CMMC Level 2 Certification: Requirements, Scoring and Timeline

CMMC Level 2 is the 110 security requirements of NIST SP 800-171 Revision 2, which protect controlled unclassified information (CUI) on contractor systems. A contractor or subcontractor that handles CUI on a the Department of War contract needs a Level 2 status. The contract’s program office picks the type, a self-assessment by the contractor or a certification assessment by a C3PAO. A score of 80 percent of the 110 points, which is 88 (0.8 x 110), with only permitted gaps, earns a Conditional status. The contractor then has 180 days to close a Plan of Action and Milestones (POA&M). Meeting all 110 earns a Final status. the Department of War’s program page says it lasts three years, with an affirmation in SPRS every year.

the Department of War suspended the Phase 2 requirements on July 13, 2026, and its program page says Phase 1 “may only require self-assessments at two levels”. Rule 170.3(e)(1) still lets the Department of War request a C3PAO status in Phase 1. Phase 2 would have required a C3PAO status for award on applicable contracts. The 80 percent line is in the 32 CFR Part 170 rule. Level 2 is the middle of the three levels in the CMMC program.

What Level 2 requires

Level 2 adds nothing to NIST’s list. The rule says it “does not add any additional security requirements to those selected in NIST SP 800-171 R2”, and the Department of War’s program page ties the 110 to DFARS clause 252.204-7012. The Cyber AB groups them into 14 domains.

Three conditions shape every assessment:

• A current System Security Plan. Without an up-to-date SSP, the rule says an assessment cannot be completed.
• A defined scope. A certification applies only to the assessed scope.
• Cloud services at FedRAMP Moderate. A cloud provider that handles CUI must be FedRAMP Authorized at Moderate or meet requirements equivalent to that baseline.

The contractor keeps its assessment evidence for six years from the status date.

Who needs Level 2

The rule applies to every the Department of War contract and subcontract awardee that processes, stores or transmits CUI on contractor information systems. A subcontractor that handles CUI on a prime’s behalf is covered the same way. Under the DFARS rule, the program office sets the level for a prime contract, and the prime or next higher-tier subcontractor sets it for a subcontract.

Contractors that handle only federal contract information need Level 1, which allows no POA&M.

Self-assessment or C3PAO

The rule lets the program office or requiring activity choose the Level 2 status for each contract. The two paths cover the same 110 requirements and differ in who assesses.

	Level 2 (Self)	Level 2 (C3PAO)
Assessor	The contractor	An authorized or accredited C3PAO
Results go to	SPRS, uploaded by the contractor	eMASS, uploaded by the C3PAO, then sent to SPRS automatically
POA&M closeout	Contractor self-assessment	Second C3PAO assessment
The Department of War estimate, small entity	$34,277 (three-year total $37,196)	$101,752 (three-year total $104,670)
The Department of War estimate, other than small	$43,403 (three-year total $48,827)	$112,345 (three-year total $117,768)
Counts for the other path	No: a self score does not satisfy a C3PAO requirement	Yes: a C3PAO status also satisfies Level 2 (Self)

Source: 32 CFR Part 170 final rule, Federal Register, October 15, 2024.

the Department of War’s figures leave out the cost of implementing the requirements, which the rule says earlier clauses already required. A Level 2 (C3PAO) status is required where the contract’s solicitation calls for it.

How Level 2 is scored

The maximum score is 110, the number of requirements. Every requirement scored NOT MET subtracts its value, so a score can go negative. Values run 5, 3 or 1 points. A requirement is worth 5 when leaving it out could lead to significant exploitation of the network or exfiltration of CUI, 3 when the effect is specific and confined, and 1 when the effect is limited or indirect.

Two requirements can earn partial credit:

• Multifactor authentication costs 3 points if it covers only remote and privileged users, and 5 points if it covers no one.
• Encryption of CUI costs 3 points if it is employed but not FIPS-validated, and 5 points if it is not employed.

A Conditional status needs 80 percent of the 110 points, which is 88 (0.8 x 110) and leaves 22 points of slack. The POA&M carries two limits:

• Points. No requirement worth more than 1 point may sit on the POA&M. The exception is encryption that is employed but not FIPS-validated, worth 3 points. In its comment responses the Department of War says a POA&M can hold up to 22 one-point requirements, or that encryption item plus up to 19 of them.
• Six requirements. AC.L2-3.1.20 External Connections, AC.L2-3.1.22 Control Public Information, CA.L2-3.12.4 System Security Plan, PE.L2-3.10.3 Escort Visitors, PE.L2-3.10.4 Physical Access Logs and PE.L2-3.10.5 Manage Physical Access never sit on a POA&M.

A POA&M earns no score credit. The rule scores a requirement NOT MET whether or not a POA&M describes it.

The path from assessment to reassessment

The Level 2 path with a C3PAO, from 32 CFR 170.17, 170.21, 170.22 and 170.24 and the Department of War’s cost estimate. The bar is drawn to scale over three years.

A passing assessment ends in one of two results. All 110 requirements MET gives a Final Level 2 status. A score of 80 percent of 110 points or more (88 or more) with a permitted POA&M gives a Conditional status.

A Conditional status runs on a 180-day clock. A closeout assessment re-assesses only the NOT MET requirements, and for a C3PAO status a C3PAO performs it. If the POA&M is not closed in 180 days, the Conditional status expires. When that happens during a contract, standard contractual remedies apply, and the contractor is ineligible for additional awards that require Level 2 (C3PAO) or higher until a new status is achieved.

The three-year validity has two readings. The Department of War’s program page counts the three years from the Conditional status date. The DFARS rule counts a Final Level 2 status as current for three years from the Final status date, with an affirmation no older than one year. The rule’s preamble also bases the deadlines on the Conditional status date when a POA&M was required.

The Affirming Official, a senior representative of the contractor, files an affirmation in SPRS after every assessment, including the closeout, and once a year after a Final status. The Department of War’s program page says the status lapses if an annual affirmation is missed.

How the phase-in stands

The four phases start one calendar year apart, and Phase 1 began when the DFARS rule took effect on November 10, 2025. The 32 CFR Part 170 rule took effect on December 16, 2024.

• Phase 1 began November 10, 2025. The Department of War intends to require a Level 1 (Self) or Level 2 (Self) status for applicable contracts, and it may request a Level 2 (C3PAO) status instead at its discretion.
• Phase 2 was due November 10, 2026. It would have required a Level 2 (C3PAO) status for applicable contracts as a condition of award. The Department of War suspended it on July 13, 2026, per its program page.
• Phases 3 and 4 start one calendar year after the phase before. Phase 3 would extend the C3PAO requirement to all applicable contracts, and Phase 4 is full implementation. The law firm Covington reports that the July 13 memorandum put both on hold pending further notice.

The same announcement created a CMMC reform task force with a 60-day deadline. Covington reports in a September 21 update that the task force’s report was due September 11, 2026 and had not been made public. The Department of War’s press release says the Department will enforce NIST SP 800-171 Revision 2 “through self-assessments and select government-led assessments”, and that contractors remain bound by DFARS 252.204-7012.

The Department of War’s program page says CMMC “may only require self-assessments at two levels” during the pause. Rule 170.3(e)(1) gives the Department of War discretion to request a Level 2 (C3PAO) status in Phase 1.

What a C3PAO assessment involves

The C3PAO assesses against NIST SP 800-171A, scores under the rule’s method, and uploads the results to eMASS. It delivers a CMMC Assessment Findings Report to the contractor. The contractor hashes its evidence files and passes the list to the C3PAO for upload.

The Department of War’s cost estimate splits the work into three phases: planning and preparing, conducting the assessment, and reporting results. It prices the C3PAO engagement at $260.28 an hour for 120 hours of a 3-person team (small entity) or 200 hours of a 5-person team (other than small). The other lines in the estimate are the contractor’s own labor and outside service provider hours.

A NOT MET requirement can be re-evaluated during the assessment and for 10 business days after the active assessment period. Three conditions apply: new evidence exists, the change cannot weaken another requirement scored MET, and the findings report has not yet been delivered.

The Cyber AB reported 107 authorized C3PAOs in June 2026. The Department of War says supply and demand set what they charge.

Software that supports Level 2

Vendors say their platforms prepare the SSP, the evidence and the POA&M. A Level 2 certification assessment itself has to come from an authorized or accredited C3PAO. The CMMC software ranking covers six platforms, and the rubric counts CMMC as one of five extra frameworks in its framework coverage criterion, worth 15 of 100 points.

Sprinto lists CMMC Level 2 among the frameworks a customer can pick on its pricing page. It says it pairs a contractor with a Registered Practitioner Organization from its network for scoping, with SSP templates. Sprinto scores 84 and Vanta 82, both above Drata at 76.

Vanta says its CMMC product spans Levels 1 through 3, with an SPRS score monitor, SSP generation and POA&M management. A-LIGN and Schellman are the C3PAO partners it names.

Drata says it keeps ownership, status and evidence links for each POA&M item and maps CMMC to controls shared across its frameworks.

Secureframe prices its Defense plan by quote. The plan’s listing names a Managed CUI Enclave, an SPRS Score Tracker, an SSP and a POA&M, and Secureframe says Defense Navigator guides teams through scoping, implementing controls and a self-assessment. Secureframe holds its own CMMC Level 2 certification, earned in September 2025 after an assessment by Redspin. It scores 75.

Secureframe’s Defense Navigator in a sample workspace.

Scrut carries a CMMC 2.0 Level 2 tile on its all-frameworks page and scores 72. OneTrust says its CMMC 2.0 page covers “all three maturity levels”, and it scores 64. Thoropass titles its CMMC product page Level 1 and says it makes moving up to Level 2 and 3 easier. It scores 52.

The scores measure each platform as a whole, and no rubric criterion rates Level 2 depth separately. The six platforms in that ranking keep the same totals in the broader compliance management ranking. Their starting prices are general plan prices with no CMMC-specific figure.