CMMC Level 2 Explained for a Shop That Has Never Had a Security Program

CMMC Level 2 is a set of 110 security requirements, taken from NIST Special Publication 800-171. The Department of Defense expects every contractor that handles Controlled Unclassified Information to meet them and to prove it. If you have never had a security program, that can look like a wall. It is really a checklist with a known shape, and your shop probably already does some of it, like locking the doors and controlling who holds keys.

This week brought reports of a CMMC task force review and a pause in the rollout, so you may be tempted to wait. Below we explain what Level 2 is, how to tell whether it applies to you, what is and is not settled about the timeline, and how a shop starting from zero can take its first real steps.

What is CMMC Level 2, in plain language?

CMMC stands for Cybersecurity Maturity Model Certification. It is the Department of Defense program, written into 32 CFR Part 170, that checks whether contractors protect two kinds of information: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

There are three levels:

• Level 1 covers FCI. It has 15 basic safeguarding requirements, checked by a yearly self-assessment.
• Level 2 covers CUI. It is the 110 requirements in NIST SP 800-171 Revision 2.
• Level 3 is for a small set of the most sensitive programs. It adds requirements from NIST SP 800-172 on top of Level 2.

Level 2 comes in two forms. Some contracts accept a self-assessment. Others require a certification assessment by an authorized third-party organization, called a C3PAO. The solicitation tells you which one applies. Either way, the status lasts three years, and a senior official at your company must affirm every year that you still comply.

In a small shop, CUI usually looks ordinary. It might be a drawing or specification from your prime with a limited distribution statement, a document with a CUI banner, or export-controlled technical data. Here is a question worth sitting with: if someone asked you today to point to every place your CUI lives, could you do it?

Does CMMC Level 2 actually apply to my shop?

Start with your paperwork, not your network. Look in your contracts and purchase orders for these clauses:

• DFARS 252.204-7012. Since the end of 2017 it has required contractors that handle covered defense information to implement NIST SP 800-171.
• DFARS 252.204-7019 and 252.204-7020. These require a current NIST SP 800-171 assessment score posted in the Supplier Performance Risk System (SPRS).
• DFARS 252.204-7021. This is the clause that writes a specific CMMC level into a contract.

If you see 7012, the 110 requirements are not a future obligation. They apply now. CMMC is the way the Department added to check them.

If you only ever receive FCI, such as purchase orders and schedules that are not meant for the public, your target is probably Level 1, not Level 2. Our guide to Level 1 or Level 2 walks through the difference. If you are not sure what you receive, ask your prime directly. Primes must pass CMMC requirements down to any subcontractor that will process, store or transmit FCI or CUI, so they should be able to tell you which level they expect. Have you had that conversation with your prime yet, or are you waiting for them to bring it up?

Is CMMC Phase 2 suspended, and should my shop wait?

Here is what is settled. The CMMC program rule (32 CFR Part 170) took effect in December 2024. The DFARS rule that puts CMMC into contracts took effect on November 10, 2025, and that started Phase 1. In Phase 1, the requirements showing up in new solicitations are mainly self-assessments. Under the rule's phased plan, Phase 2 begins one year after Phase 1. Phase 2 is when third-party Level 2 certification starts appearing as a condition of award for applicable contracts.

Here is what is not settled. In the last week, an advisory firm announced a briefing on CMMC reform that described a task force review and a suspension of Phase 2. We could not confirm from an official Department of Defense or Federal Register source what exactly was paused, for how long, or whether the rule itself is changing. Until there is an official notice, treat it as unsettled. Be careful with anyone who sounds certain either way.

Here is what does not change either way:

• If your contract includes DFARS 252.204-7012, the 110 requirements apply now.
• If your contract includes 7019 or 7020, your prime and the Department expect your SPRS score now.
• Your prime is still responsible for its supply chain, and its questions to you will keep coming.

So here is a real question: if the timeline slipped by six months, would your shop be in a better position at the end of it, or the same one? A pause only helps if you use it.

What does CMMC Level 2 actually ask a small shop to do?

The 110 requirements fall into 14 families. In plain terms, they ask you to:

• Control who gets in (Access Control, Identification and Authentication): unique accounts, strong passwords, multifactor authentication, and only the access each person needs.
• Train your people (Awareness and Training): everyone who touches CUI knows the risks and their role.
• Keep records (Audit and Accountability): logs that show who did what, and that someone actually reviews.
• Keep systems in a known state (Configuration Management, Maintenance): a standard setup for your machines, controlled changes, and supervised maintenance.
• Protect the data itself (Media Protection, System and Communications Protection): encryption, control over USB drives and printouts, and clear limits on where CUI can travel.
• Protect the building and the people (Physical Protection, Personnel Security): locked doors, escorted visitors, screened staff, and access removed when someone leaves.
• Watch and respond (Incident Response, System and Information Integrity, Risk Assessment, Security Assessment): patching, malware protection, monitoring, regular self-checks, and a plan for when something goes wrong.

Two documents sit at the center. The System Security Plan (SSP) describes your environment and how you meet each requirement. The Plan of Action and Milestones (POA&M) lists what is not done yet and when it will be.

A few details matter for small shops:

• The CMMC rule allows a conditional Level 2 status with some items still open on a POA&M. That only works if you reach a minimum score, only for certain requirements, and only if you close those items within 180 days.
• Under DFARS 252.204-7012, you must report cyber incidents that affect covered defense information to the Department within 72 hours of discovering them.
• If you use a cloud service to store or process CUI, 7012 sets security requirements for that provider, so the tools you choose matter.

Assessors look for two things: that each requirement is written down, and that you actually do it. A policy nobody follows does not pass.

Where does a shop with no security program start?

Start with a map, not a product. Here is an order of work for a shop starting from nothing:

1. Find your CUI. Trace how it arrives (email, portal, USB, paper), where it is stored, who opens it, and where it goes when the job ships. Draw it on one page.
2. Shrink the boundary. The fewer machines, accounts and people that touch CUI, the less falls inside your assessment scope. Many small shops set up an enclave, which is a walled-off set of systems used only for CUI work.
3. Write down what you already do. Locked doors, key control, a firewall and individual logins all count, and writing them down is real progress.
4. Draft your System Security Plan. It does not need to be elegant. It needs to be true.
5. Assess yourself honestly. Check each requirement against the assessment objectives in NIST SP 800-171A, and score yourself using the DoD Assessment Methodology. An honest low score helps you far more than a hopeful high one. The Department of Justice has brought False Claims Act cases against contractors that misrepresented their cybersecurity compliance.
6. Build your POA&M and close the heaviest gaps first. The scoring method counts some requirements, such as multifactor authentication, more heavily than others.
7. Post your score in SPRS if your contract requires it, and update your SSP whenever your environment changes.

None of this requires a CISO on staff. It does require someone who owns it. Which of these steps could you finish this month with the people you already have?

How does Level 2 readiness change the way my prime sees my shop?

Primes have to pass CMMC requirements down and know which of their suppliers can handle CUI. When a prime decides who gets the next drawing package, a supplier with a current SPRS score, a real SSP and a dated POA&M has already answered the questions the prime would ask. That moves you from a supplier the prime has to worry about to one it can rely on.

The benefit goes beyond the prime. The same SSP and daily habits give you clear answers when a commercial customer sends a security questionnaire. And in your community, a shop that keeps its defense work also keeps its jobs and keeps its local suppliers busy.

This is where in-kind help can matter. Here is what an in-kind grant is: support delivered as work and expertise, at no cost to you. If your shop has no security lead, having someone work through the first steps alongside you can be the difference between a plan on paper and a plan you actually follow.

Frequently asked questions

Where to start

If your shop is starting from zero and wants a hand with the first steps, learn how Cyber Grants Alliance in-kind cybersecurity grants work, or apply for in-kind support.

Sources

• 32 CFR Part 170, Cybersecurity Maturity Model Certification (CMMC) Program, eCFR
• NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
• NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information
• DFARS clauses 252.204-7012, 252.204-7019, 252.204-7020 and 252.204-7021, Acquisition.gov
• Department of Defense CIO, CMMC program page
• Department of Defense, NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1
• U.S. Department of Justice, Civil Cyber-Fraud Initiative announcement, October 2021