The regulatory anchor: 32 CFR Part 170
The CMMC Program rule was finalized by the Department of Defense in October 2024 and codified in 32 CFR Part 170. The rule defines three CMMC levels and the assessment requirements for each. DFARS 252.204-7021, a final clause, puts the required CMMC level into contracts, alongside DFARS 252.204-7012 (the CUI safeguarding clause). On July 13, 2026, DoD suspended the CMMC Phase 2 transition; NIST SP 800-171 Rev. 2 obligations under DFARS 252.204-7012 still apply. See CMMC status.
The 110 controls and 320 assessment objectives
CMMC Level 2 aligns to NIST SP 800-171 Rev. 2, which defines 110 security requirements across 14 control families. The assessment is performed against NIST SP 800-171A, which breaks each control into one or more assessment objectives — 320 in total. The assessment covers every objective; a requirement is MET only if every underlying objective is met.
AC — Access Control22
AT — Awareness and Training3
AU — Audit and Accountability9
CM — Configuration Management9
IA — Identification and Authentication11
IR — Incident Response3
MA — Maintenance6
MP — Media Protection9
PS — Personnel Security2
PE — Physical Protection6
RA — Risk Assessment3
CA — Security Assessment4
SC — System and Communications Protection16
SI — System and Information Integrity7
Level 1 vs. Level 2 vs. Level 3
Level 1 covers basic safeguarding of Federal Contract Information (FCI): the 15 requirements in FAR 52.204-21(b)(1), self-assessed every year. Level 2 covers Controlled Unclassified Information (CUI): all 110 NIST SP 800-171 requirements, assessed every three years as Level 2 (Self) or Level 2 (C3PAO), as the solicitation specifies. During the 2026 suspension, solicitations designate only Level 2 (Self). Level 3 adds a subset of NIST SP 800-172 enhanced security requirements and is assessed by DIBCAC for the most sensitive CUI categories.
SPRS scoring
The Supplier Performance Risk System (SPRS) is the DoD's repository for contractor self-assessment scores against NIST SP 800-171. The score starts at 110 and deducts weighted points (1, 3, or 5) per unimplemented control. A perfect score is 110; a fully unimplemented environment scores -203. DoD contracting officers see the score when evaluating contractors for CUI-handling work, so the SPRS submission is materially tied to bid eligibility.
What a Level 2 assessment covers
Level 2 assessments, whether self-assessments or C3PAO assessments, follow the NIST SP 800-171A methods: examine documents, interview personnel, and test technical controls. Every objective must be supported by evidence. The deliverables on assessment day include the System Security Plan (SSP), Plan of Action & Milestones (POA&M), Security Assessment Report (SAR), and supporting evidence — typically bundled into an eMASS-ready package. After certification, continuous monitoring obligations apply under 32 CFR Part 170; the Affirming Official must attest to ongoing compliance annually.
Conditional vs. Final Level 2 status
A Conditional Level 2 status, (Self) or (C3PAO), is possible when your score is at least 88 and the POA&M holds only eligible items: 1-point requirements, plus SC.L2-3.13.11 when encryption is used but not FIPS-validated, never 3.1.20, 3.1.22, 3.12.4 or 3.10.3–3.10.5. A POA&M closeout assessment must confirm closure within 180 days of the Conditional CMMC Status Date; otherwise the conditional status expires. Final Level 2 status means every requirement is MET (32 CFR 170.21; 170.16(a)(1)). See also POA&M template.
What this means for DoD contractors
If you handle CUI under a DoD contract — or you're a sub to a prime that does — Level 2 is on your roadmap. The work splits into evidence collection against the 320 objectives, control implementation where gaps exist, document assembly (SSP, POA&M, SAR), SPRS submission and affirmation, and the assessment type your contract names (Level 2 (Self) during the current suspension). Each phase has its own artifacts, deadlines, and audit-trail requirements. Run the free Quick Score to baseline against the 320 objectives, then walk through the workflow automation page to see what defensible end-to-end execution looks like.