A small defense contractor with a limited CUI footprint can use 12 weeks to get ready for a CMMC Level 2 assessment: scope the CUI boundary, assess against the 110 requirements, write the system security plan, fix gaps and collect evidence. Assessment dates, and whether you self-assess or use a C3PAO, are not yours alone to set.
What must the 12 weeks achieve?
CMMC is codified in 32 CFR part 170. Level 2 uses the 110 requirements from NIST SP 800-171 Revision 2. The rule describes two Level 2 routes: a self-assessment, and a certification assessment by a CMMC Third-Party Assessment Organization (C3PAO). Which one your contract needs depends on the information you handle and what the contracting officer specifies. The rule describes phased introduction of requirements into DoD contracts, so check your contract clauses.
Outcomes the rule cares about: all requirements met, an up to date system security plan (SSP) at assessment, results posted to SPRS or, for C3PAO assessments, entered by the assessor, and an annual affirmation by a senior official. A conditional status with a plan of action and milestones (POA&M) must be closed out within 180 days or it expires. Which requirements may sit on a POA&M is limited by the rule, so read the relevant section.
This calendar assumes a company of tens of people, one main enclave for CUI, and an owner with real time. It stops at readiness. It does not promise a result.
What happens each week?
Week 1: contract and mandate. Read your contract clauses and flow downs. Identify what FCI and CUI you receive and where it lands. Choose a program owner and sponsor. Decide whether to engage a registered practitioner or consultant. Note that C3PAO personnel are barred from assessing an organisation they consulted for within the previous three years, so keep that in mind when choosing advisors.
Week 2: scope. Define the assessment scope: assets that process, store or transmit CUI, and those that protect them. Consider moving CUI into a dedicated enclave to shrink scope. Draw the network and data flow diagrams.
Week 3: inventory and external providers. Inventory hardware, software, cloud services and people. List external service providers and what they handle. Collect their service descriptions and customer responsibility matrices, since your SSP must document how you use them.
Week 4: baseline assessment. Assess each of the 110 requirements using the NIST SP 800-171A objectives. Record met, not met, or not applicable with evidence. Be strict: assessors use the objectives, not intentions.
Week 5: plan and prioritise. Turn gaps into a POA&M with owners, resources and dates. Group by theme: identity, endpoint, network, logging, policies, physical, personnel.
Weeks 6 to 8: fix technical gaps.
- Week 6: access control and identification and authentication: least privilege, MFA, account management.
- Week 7: configuration, system and communications protection, media protection: baselines, encryption, boundary protection.
- Week 8: audit and accountability, system and information integrity, incident response: central logging, patching, malware, response plan and exercise.
Week 9: policies, procedures and training. One policy per family, procedures that say who does what, awareness training with records, personnel security steps, physical protection records.
Week 10: SSP. Write the SSP: system description, boundary, each requirement with how it is met, who owns it and where evidence lives. Add name, date and version. Cross-check every claim against reality.
Week 11: dry run. Have someone independent of the implementation walk through the 110 requirements with examine, interview and test methods. Fix what fails. Update the POA&M and SSP.
Week 12: decide and schedule. For self-assessment, complete and review the results with the affirming official. For a C3PAO route, contact authorised assessors for availability and cost. Calendar the annual affirmation and the cycle for the next assessment.
Where do plans slip?
- Scope creep. Every extra system is another thing to prove.
- SSP written from policy, not practice. The rule treats an out of date SSP at assessment as a finding.
- External service provider gaps. If your cloud provider does not document responsibilities, you carry the gap.
- Evidence collected late. Assessors want records, so start in week 6.
- Treating the POA&M as a reserve. It has limits and a 180 day clock.
- Affirmation overlooked. It is annual and involves a named senior person.
Who does what?
Executive sponsor: resources and affirmation. Program owner: plan, SSP, POA&M. IT lead: enclave, identity, endpoints, logging. HR: personnel security and training. Facilities: physical protection. Contracts: flow downs and provider terms.
What to do
- Confirm the required level from your contract.
- Shrink scope with an enclave before spending on controls.
- Run the 110 requirement assessment against 171A objectives in week 4.
- Keep the SSP and the live environment in lockstep.
- Collect evidence weekly.
- Run an independent dry run.
- Book assessor time as soon as scope is stable.
- Put annual affirmation on the calendar.
Quick check
How many requirements are in CMMC Level 2?
110, taken from NIST SP 800-171 Revision 2, according to the rule.
How long is the POA&M window after a conditional Level 2 status?
180 days from the CMMC status date, after which the conditional status expires if not closed out.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between assessments, which saves the team time. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard helps prepare and keep evidence ready. Assessment results come from you under the rule or from a C3PAO, not from Safeguard. Book a call.
Sources
Fetched 18 October 2026. Check current rule text and contract clauses.
Last reviewed: 18 October 2026.
