Back to Blog
    cmmc-compliance-steps
    cmmc-compliance-checklist
    cmmc-2-0-best-practices
    cmmc-security-requirements
    how-to-get-cmmc-certified

    Contractors: Fix the 110 CMMC 2.0 Controls Now with a 30/60/90 Plan

    Dustin CollettSeptember 25, 2026

    Most contractors need Level 2, which is identical to NIST SP 800-171 Revision 2 and its 110 security requirements. Certification runs either as a self-assessment or a third-party C3PAO review, with an annual affirmation filed in SPRS either way. Your immediate task: pull out your System Security Plan, confirm it reflects your actual environment, and start collecting evidence for the controls before an assessor or a prime contractor asks for it.

    TL;DR:

    • Level 2 requires full implementation and documentation of all 110 NIST SP 800-171 R2 controls, with emphasis on multi-factor authentication and encryption.
    • Assessments are either self-conducted or done by a third-party C3PAO, with ongoing annual affirmations in SPRS necessary to maintain compliance.
    • The scope must precisely include all systems, assets, and external service providers that process or transmit CUI, as oversight can create compliance gaps.
    • Most contractors are unprepared due to outdated SSPs and lack of concrete evidence, making early gap remediation and mock assessments critical.
    • Compliance remains mandatory despite the Phase II pause, as the underlying security requirements and contractual obligations continue to apply.

    Table of Contents

    CMMC 2.0 Levels: Which One Applies to Your Contracts?

    The model has three tiers, and your contract type decides which one governs you.

    Level 1 covers Federal Contract Information (FCI) and mirrors the 15 basic safeguards in 48 CFR 52.204-21. Self-assessment, annual affirmation, done. Level 2 applies once you handle Controlled Unclassified Information (CUI), and it requires full alignment with the 110 requirements in NIST SP 800-171 R2. Level 3 layers in a subset of NIST SP 800-172 controls for the highest-risk programs and always requires government-led assessment through DIBCAC.

    Here's the part contractors often miss: the contracting officer sets your required level in the solicitation, not you. That level then flows down through subcontracts. If your prime handles CUI and you touch any of it as a subcontractor, you likely inherit Level 2 obligations too, even if your own contract value is small.

    • Level 1: FCI only, 15 basic safeguards, self-assessment
    • Level 2: CUI, 110 NIST SP 800-171 R2 requirements, self or C3PAO assessment
    • Level 3: CUI plus elevated threat exposure, NIST SP 800-172 add-ons, government-led assessment

    What Level 2 Actually Requires: Controls, Scoring Weight, and Documentation

    Level 2 is not a CMMC-specific list. It is the NIST SP 800-171 R2 catalog, all 110 requirements, applied without exception. That means access control, incident response, configuration management, and audit logging all count equally on paper. In practice, some controls carry far more consequence than others.

    Pro Tip: Multi-factor authentication and encryption are the two controls most likely to sink an otherwise strong assessment. Fix them first, before you touch anything else on the SSP.

    Two requirements deserve top priority: multifactor authentication (IA.L2-3.5.3) and FIPS-validated encryption for CUI at rest and in transit (SC.L2-3.13.11). Both carry outsized weight under the scoring rules in 32 CFR 170.24, and both allow only limited partial credit if implemented incompletely. Incident response, security assessment, and access control categories tend to draw the closest assessor scrutiny because they generate the most inconsistent evidence across small organizations.

    Scoring reality check: Under §170.24, each Level 2 requirement carries a point value of 1, 3, or 5. Missing a high-value control like MFA or encryption may cause significant score deductions, which can push a marginal environment below the certification threshold.

    Assessors show up expecting a specific document set, not a verbal walkthrough. Before scheduling anything, make sure you have:

    • A current System Security Plan mapped to all 110 requirements
    • Written policies covering access control, incident response, and configuration management
    • Implementation evidence: screenshots, configuration exports, and audit logs
    • Current user lists tied to access privileges and MFA enrollment
    • A record of prior security assessments and remediation actions

    Our CMMC compliance quick wins breakdown covers the controls contractors can usually close out fastest.

    How Do CMMC Assessments, Scoring, and SPRS Reporting Actually Work?

    Level 1 stays self-assessed. Level 2 splits into two paths: Level 2 (Self), permitted for contracts the government designates as lower risk, and Level 2 (C3PAO), a third-party certification assessment required for programs handling higher-priority CUI. Level 3 always runs through DIBCAC, the DoD's own assessment arm, regardless of contract size.

    Whichever path applies, the CMMC Assessment Process follows the same four phases:

    1. Planning, the assessment team scopes the environment and reviews your SSP in advance.
    2. Conduct, assessors examine documents, interview staff, and test controls using NIST SP 800-171A methods.
    3. Reporting, findings are scored and compiled into a final report.
    4. Closeout, certificates are issued, or POA&M items are tracked to resolution.

    Scoring works on a point system. Every requirement is worth 1, 3, or 5 points based on its risk weight, and your total score determines certification eligibility. This is where POA&Ms get misunderstood. Under 32 CFR 170.21, a Plan of Action and Milestones can only support a Conditional certification if your score is sufficiently high relative to the total points, and certain high-value requirements, including MFA and FIPS encryption, generally cannot be deferred to a POA&M.

    "The suspension of Phase II implementation does not relieve contractors of their existing obligations under NIST SP 800-171 or DFARS 252.204-7012," the Cyber AB stated following the pause, adding that C3PAO certification remains a meaningful credential for contract competitiveness.

    Once certified, or self-assessed, you're not done. DFARS 252.204-7021 requires an annual affirmation of continuous compliance in SPRS, tied to a CMMC Unique Identifier (UID) for your organization. Skip the affirmation, and your status lapses even if the underlying controls are still solid.

    How Do You Determine CMMC Scope and Flow Requirements to Subcontractors?

    Scope determines everything else. Get it wrong, and you either overspend hardening systems that never touch CUI, or you leave a real gap an assessor will find immediately.

    Start by mapping every system, application, and storage location that processes, stores, or transmits FCI or CUI. That boundary, not your whole network, is what gets assessed.

    • Inventory every asset touching CUI or FCI, including laptops, servers, and cloud tenants
    • Identify External Service Providers (cloud hosts, IT vendors, MSPs) that handle CUI on your behalf
    • Confirm each ESP's own security posture is documented and available for assessor review
    • Draft subcontract language that flows down your required CMMC level explicitly
    • Collect written confirmation from subcontractors of their assessment status before work begins

    Pro Tip: The most common scoping mistake isn't missing a server, it's forgetting that a help desk vendor with remote access into your environment is an External Service Provider too, and needs to be accounted for in your scope boundary.

    Flowdown works the same way it does for you: if your prime requires Level 2, and your subcontractor handles any of that CUI, your subcontract needs to state that requirement plainly and require proof of it, not just a handshake assurance.

    Practical Readiness Checklist: A 30/60/90 Roadmap

    Contractors who fail assessments almost always trip on the same things: a stale SSP that doesn't match the current network, missing evidence for controls they actually implemented, and confusion over what can and cannot go on a POA&M. Practitioners consistently find that a tightly scoped asset inventory, mapped control by control to concrete evidence, cuts assessment time and rework substantially.

    1. Days 1 to 30: Update the SSP, enable MFA everywhere it's missing, and start centralizing logs.
    2. Days 31 to 60: Close encryption gaps, formalize incident response documentation, and validate access control lists against actual staff.
    3. Days 61 to 90: Run an internal mock assessment, remediate findings, and confirm SPRS score entry is accurate.

    Our 30/60/90 IT documentation checklist walks through building the SSP artifacts assessors expect to see.

    Why Contractors Can't Afford to Slow Down Now

    The Phase II pause has led some contractors to treat compliance as optional for the moment. That reading is wrong, and it's risky. NIST SP 800-171 and the DFARS 252.204-7012 safeguarding clause never went anywhere. Primes still expect subcontractor evidence, and a False Claims Act exposure exists the moment you affirm compliance in SPRS that your environment doesn't actually support.

    Readiness now protects your eligibility later, and it's far cheaper to fix gaps on your own schedule than under contract pressure. Managed monitoring and documentation support can absorb a real share of that ongoing burden.

    , Dustin Collett

    Get Assessment Ready With Collett Systems LLC

    A fixed, fully loaded IT stack with 24/7 monitoring and proactive support can be an alternative to guessing your way through CMMC prep, instead of a compliance retainer billed as a separate line item every time documentation is updated.

    Collett Systems LLC

    Our IT & Security Assessment gives you a direct gap list against the 110 NIST SP 800-171 R2 requirements, a prioritized remediation roadmap, and a realistic view of where a POA&M can help and where it can't under §170.21's restrictions. If you're already thinking about ongoing coverage, our Managed IT Services plan folds monitoring, patching, and documentation upkeep into one predictable per-user price, so the evidence an assessor wants is already being generated month to month instead of assembled in a scramble. For contractors specifically weighing certification risk, our cybersecurity assessment page details how we scope and prioritize findings. Book the assessment and get your gap list before your next contract renewal forces the issue.

    Sources

    FAQ

    What Are the Requirements for CMMC Level 2 for CUI?

    Level 2 requires full implementation of all 110 security requirements in NIST SP 800-171 R2, documented in a System Security Plan with supporting evidence. High-value controls like MFA and FIPS-validated encryption carry the most scoring weight under 32 CFR 170.24.

    Is CMMC Level 2 Still Required?

    Yes. The Phase II implementation pause affects the rollout schedule, not the underlying obligation. The Cyber AB has confirmed that NIST SP 800-171 and DFARS 252.204-7012 requirements remain in force regardless of the pause.

    How Much Does CMMC 2.0 Cost?

    Costs vary widely depending on your current security posture, whether you need Level 2 self-assessment or full C3PAO certification, and how much remediation your environment needs before assessment. Collett Systems LLC's IT & Security Assessment pricing is available on request through our assessment page.

    What Controls Are Required for CMMC 2.0 Level 2?

    All 110 requirements from NIST SP 800-171 R2 apply, spanning access control, incident response, audit and accountability, configuration management, and system integrity. None are optional, though scoring weight and POA&M eligibility differ by control under 32 CFR 170.21.

    Can I Use a POA&M to Pass a CMMC Assessment?

    Only within limits. Your assessment score must reach at least 0.8 of total possible points before a POA&M is allowed, and certain high-value requirements, including MFA and encryption, generally cannot be deferred to a POA&M at all.