CMMC Level 2 uses the 110 requirements of NIST SP 800-171 Revision 2. For engineers the work reduces to scoping the assets that touch controlled unclassified information, then implementing and documenting access control, logging, configuration baselines, multi-factor authentication, FIPS-validated encryption, vulnerability management and monitoring on them.
Start with scope, because it sets the workload
Under 32 CFR Part 170, assets in scope fall into categories. CUI assets process, store or transmit CUI and are assessed against all Level 2 requirements. Security protection assets provide security functions and are assessed against requirements relevant to their capability. Contractor risk managed assets can but are not intended to handle CUI, and are not otherwise assessed if the system security plan documents them adequately. Specialized assets such as IoT, operational technology and government furnished equipment are handled through the plan. Out-of-scope assets cannot handle CUI and do not protect CUI assets.
Shrinking the CUI enclave, for example a separate tenant or network segment for the contract work, reduces how many machines must meet all 110 requirements. Draw the boundary, and document it in the system security plan, which must be in place at the time of assessment.
The checklist
Requirement numbers below follow NIST SP 800-171 Rev 2 naming used in CMMC, such as 3.5.3. We could not fetch the NIST text, so verify each number against the standard.
Access control (3.1).
- Limit system access to authorised users and devices, and enforce least privilege, including separate admin accounts.
- Control remote access with approved methods and encryption.
- Lock sessions after inactivity and control wireless access.
Audit and accountability (3.3).
- Create and retain audit logs sufficient to trace actions to individuals.
- Protect logs from modification, review them, and synchronise clocks.
- Alert on audit logging failure.
Configuration management (3.4).
- Maintain baseline configurations and an inventory of systems.
- Apply security configuration settings, track and approve changes, and restrict nonessential programs and services.
Identification and authentication (3.5).
- Identify and authenticate users and devices.
- Use multi-factor authentication for local and network access to privileged accounts and for network access to non-privileged accounts (3.5.3).
- Enforce password complexity and prevent reuse.
System and communications protection (3.13).
- Separate user functionality from admin functionality, and use boundary protection at the edge of the CUI environment.
- Encrypt CUI in transit and at rest.
- Where encryption protects CUI, use FIPS-validated cryptography. The CMMC rule treats SC.L2-3.13.11 specially: it is the one 3 point requirement that may appear on a plan of action if encryption is used but not FIPS-validated.
Risk assessment (3.11).
- Scan for vulnerabilities periodically and when new ones affecting systems are identified, and remediate according to your risk assessments.
System and information integrity (3.14).
- Identify, report and correct flaws in a timely manner, protect against malicious code, monitor security alerts and update protections.
Media and physical (3.8, 3.10). Even engineering teams need to cover encrypted laptops, removable media controls and visitor handling. Several physical requirements cannot be on a plan of action under the rule.
Scoring and gaps
Level 2 assessment uses point values of 5, 3 or 1 per requirement. To get a conditional status you need a score of at least 0.8 of the maximum, no open items above 1 point except the encryption case, and none from the list of excluded requirements (including AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5). Open items must be closed and a closeout assessment completed within 180 days, or the conditional status expires.
Assessment type and timing
Level 2 can be a self-assessment or a certification assessment by a C3PAO, depending on the contract. Affirmation is required with each assessment and annually. Phase dates for contract requirements were set in the DFARS rule; reports in July 2026 indicated a program review that may affect later phases, so check current DoD announcements.
What to do
- Identify where CUI lives and draw the enclave boundary.
- Write the system security plan describing each in-scope system.
- Inventory assets and classify them into the scope categories.
- Work through the family list, marking each requirement implemented, partial or not.
- Prioritise by point value and by the excluded list.
- Turn on logging, MFA and FIPS-validated encryption early, as they take longest.
- Collect evidence per requirement in a shared index.
- Run a mock assessment.
Quick check
Do I need a C3PAO?
Level 2 may be met by self-assessment or by C3PAO certification depending on what the contract requires. Check your solicitation.
Can I leave gaps on a plan of action?
Some, within limits: a score of at least 0.8, a 180 day closeout and a list of requirements that cannot be deferred.
How Safeguard helps automate this
Engineering controls need proof from live systems. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between assessments, leaving your team time for other work. Technical evidence for flaw remediation and vulnerability scanning comes from your real code and dependencies: scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies and other findings; it is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. A C3PAO or government assessor makes the call; Safeguard helps you prepare and keep evidence ready.
Open the framework mapping demo or book a call.
Sources
- 32 CFR Part 170 (CMMC program), eCFR: scope categories, scoring, plan of action rules, 180 day closeout.
- DFARS phase dates and the July 2026 program review report come from law firm and vendor summaries in search results, not from the Federal Register. Verify before relying on them.
- NIST SP 800-171 Rev 2 text was not fetched.
Last reviewed: 18 October 2026.
