Executive Summary
The Cybersecurity Maturity Model Certification (CMMC) Program applies to DoD contract and subcontract awardees that process, store, or transmit Federal Contract Information or Controlled Unclassified Information (CUI) on contractor information systems (32 CFR §170.3). The CMMC Level 2 security requirements are identical to the 110 requirements in NIST SP 800-171 Revision 2 (32 CFR §170.14(c)(3)), and the Level 2 Assessment Guide published by the Office of the DoD CIO explains how they are assessed. This article analyzes what those requirements involve, distinguishes readiness support from certification, and provides a practical framework for organizations beginning the process.
The Problem
Many defense contractors are approaching CMMC with the same mindset they applied to older compliance frameworks — checking boxes and hoping for the best. CMMC Level 2 does not work that way. Depending on the contract, the required status is either a Level 2 self-assessment or a certification assessment performed by a Certified Third-Party Assessment Organization (C3PAO). DoD program managers or requiring activities select which applies to each procurement, and DoD is phasing these requirements into solicitations over time (32 CFR §170.3(d)–(e)). Organizations that are not genuinely prepared will not achieve the required status.
What the Assessment Guide Actually Says
CMMC Level 2 uses the 110 security requirements of NIST SP 800-171 Revision 2, organized into 14 domains that map to that publication’s security requirement families (32 CFR §170.14(b)–(c)). The CMMC Assessment Guide for Level 2 (Version 2.13, September 2024) describes how each requirement is assessed. NIST has since published Revision 3 and withdrawn Revision 2, but the CMMC Program regulation, as published in the 2025 edition of 32 CFR Part 170, incorporates Revision 2 by reference, so Revision 2 is the Level 2 baseline unless DoD amends the rule. Each practice is evaluated on a three-point scale: MET, NOT MET, or NOT APPLICABLE. A practice is MET only when the organization can demonstrate that the policy, process, and technical implementation are all present and functioning. Documentation alone is insufficient.
The 14 domains include:
- Access Control (22 practices)
- Awareness and Training (3 practices)
- Audit and Accountability (9 practices)
- Configuration Management (9 practices)
- Identification and Authentication (11 practices)
- Incident Response (3 practices)
- Maintenance (6 practices)
- Media Protection (9 practices)
- Personnel Security (2 practices)
- Physical Protection (6 practices)
- Risk Assessment (3 practices)
- Security Assessment (4 practices)
- System and Communications Protection (16 practices)
- System and Information Integrity (7 practices)
The Gap Most Organizations Face
Technical controls and documentation are the two most common weak points. Organizations often have partial implementations — a password policy exists on paper but is not enforced in the Active Directory configuration. An incident response plan exists but has never been tested. These gaps will result in NOT MET assessments.
A second significant gap is CUI boundary definition. Before an assessment can proceed, the organization must clearly identify what CUI they handle, where it lives, who touches it, and how it flows through their environment. Without this boundary definition, the assessment cannot be scoped.
A Practical Readiness Framework
Organizations preparing for CMMC Level 2 assessment should approach readiness in four phases:
Phase 1: Scope and Boundary Definition
Identify every system, person, and process that touches CUI. Define the CUI boundary explicitly. This includes cloud services, contractor laptops, shared drives, and any system that receives, processes, stores, or transmits CUI. Document the System Security Plan (SSP) to reflect the actual boundary, not an aspirational one.
Phase 2: Gap Assessment Against 110 Practices
Evaluate each of the 110 practices against the actual technical and procedural state of the organization. Be honest. Practices are MET or NOT MET — there is no partial credit in the assessment.
Phase 3: Remediation Planning
Prioritize gaps by domain criticality and implementation complexity. Access Control and Identification/Authentication gaps are typically highest priority because they affect how CUI is protected at the access layer. Configuration Management gaps are often the most time-consuming because they require systematic inventory and change control implementation.
Phase 4: Evidence Collection
Before an assessment, whether a self-assessment or a C3PAO certification assessment, collect objective evidence for every MET practice: screenshots, configuration exports, policy documents, training records, and test results. An assessor will request this evidence. Organizations that walk in without it waste assessment time and money.
Implications for Defense Contractors
A CMMC Level 2 status, self-assessed or C3PAO-certified depending on the contract, is becoming a contractual prerequisite, not a competitive differentiator. The DFARS rule that adds the CMMC requirements to contracts took effect on November 10, 2025, and the program regulation phases the requirements into solicitations (32 CFR §170.3(e)). Organizations that delay readiness work are not avoiding cost — they are deferring it into a crisis. The longer the delay, the more expensive the remediation and the higher the risk of losing contract eligibility.
SOSRA's Position
SOSRA provides readiness support — we help organizations understand their current posture, define their CUI boundary, and build the evidence portfolio they need before an assessment. We do not conduct assessments, issue certifications, or guarantee outcomes. The assessment is performed by the organization itself or by a C3PAO, depending on the contract. Our role is to make sure organizations show up ready.
