CMMC Level 2 Requirements: A Practical Breakdown for Small Contractors

CMMC Level 2 is the certification tier most Connecticut and Rhode Island defense subcontractors handling Controlled Unclassified Information (CUI) need. It aligns with all 110 security requirements in NIST SP 800-171. Here’s a practical breakdown of what that actually means — for the full compliance program and how Kyber delivers it, see our CMMC compliance services page.

The 110 Requirements, Organized Into 14 Control Families

• Access Control — who can access CUI and under what conditions
• Awareness & Training — security training for all personnel with CUI access
• Audit & Accountability — logging and reviewing system activity
• Configuration Management — controlling system configuration changes
• Identification & Authentication — verifying user and device identity, including MFA
• Incident Response — detecting, reporting, and responding to security incidents
• Maintenance — controlling system maintenance activities
• Media Protection — protecting and sanitizing media containing CUI
• Personnel Security — screening personnel prior to CUI access
• Physical Protection — limiting physical access to systems and facilities
• Risk Assessment — periodically assessing organizational risk
• Security Assessment — assessing and monitoring control effectiveness
• System & Communications Protection — monitoring and protecting network communications
• System & Information Integrity — identifying and correcting system flaws

Required Artifacts: SSP and POA&M

A System Security Plan (SSP) documents your system boundary, asset inventory, and implementation status for every applicable requirement — it’s the primary document reviewed in any assessment. A Plan of Action and Milestones (POA&M) documents open gaps, assigned owners, and remediation timelines. Both are required artifacts for Level 2, regardless of assessment path.

Self-Assessment vs. C3PAO Assessment

Depending on program sensitivity, Level 2 requires either an annual self-assessment with an affirmed score submitted to SPRS, or a triennial third-party assessment conducted by a Certified Third-Party Assessment Organization (C3PAO). Your contracting officer or prime contractor will specify which path applies to your contract.

Practical Steps to Prepare

1. Gap assessment against all 110 requirements
2. Build or update your SSP to reflect actual system boundaries and control implementation
3. Remediate technical gaps — MFA, access controls, audit logging, encryption, and endpoint protection are the most common findings
4. Build and maintain your POA&M for any gaps still in progress
5. Submit your SPRS score, or schedule and prepare for your C3PAO assessment

Common Reasons Contractors Fail Their First Assessment

Missing or incomplete SSPs, uncontrolled CUI on personal devices or unencrypted channels, missing MFA on CUI-touching systems, and incident response plans that exist on paper but have never been tested are the most frequent gaps. See our full breakdown on the CMMC compliance services page for how each of these gets remediated.

Frequently Asked Questions

What are the 14 control families in CMMC Level 2 / NIST 800-171?

Access Control, Awareness & Training, Audit & Accountability, Configuration Management, Identification & Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System & Communications Protection, and System & Information Integrity.

Do all 110 requirements apply to every contractor?

All 110 apply to any system in scope for handling CUI. Properly scoping your system boundary — separating CUI-touching systems from the rest of your environment — is often the first and most impactful step in reducing remediation burden.

What’s the difference between a CMMC self-assessment and a C3PAO assessment for Level 2?

A self-assessment is conducted internally with an affirmed score submitted to SPRS. A C3PAO assessment is conducted by an independent, accredited third-party organization. Which is required depends on the sensitivity of the specific program and contract.

How long does it take to meet CMMC Level 2 requirements from scratch?

For a contractor starting from standard IT practices, readiness typically takes four to nine months depending on gap severity and assessment path — gap assessment, remediation, SSP finalization, and assessment scheduling each take real time.

What is a POA&M and can I use one to pass certification?

A POA&M documents open gaps and remediation timelines. It demonstrates forward progress but does not substitute for implementing required controls — assessors evaluate whether the POA&M is credible, not whether it exists.

Where can I get help preparing for CMMC Level 2?

Kyber Security is a CyberAB-certified Registered Practitioner Organization (RPO), authorized to provide CMMC gap assessments, SSP development, technical remediation, and assessment preparation for Connecticut and Rhode Island defense contractors.