What Is CMMC 2.0 and Why It Exists
The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense's framework for ensuring that defense contractors protect sensitive information. CMMC 2.0 replaced the original five-level model with a simplified three-level structure, aligning more closely with existing NIST standards and reducing the compliance burden on smaller contractors.
The driver behind CMMC is straightforward: defense contractors handle Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) that adversaries actively target. Self-attestation under DFARS 252.204-7012 was not working — contractors claimed compliance without actually implementing the required controls. CMMC adds third-party verification to ensure contractors are doing what they say they are doing.
If you are new to compliance frameworks in general, our guide on what GRC is and why it matters provides foundational context for how frameworks like CMMC fit into a broader governance strategy.
Why Level 2 Matters
CMMC 2.0 has three levels:
- Level 1 (Foundational): 17 practices based on FAR 52.204-21. Covers FCI. Self-assessment is sufficient.
- Level 2 (Advanced): 110 practices based on NIST SP 800-171 Rev 2. Covers CUI. Requires third-party assessment by a C3PAO for most contracts.
- Level 3 (Expert): Based on a subset of NIST SP 800-172. Covers the most sensitive programs. Requires government-led assessment.
Level 2 is where the majority of defense contractors land. If your contract involves CUI — and most contracts involving technical data, engineering drawings, controlled technical specifications, or operational security information do — you need Level 2.
The critical distinction is that Level 2 requires a third-party assessment from a CMMC Third-Party Assessment Organization (C3PAO), not just a self-attestation. This means your controls must actually be implemented, documented, and demonstrable — not just described in a policy.
The 14 Domains of NIST 800-171
CMMC Level 2 maps directly to the 110 security requirements in NIST SP 800-171, organized across 14 domains. Understanding these domains is essential for scoping your compliance effort.
Access Control (AC) — 22 Requirements
The largest domain. Covers account management, access enforcement, remote access, wireless access, and the principle of least privilege. Most organizations underestimate the scope here — it includes not just user accounts but also system accounts, service accounts, and automated processes.
Awareness and Training (AT) — 3 Requirements
Security awareness training for all users and specialized training for roles with security responsibilities. Training must be documented and refreshed periodically.
Audit and Accountability (AU) — 9 Requirements
System audit logging, log protection, log review, and correlation. You must create, protect, and review audit records — and be able to trace actions back to individual users.
Configuration Management (CM) — 9 Requirements
Baseline configurations, change control, least functionality, and software restrictions. Your systems must have documented configurations, and changes must go through a controlled process.
Identification and Authentication (IA) — 11 Requirements
User identification, authentication for network and local access, multi-factor authentication, and cryptographic authentication. MFA for remote and privileged access is a hard requirement here.
Incident Response (IR) — 3 Requirements
Incident handling capability, including preparation, detection, analysis, containment, recovery, and user response activities. You must also report incidents to appropriate authorities.
Maintenance (MA) — 6 Requirements
System maintenance controls, including maintenance tools, remote maintenance, and maintenance personnel oversight. Remote maintenance sessions must be logged and audited.
Media Protection (MP) — 9 Requirements
Controls for protecting, sanitizing, and disposing of system media containing CUI. This includes both digital media and physical documents.
Personnel Security (PS) — 2 Requirements
Personnel screening and access management during personnel actions such as terminations and transfers. Access must be revoked promptly when personnel leave.
Physical Protection (PE) — 6 Requirements
Physical access controls, visitor management, monitoring, and alternative work sites. If CUI exists in physical form or on systems in accessible locations, physical controls apply.
Risk Assessment (RA) — 3 Requirements
Periodic risk assessments, vulnerability scanning, and remediation. Your risk assessment must consider threats, vulnerabilities, likelihood, and impact.
Security Assessment (CA) — 4 Requirements
Periodic assessment of security controls, system security plans, and plans of action and milestones (POA&Ms). This is the self-monitoring requirement that feeds your C3PAO assessment.
System and Communications Protection (SC) — 16 Requirements
Boundary protection, cryptographic protections, network segmentation, session termination, and CUI handling at system boundaries. This domain gets technical — it covers how data flows between systems and networks.
System and Information Integrity (SI) — 7 Requirements
Flaw remediation, malware protection, security alerts, and system monitoring. Your vulnerability management and patch management processes live here.
The CMMC 2.0 Enforcement Timeline
CMMC 2.0 rulemaking has been phased, with enforcement ramping incrementally:
- Phase 1: Self-assessment for Level 1 and some Level 2 contracts appears in solicitations
- Phase 2: Third-party C3PAO assessments required for Level 2 contracts involving prioritized CUI
- Phase 3: Full Level 2 C3PAO assessment requirements across applicable contracts
- Phase 4: Level 3 government-led assessments for highest-sensitivity programs
The practical takeaway is that waiting until CMMC appears in your specific contract solicitation is too late. Assessment readiness takes most organizations 12 to 18 months. Starting now means you are building the practice, not scrambling to paper over gaps.
How to Prepare for CMMC Level 2 Assessment
Step 1: Scope Your CUI Environment
Before you implement controls, you must know where CUI lives. Map every system, network segment, application, and storage location that processes, stores, or transmits CUI. The smaller your CUI boundary, the fewer systems need to meet all 110 requirements.
Organizations that invest in scoping — by isolating CUI into dedicated enclaves — dramatically reduce their compliance surface area. This is the single highest-leverage activity in CMMC preparation.
Step 2: Conduct a Gap Assessment Against NIST 800-171
Walk through all 110 requirements and document your current state for each. For every requirement, record whether the control is fully implemented, partially implemented, or not implemented. This gap assessment becomes the foundation of your System Security Plan and POA&M.
If you are mapping controls across multiple frameworks — for example, NIST CSF and CMMC simultaneously — a cross-framework mapping approach prevents duplicate work. Our NIST CSF 2.0 implementation guide covers how to structure this.
Step 3: Develop Your System Security Plan (SSP)
The SSP is the document that describes how your organization meets each of the 110 requirements. It is the primary artifact your C3PAO will review. The SSP should be specific — not boilerplate language copied from a template. Assessors can tell the difference.
For each requirement, the SSP should describe: the control implementation, the systems in scope, the responsible parties, and how compliance is verified. Generic statements like "we use encryption" are insufficient — specify what encryption, where, managed by whom, and how it is validated.
Step 4: Build Your Plan of Action and Milestones (POA&M)
The POA&M documents controls that are not yet fully implemented, along with your plan and timeline for closing each gap. A POA&M is not a sign of failure — it is a sign of honest assessment and structured remediation.
However, POA&Ms have limits under CMMC. Certain high-weight requirements cannot be on a POA&M at the time of assessment. Understand which requirements are "must-pass" before your C3PAO engagement.
Step 5: Collect and Organize Evidence
Your C3PAO will want to see evidence that controls are implemented and operating. This includes configuration screenshots, policy documents, training records, access review logs, vulnerability scan reports, and incident response documentation.
Automating evidence collection through platform integrations saves significant preparation time and ensures evidence is current rather than stale screenshots from months ago.
Step 6: Engage a C3PAO
C3PAOs are authorized by the CMMC Accreditation Body (the Cyber AB) to conduct assessments. Engage early — C3PAO capacity is limited, and scheduling can take months. A pre-assessment readiness review with your C3PAO can identify issues before the formal assessment.
Common Mistakes That Derail CMMC Compliance
Treating CMMC as an IT-Only Problem
CMMC compliance involves HR (personnel security), facilities (physical protection), legal (contract flow-down), and executive leadership (governance). Organizations that delegate CMMC entirely to IT miss requirements in at least three domains.
Underscoping the CUI Boundary
If you define your CUI boundary too narrowly, you miss systems that actually touch CUI. If you define it too broadly, you create an unnecessarily large compliance surface. Getting the boundary right requires collaboration between security, IT, and the program teams that handle CUI daily.
Copying SSP Templates Verbatim
Assessors have seen every template. A boilerplate SSP that describes generic controls rather than your actual implementation will generate findings. Write the SSP to describe what your organization actually does — not what a template says you should do.
Ignoring Supply Chain Flow-Down
If you use subcontractors who handle CUI, they must also meet CMMC requirements. This flow-down obligation catches many prime contractors off guard. Map your supply chain early and assess subcontractor readiness alongside your own.
Waiting for the Requirement to Appear in a Contract
By the time CMMC appears in a solicitation, you need to be assessment-ready — not starting your gap assessment. The organizations winning contracts will be those already certified or in active assessment.
How a GRC Platform Helps With CMMC
CMMC compliance generates a significant volume of documentation, evidence, and tracking requirements. A GRC platform helps by:
- Mapping all 110 NIST 800-171 requirements to controls, evidence, and owners in a single system
- Tracking POA&M items with deadlines, owners, and status visibility
- Collecting evidence automatically from cloud, identity, and endpoint integrations
- Cross-mapping controls to other frameworks you maintain (SOC 2, ISO 27001, NIST CSF) so you do not duplicate work
- Generating SSP documentation from your actual control implementations rather than starting from scratch
- Providing assessment-ready reports that your C3PAO can review efficiently
If you are comparing platforms, our comparison of GRC tools for vCISOs covers what to look for in cross-framework support and evidence automation — both critical for CMMC programs. BlueRadius also provides guided CMMC readiness programs for organizations that want expert support alongside the platform.
Frequently Asked Questions
What is the difference between CMMC Level 1 and Level 2?
Level 1 covers Federal Contract Information (FCI) with 17 basic practices and allows self-assessment. Level 2 covers Controlled Unclassified Information (CUI) with 110 practices from NIST 800-171 and requires third-party assessment by a C3PAO for most contracts.
How long does it take to prepare for a CMMC Level 2 assessment?
Most organizations need 12 to 18 months to go from initial gap assessment to assessment-ready. The timeline depends on your starting posture, the size of your CUI environment, and the resources you dedicate to remediation.
Can I use a POA&M to pass a CMMC Level 2 assessment?
POA&Ms are allowed for some requirements, but certain high-weight requirements must be fully implemented at the time of assessment. Your C3PAO can advise which requirements are must-pass versus POA&M-eligible.
How much does a CMMC Level 2 assessment cost?
Assessment costs vary based on the size and complexity of your CUI environment, but organizations should budget for the C3PAO assessment fee plus the internal effort to prepare documentation, evidence, and remediation. Engaging a C3PAO early for a readiness review can reduce surprises.
Does CMMC replace NIST 800-171 self-attestation?
CMMC builds on NIST 800-171 by adding third-party verification. The technical requirements at Level 2 are the same 110 controls from NIST 800-171 Rev 2. CMMC adds the assessment mechanism and enforcement structure that self-attestation lacked.
Preparing for CMMC Level 2? Start your free trial of Radius360 to map all 110 NIST 800-171 requirements, track your POA&M, and collect evidence automatically. For guided CMMC readiness programs, talk to BlueRadius about building your path to certification.
