To implement CMMC 2.0 yourself, find the level your contracts require, scope where federal data lives, gap check against NIST SP 800-171, fix the gaps, document everything in a system security plan, score yourself, and prepare for the required assessment. Order matters: scope first, tooling last.
Step 1: find your required level
CMMC has three levels. Which one you need comes from your contract. Level 1 relates to federal contract information, Level 2 to controlled unclassified information (CUI) and is based on NIST SP 800-171, and Level 3 adds enhanced requirements for the most sensitive programs. Ask your contracting officer or prime contractor what applies, and read the clause in the solicitation. We could not fetch the DoD CMMC page or the eCFR text, so verify details in 32 CFR Part 170.
Step 2: scope the boundary
List where CUI enters, is stored, is processed and leaves. Include people, endpoints, cloud services, email and collaboration tools, and any provider that touches it. Many firms build a dedicated enclave so only a small part of the company is in scope.
Step 3: gap check against 800-171
SP 800-171 Rev. 3 lists 17 families: Access Control; Awareness and Training; Audit and Accountability; Assessment, Authorization and Monitoring; Configuration Management; Identification and Authentication; Incident Response; Maintenance; Media Protection; Physical and Environmental Protection; Planning; Personnel Security; Risk Assessment; System and Services Acquisition; System and Communications Protection; System and Information Integrity; and Supply Chain Risk Management. Confirm which revision your CMMC level references, because the program rule names one. For each requirement record: met, partly, not met, plus evidence.
Step 4: build the remediation plan
Group gaps by effort and risk. Typical early work: MFA everywhere, endpoint management, encryption of CUI, central logging, patching cadence, access reviews, incident response testing. Give every gap an owner and a date.
Step 5: write the system security plan
The plan describes your boundary, environment and how each requirement is implemented. Write it from the real configuration. An assessor will compare it with what they see.
Step 6: manage the POA&M carefully
Secondary summaries of the rule say a conditional result requires at least 80 percent of the maximum score, only certain low value items can stay open, and open items must be closed within 180 days. Confirm all of this in the rule. Plan to close gaps before assessment rather than count on a POA&M.
Step 7: score and report
Score yourself against the DoD assessment method and submit as the contract requires. Be conservative, because scores are tied to annual affirmations by company leadership.
Step 8: prepare for assessment
Build an evidence binder, run a mock assessment, and brief the staff who will be interviewed. Where a third party assessment is required, book the assessor early.
Step 9: operate it every day
CMMC is not a one time project. Access reviews, patching, log review and incident exercises continue, and affirmations recur.
Mistakes to avoid
- Scoping the whole company when an enclave would do.
- Buying a platform before scoping.
- Assuming a cloud provider's authorization covers your configuration.
- Writing the plan before the fixes, then letting them diverge.
What to do
- Read the contract clause and confirm the level.
- Map the CUI boundary and data flows.
- Gap check all 800-171 families.
- Prioritize fixes with owners and dates.
- Write the system security plan from the real configuration.
- Self score and submit as the contract requires.
- Mock assess, then book the real assessment if one is required.
- Schedule recurring reviews and affirmations.
Quick check
Which CMMC level do I need?
It depends on your contract and whether you handle federal contract information or CUI. Read the solicitation clause and ask your contracting officer or prime.
Can I rely on a POA&M to pass?
Not safely. Secondary sources describe tight limits and a 180 day closeout window, so confirm the rule and aim to fix gaps first.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits. That helps with step 9, the part teams underestimate.
Technical evidence comes from your real code and dependencies, through scans, SBOMs and reachability, not only policies, which supports requirements around flaw remediation and supply chain risk. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. CMMC assessments are performed by authorized independent assessors where required. Safeguard helps prepare and keep evidence ready, and does not guarantee a result.
Want to see it on your own stack? Book a call.
Sources
- NIST SP 800-171 Rev. 3, Protecting CUI in Nonfederal Systems
- 32 CFR Part 170 (CMMC Program), check the current text on eCFR
- Search summary of CMMC Level 2 POA&M rules (secondary, verify against the rule)
Last reviewed: 18 October 2026.
