CMMC Level 2 Requirements: What the 110 NIST SP 800-171 Requirements Mean
CMMC Level 2 means the 110 security requirements of NIST SP 800-171 Rev 2 for systems that handle Controlled Unclassified Information (CUI). DoW (DoD) is removing or revising CMMC requirements in its contracts, but the NIST baseline under DFARS 7012 remains.
What is CMMC Level 2, and what does it require?
CMMC Level 2 is the Cybersecurity Maturity Model Certification level for contractors that handle CUI. It means the 110 security requirements of NIST SP 800-171 Rev 2, implemented and documented on every system that stores, processes or transmits CUI, verified by a self-assessment or a C3PAO assessment, with an annual affirmation.
The requirements are grouped in 14 families, from access control to system and information integrity. They apply to the systems that handle CUI and to the systems that protect them, which is why scope matters as much as the requirements themselves.
Implementing the requirements is only part of it. You describe how each one is met in a System Security Plan (SSP), track open items in a Plan of Action and Milestones (POA&M) only where the rule allows one, record a score in the Supplier Performance Risk System (SPRS), and a senior official affirms each year that the requirements are still met.
What are the CMMC levels?
| Level | Requirements | How it is verified | Status in new contracts (2026 deviation) |
|---|---|---|---|
| Level 1 (Self) | 15 requirements from FAR 52.204-21, for Federal Contract Information (FCI) | Annual self-assessment and affirmation | Can still be required |
| Level 2 (Self) | 110 requirements of NIST SP 800-171 Rev 2, for CUI | Self-assessment every three years, score in SPRS, annual affirmation | Can still be required |
| Level 2 (C3PAO) | The same 110 requirements | Assessment by an authorized C3PAO every three years, annual affirmation | Not designated during the review; available voluntarily |
| Level 3 (DIBCAC) | Level 2 (C3PAO) plus 24 selected NIST SP 800-172 requirements | Government assessment by DCMA’s DIBCAC | Not designated during the review |
Which areas do the 110 requirements cover?
NIST SP 800-171 Rev 2 groups its 110 requirements in 14 families. Grouped by what they protect, they look like this.
Access and Identity
- Access Control (22)
- Identification and Authentication (11)
People and Facilities
- Awareness and Training (3)
- Personnel Security (2)
- Physical Protection (6)
Systems and Media
- Configuration Management (9)
- Maintenance (6)
- Media Protection (9)
Monitoring and Response
- Audit and Accountability (9)
- Incident Response (3)
Risk and Assessment
- Risk Assessment (3)
- Security Assessment (4)
Communications and Integrity
- System and Communications Protection (16)
- System and Information Integrity (7)
Is CMMC Level 2 still required in 2026?
It depends on your contract. DoW (DoD) is removing or revising CMMC requirements in its contracts; NIST SP 800-171 Rev 2 under DFARS 7012 remains the baseline. CMMC Level 2 (Self) can still appear in new contracts, and DCMA can still assess any contractor that holds a DFARS 7012 contract.
In July 2026 the Department of War CIO suspended the planned November 2026 move to CMMC Phase 2. Class Deviation 2026-O0025 Rev 3, signed September 3, 2026, then told contracting officers to remove or revise CMMC requirements in new and existing contracts. Existing contracts change by modification, before the next option period or at the next administrative modification, and no waivers are granted during the review. CMMC status →
Under DFARS 252.240-7997, DCMA Medium and High assessment results take precedence over any other assessment, including your own. That makes the Level 2 requirements the safest reference point whatever happens to CMMC next: implement them in a way you can prove, and be ready if a prime or DoW asks for a third-party assessment.
Who needs CMMC Level 2?
Any contractor that handles CUI on a DoW contract has to protect it under DFARS 7012 and NIST SP 800-171 Rev 2. Whether CMMC Level 2 itself appears in the contract depends on the solicitation and, since 2026, on how the suspension is applied.
If you handle only Federal Contract Information (FCI) and never CUI, Level 1 is the relevant level instead. If you are unsure which information you hold, start with how CUI is marked in your contracts and where it flows in your organization.
1
Prime contractors whose contracts include DFARS 7012 and involve CUI
2
Subcontractors that receive CUI through a prime’s flow-down
3
Suppliers whose prime asks for evidence of NIST SP 800-171 implementation
4
Contractors bidding on solicitations that specify CMMC Level 2 (Self)
How does SENTRE help you meet CMMC Level 2?
SENTRE is a managed CUI enclave built by ITG, based on the environment a C3PAO assessed at 110 of 110. It implements the Level 2 requirements inside a boundary you own, so assessment scope centers on the enclave.
- The 110 requirements implemented and documented in the enclave
- SSP, POA&M, policies and procedures from an assessed environment
- Evidence produced by daily operations to support your affirmation
- A Shared Responsibility Matrix showing who is responsible for each requirement
- Proven first on ITG: CMMC Final Level 2 (C3PAO), 110 of 110
CMMC Level 2 FAQs
How many requirements are in CMMC Level 2?
110: the security requirements of NIST SP 800-171 Rev 2, grouped in 14 families. Assessments check each requirement against the assessment objectives in NIST SP 800-171A, so a requirement counts as met only when every objective behind it is met, not when a policy simply mentions it.
Can we self-assess for CMMC Level 2?
Yes, where the contract specifies Level 2 (Self). You assess against NIST SP 800-171A, post the score in SPRS and affirm it every year, so the score must match what is actually in place. A DCMA assessment can later test the same requirements. SPRS score →
What is the annual affirmation?
A senior official of your company affirms in SPRS each year that the company continues to meet the requirements. An affirmation that overstates what is in place can create False Claims Act exposure, which is why the evidence behind it matters as much as the score.
When is a POA&M allowed under Level 2?
Only within the limits in 32 CFR 170.21. Your score must be at least 88 of 110, and only requirements worth 1 point can go on the POA&M, plus 3.13.11 where encryption is used but not FIPS-validated. The security plan (3.12.4) can never be deferred. Every open item must be closed and verified within 180 days.
Does an enclave reduce Level 2 scope?
Yes. When CUI is confined to a defined enclave, the assessment covers the enclave and the systems that protect it rather than every system in the company. Your scoping documents define the boundary, and Discovery shows where that boundary would sit for your contracts.
What is the difference between Level 2 (Self) and Level 2 (C3PAO)?
The requirements are the same 110. The difference is who checks them: under Level 2 (Self) you assess yourself and affirm the result; under Level 2 (C3PAO) an authorized third-party assessor does, every three years. During the suspension DoW may not designate C3PAO assessments in new contracts, but they remain available voluntarily.
How long does Level 2 take?
It depends on your starting point and how much of your organization handles CUI. ITG’s own build took more than 10 months with a dedicated team; with SENTRE you start from that finished environment, and Discovery produces a project timeline before you commit.
Find out how SENTRE would meet CMMC Level 2 for your contracts, and where your enclave should sit. Discovery is a no-obligation review.