CMMC Level 2 is the certification level most defense contractors who touch CUI need. It maps to all 110 controls of NIST SP 800-171 Revision 2, organized into 14 families. Here is what each family covers and what meeting a control actually means.
CMMC Level 2 requires you to meet all 110 controls of NIST Special Publication 800-171 Revision 2. The controls are organized into 14 families covering everything from who can log in to your systems to how you respond when something goes wrong. Most defense contractors handling Controlled Unclassified Information (CUI) need Level 2. If your contract includes a CMMC clause and you touch CUI, this is your bar.
You need Level 2 if your prime or government contract requires it. Two indicators that almost always mean Level 2:
Level 1 is the lower bar (17 basic safeguarding requirements, self attested) and applies when you only handle Federal Contract Information (FCI), not CUI. More on what counts as CUI.
NIST SP 800-171 Rev 2 organizes the 110 controls into 14 families. Each family covers one specific risk area. Here is what each one is really asking you to do.
| Family | Code | What it covers |
|---|---|---|
| Access Control | AC | Who can use your systems, what they can do, and what gets logged. The largest family by control count. |
| Awareness and Training | AT | Your people are trained on security risks and their role in protecting CUI. |
| Audit and Accountability | AU | You log security relevant events, you review the logs, and you can tie actions to specific users. |
| Configuration Management | CM | Your systems have a known baseline. Changes are tracked and approved. |
| Identification and Authentication | IA | You know who is on your systems. MFA is required for privileged and remote access. |
| Incident Response | IR | You can detect an incident, contain it, recover from it, and report it. |
| Maintenance | MA | Maintenance on your systems happens in a controlled way that does not leak CUI. |
| Media Protection | MP | Removable media, paper documents, and old hardware that touched CUI are controlled and destroyed properly. |
| Personnel Security | PS | Background checks where required, and removal of access when people leave. |
| Physical Protection | PE | Your facility, server room, and devices are physically protected from unauthorized access. |
| Risk Assessment | RA | You actively identify risks to your systems and act on them. |
| Security Assessment | CA | You assess your security controls, write the SSP, and maintain a POA&M. |
| System and Communications Protection | SC | Your network is segmented, encrypted, and isolates CUI from where it does not belong. |
| System and Information Integrity | SI | You patch quickly, monitor for malicious code, and protect against threats in motion. |
The DoD does not grade on intent. A control is either met, partially met, not met, or not applicable, and your SPRS score reflects exactly that. To call a control met you generally need three things in place:
If you have one of these but not the others, the control is partial. Partial controls deduct fractional points from your SPRS score. More on SPRS scoring.
Each control carries a weight of 1, 3, or 5 points that you lose if it is not met. The DoD methodology has one special rule worth knowing: two controls (3.5.3 multi factor authentication and 3.13.11 FIPS validated cryptography) only deduct 3 points instead of 5 when partially implemented, because partial coverage of those two has measurable value.
The scope of your CMMC assessment is "every system that processes, stores, or transmits CUI, plus everything that supports those systems." The art is in narrowing it.
Narrowing scope is the single biggest cost lever. A 30 employee shop with 6 people in a CUI enclave will pay a much smaller C3PAO fee than a 30 employee shop where CUI is on every laptop.
For a small contractor starting from a typical office IT setup, expect 3 to 9 months of focused work to close real gaps and produce a defensible SSP. Compliance software shortens the documentation half significantly, but the remediation half (actually buying and configuring the tools) is real engineering time you cannot shortcut.
110. They come from NIST Special Publication 800-171 Revision 2 and are organized into 14 families. CMMC Level 2 requires all 110 to be met (or formally accepted as not applicable with written justification) for full compliance.
Yes, unless a control genuinely does not apply to your environment. For example, if you operate no wireless networks, wireless related controls can be marked Not Applicable with written justification. A C3PAO assessor will review that justification. Marking applicable controls as not applicable to inflate a score is a finding.
Access Control (AC), Awareness and Training (AT), Audit and Accountability (AU), Configuration Management (CM), Identification and Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Personnel Security (PS), Physical Protection (PE), Risk Assessment (RA), Security Assessment (CA), System and Communications Protection (SC), and System and Information Integrity (SI).
CMMC Level 2 directly inherits the 110 controls of NIST SP 800-171 Rev 2. The difference is that NIST 800-171 alone has historically been self attested under DFARS, while CMMC Level 2 requires a Certified Third Party Assessment Organization (C3PAO) to perform a formal assessment and issue certification for most contracts handling CUI.
Level 2 covers all 110 controls of NIST 800-171. Level 3 adds a subset of NIST 800-172 enhanced security requirements designed to defend against advanced persistent threats, and only applies to contractors handling the most sensitive CUI for the most sensitive programs. The overwhelming majority of contractors with a CMMC requirement need Level 2, not Level 3.
Verdiex walks you through the questionnaire, generates your SSP, calculates your SPRS score, and tracks your POA&M. Get on the early access list and we will notify you when it opens.
Verdiex prepares you for assessment. A C3PAO performs the assessment and issues certification.