Level 2 does not automatically require a C3PAO assessment simply because an organization handles Controlled Unclassified Information (CUI). The contract decides whether self-assessment, third-party certification, or a government review is required.
Choose the CMMC level named in your contract
The applicable CMMC level comes from the solicitation, award, modification, or subcontract flow-down that contains the CMMC requirement.
Contract rule: Level 1 normally applies when the contract involves FCI. Level 2 applies when the contract requires CUI protection. Level 3 applies only when DoD selects programs needing protection from advanced threats.
Find the clause before pricing the work
Start with the prime contract or solicitation. Then check each amendment and subcontract flow-down.
Look for DFARS 252.204-7021. It introduces CMMC requirements.
Keep it separate from DFARS 252.204-7012, 252.204-7019, and 252.204-7020. Those clauses may create separate duties.
Separate FCI, CUI, and ordinary data
Federal Contract Information is information made for or given by the government under a contract. It is not meant for public release.
Controlled Unclassified Information is sensitive government information. It needs safeguards or sharing controls, even though it is not classified.
The data label shapes the required CMMC path.
Confirm whether the acquisition is prioritized
Level 2 has two CMMC 2.0 routes. Some acquisitions allow annual self-assessment.
Prioritized acquisitions require a C3PAO certification assessment. Both routes require an annual affirmation by a senior official.
That official must truthfully state that the organization meets applicable requirements.
Level 2 may mean self-assessment or C3PAO
A Level 2 requirement does not always require a C3PAO certification assessment.
A C3PAO is authorized to conduct Level 2 certification assessments. Its assessors test the defined scope through interviews, observation, and evidence review.
An annual Level 2 self-assessment checks all 110 NIST SP 800-171 requirements. The contractor must document the results.
The organization needs proof for its conclusion. It cannot treat this as a yearly questionnaire.
The Supplier Performance Risk System (SPRS) stores NIST SP 800-171 assessment scores under certain DFARS clauses. An SPRS score does not prove CMMC certification.
The score uses the DFARS 252.204-7019 self-assessment method. CMMC has separate assessment rules.
CMMC Level 3 is not simply a stricter Level 2. It applies to selected DoD programs facing advanced persistent threats.
A Level 3 organization must first meet 110 NIST SP 800-171 practices. It must then add Level 3 practices based on NIST SP 800-172.
The government leads Level 3 assessments. The CMMC program and contract set their schedule.
A completed self-assessment does not make a company “CMMC certified.” Certification depends on the assessment route required by that contract.
Scope every FCI and CUI data path
A valid CMMC scope includes each person, system, service, and connection that stores, processes, or sends FCI or CUI.
Trace CUI beyond the corporate network
Follow one CUI file from receipt through editing, review, storage, backup, and deletion. Include every place it travels.
Check endpoints, email, collaboration tools, ticket systems, and code repositories. Also check printers, mobile access, and security monitoring tools.
The most common error is mapping only the main network. CUI often moves through cloud tools and support channels.
Include suppliers and managed services
Review managed service providers, cloud hosts, security operations providers, consultants, subsidiaries, and subcontractors. Include them when they can access CUI or FCI.
Calling a provider “out of scope” does not remove risk. This approach fails when its administrators have privileged access.
A common case involves an outsourced IT firm with tenant administrator rights. That provider belongs in the review.
Keep independent duties separate
CMMC confirms contract eligibility at the required level. It does not replace other duties.
Those duties can include protecting FCI or CUI. They can also include incident reports under DFARS 252.204-7012.
You may also need to preserve affected images and logs. Contract-specific requirements still apply.
CMMC decision path
1. Read clause
Is DFARS 252.204-7021 present?
2. Classify data
FCI, CUI, or neither?
3. Match level
Level 1, 2, or 3
4. Match review
Self, C3PAO, or government
Annual affirmations apply to the required CMMC level. The contract decides the required route.
Evidence, owners, and a 90-day readiness plan
CMMC readiness needs operating evidence. A polished policy binder is not enough.
Build a level 1 evidence set
Level 1 covers 17 practices from basic safeguards in FAR 52.204-21. Its evidence can be simpler than Level 2 evidence.
It must still show that only authorized users access FCI. It must show that FCI avoids needless exposure.
Build a level 2 evidence set
Level 2 aligns with 110 requirements in NIST SP 800-171. Your SSP should describe the system boundary and responsible roles.
It should also describe control methods and inherited cloud controls. Include any permitted POA&M items.
For Level 2, name an owner for each requirement and retain current proof. A policy alone cannot show that a control works.
| Requirement area | Auditable evidence example | Typical owner |
|---|
| Multi-Factor Authentication | Identity-provider settings and recent MFA sign-in logs | Identity administrator |
| Asset inventory | Current device, software, and system inventory | IT operations lead |
| Incident response | Exercise record, ticket timeline, and after-action fixes | Security lead |
| Backup recovery | Restore test dated within the review cycle | Infrastructure owner |
Use 90 days to test the evidence
A 90-day readiness plan should begin with weeks 1 through 3. Review contracts, map data, and approve scope.
Use weeks 4 through 7 to find control gaps. Assign owners and make technical fixes.
Use weeks 8 through 12 to sample evidence and run an internal mock review. Then hold an executive review and schedule an assessment if needed.
Link zero trust to assessment proof
Zero Trust is not a separate CMMC level. It is a security approach that supports CMMC evidence.
It limits access to verified users and devices. It also applies least privilege and monitors activity over time.
This guidance does not replace the actual contract clause, legal advice, or a contracting officer’s decision. It focuses on organizations with DoD contracts or subcontracts that have CMMC requirements.
For Level 2, the 110 requirements span 14 security domains. These include Access Control, Awareness and Training, and Audit and Accountability.
They also include Configuration Management and Identification and Authentication. Other domains cover incident response, maintenance, media, and personnel security.
The remaining domains cover physical protection, risk assessment, security assessment, communications protection, and system integrity. Level 1 has a narrower baseline.
Level 1 evidence should still be auditable. Examples include authorized FCI user lists, unique account screenshots, visitor logs, and disposal records.
You can also show endpoint antivirus status and proof of employee safeguarding instructions. These records show daily practice, not policy words.
Common questions
Do I need level 2 if I handle CUI?
You need the Level 2 path named in your contract when it covers CUI. The path may require annual self-assessment or a C3PAO certification assessment.
The acquisition and DFARS 252.204-7021 language decide which path applies.
Is a SPRS score the same as CMMC certification?
No, an SPRS score is not CMMC certification. It records a NIST SP 800-171 assessment score under applicable DFARS requirements.
CMMC has separate assessment and annual affirmation rules.
How long should CMMC level 2 preparation take?
Most initial Level 2 preparation takes between 90 and 180 days after scope approval. Work takes longer when CUI sits in unmanaged SaaS or remote endpoints.
It also takes longer when providers lack clear responsibilities.
What does a senior official affirm each year?
A senior official affirms that the organization meets applicable CMMC requirements for its required level. The statement needs current evidence.
Do not rely on last year’s screenshots or an unfinished fix plan.
Are CMMC levels 4 and 5 still valid?
No, CMMC 2.0 has only Levels 1, 2, and 3. CMMC 1.0 Levels 4 and 5 were removed.
Some advanced practices moved into Level 3 through NIST SP 800-172.
What to do before you bid or renew
Treat the contract clause as the source of truth. Then make the data boundary match daily work.
First, have contracts, security, IT, engineering, and procurement review the solicitation together. Second, map FCI and CUI across cloud services, endpoints, repositories, suppliers, and privileged support access.
Third, assign each required practice to an owner. That owner must be able to show current evidence.
What matters most:- The contract clause, data type, and acquisition priority decide the applicable CMMC route.
- Level 2 can require annual self-assessment or a triennial C3PAO assessment. Both routes require annual affirmation.
- SPRS scores, SSPs, and policy binders do not equal CMMC certification.
- Scope cloud tools, remote devices, code repositories, and providers before estimating cost or timing.
- Evidence of real work turns security controls into assessment readiness.
Learn more
Here are some additional resources on this subject:
