from future defense contracts but also increases the chance of data breaches that could compromise national security.

Contractors and subcontractors must now evaluate the type of information they manage, align with NIST SP 800-171 requirements, and begin preparing for third-party certification if applicable. 

Whether you are just starting your CMMC journey or need help closing compliance gaps, MAD Security is here to support you every step of the way. Our team of experts offers tailored guidance, managed services, and compliance strategies designed to help you meet CMMC requirements with confidence. 

Don't wait; get started today. Contact MAD Security for a CMMC readiness consultation and ensure your organization is prepared for the evolving cybersecurity demands of the defense sector. 

Frequently Asked Questions (FAQS)