CMMC Level 2 requirements by family
Published 2026-10-23, 19 min read
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Contracts may require CMMC Level 1 (Self) or Level 2 (Self): your own assessment, scored and entered in SPRS, with a senior official's affirmation. Class Deviation 2026-O0025 Rev 3; 32 CFR 170.15, 170.16
- The CMMC rule itself, 32 CFR Part 170, is unchanged since it took effect on 2024-12-16. eCFR, 32 CFR Part 170
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Existing contracts that carry CMMC requirements have them removed at the next option period or the next scheduled administrative modification. Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
- DoD's 2026 Regulatory Plan lists an interim final rule amending 32 CFR Part 170 (RIN 0790-AM01) to set a deadline and transition from NIST SP 800-171 Rev 2 to Rev 3. It was timetabled for July 2026 and has not been published as of 2026-10-23. 91 FR 52824
- Class Deviation 2026-O0025, Revision 3 (DFARS part 240), read 2026-10-23
- DFARS 252.204-7012, -7019, -7020, -7021 (acquisition.gov), read 2026-10-23
- 32 CFR Part 170 (eCFR), read 2026-10-23
- Federal Register 2026-16603, 2026 Regulatory Plan (RIN 0790-AM01), read 2026-10-23
- Federal Register: CMMC documents, read 2026-10-23
What Level 2 requires
CMMC Level 2 does not write its own controls. Level 2 is the 110 security requirements of NIST SP 800-171 Rev 2, adopted as NIST wrote them, grouped in the same 14 families and numbered the NIST way with a family prefix in front: AC.L2-3.1.1 is NIST requirement 3.1.1 in the access control family.
- Requirements
- 110NIST SP 800-171 Rev 2, word for word
- Families
- 14Access control to system integrity
- Assessment objectives
- 320NIST SP 800-171A, what an assessor checks
- Maximum score
- 110Every requirement MET
- Conditional minimum
- 88Score needed to use a POA&M at all
- Lowest possible score
- −203Every requirement NOT MET at full value
The revision matters. DoD binds Rev 2: Part 170 incorporates it, and the deviated DFARS 252.204-7012 names “Revision 2”. NIST published Rev 3 in May 2024 and marks Rev 2 withdrawn, so a Rev 3 checklist answers a different list. What changed between the two is in what NIST SP 800-171 is, and how the standard and the program fit together is in CMMC vs NIST SP 800-171.
Level 2 also contains Level 1. 17 of the 110 requirements are the NIST form of the FAR 52.204-21 basic safeguarding items, and a Level 2 (Self) status satisfies Level 1 (Self) for the same systems. A shop that already affirms Level 1 has started; the Level 1 requirements show which part.
How big the job is depends on scope, not on the list. Every system that processes, stores or transmits CUI is a CUI Asset, and CUI Assets are assessed against all Level 2 security requirements. A shop that keeps CUI on a few laptops and one file share meets the 110 on those; a shop where CUI lands everywhere meets them everywhere. Draw the line first with the CMMC scoping worksheet.
Two ways to show Level 2, and which one applies today
The requirements are the same 110 whoever checks them. What changes is who signs the result: you, in a self-assessment, or a certified third-party assessment organization (C3PAO). The contract names the one it wants, and the CMMC clause lists both as separate statuses, each Conditional or Final.
| What the rule sets | Level 2 (Self) | Level 2 (C3PAO) |
|---|---|---|
| Who assesses§ 170.16(a), 170.17(a) | You, against your own systems | An authorized or accredited C3PAO |
| Against what§ 170.16(c)(1), 170.17(c)(1) | All 110, by the NIST SP 800-171A objectives, scored by § 170.24 | The same 110, the same objectives, the same scoring |
| Where the result goes§ 170.16(a)(1)(i), 170.17(a)(1) | SPRS, entered by you as a score out of 110 | CMMC eMASS, passed on to SPRS automatically |
| Fixing a finding mid-way§ 170.17(c)(2) | Your own assessment, your own pace | A NOT MET can be re-evaluated for 10 business days after the active assessment, before the findings report |
| POA&M closeout§ 170.21(b) | Your own closeout self-assessment within 180 days | A C3PAO closeout assessment within 180 days |
| Evidence kept§ 170.16(c)(4), 170.17(c)(4) | Six years from the CMMC Status Date | Six years, hashed with a NIST-approved algorithm |
| Repeated§ 170.16, 170.17, 170.22 | Every three years, affirmed every year | Every three years, affirmed every year |
| Also satisfies§ 170.16(a), 170.17(a) | Level 1 (Self) | Level 1 (Self) and Level 2 (Self) |
| In contracts todayStatus box above | May be required | Suspended |
The last row comes from the status box at the top of this page, which is the one place this site records what binds today. The reasons, the dates and what to watch for are in CMMC status today.
Both paths end in the same place: a score in SPRS and a senior official's affirmation. The steps from scoping to that affirmation are in how to get CMMC certified, and what an assessment firm is and is not allowed to do is in what a C3PAO is.
Where the 110 points sit
Not every requirement counts the same. Each one carries 5, 3 or 1 point, and a requirement you have not met costs its full value against the maximum. The rule sets the weight by what a gap would expose:
Counted, that is 42 requirements at 5 points, 14 at 3 and 51 at 1, plus 2 that score 3 or 5 depending on how far they are done and 1 with no value at all. The points pile up in a few families. Access control, system and communications protection and configuration management carry 54, 42 and 33; personnel security carries 8.
- 5-point requirements
- 3-point requirements
- 1-point requirements
- 3.1 Access control54 points: 35 from 5-point, 6 from 3-point and 13 from 1-point requirements
- 3.2 Awareness and training11 points: 10 from 5-point, 0 from 3-point and 1 from 1-point requirements
- 3.3 Audit and accountability19 points: 10 from 5-point, 3 from 3-point and 6 from 1-point requirements
- 3.4 Configuration management33 points: 30 from 5-point, 0 from 3-point and 3 from 1-point requirements
- 3.5 Identification and authentication27 points: 20 from 5-point, 0 from 3-point and 7 from 1-point requirements
- 3.6 Incident response11 points: 10 from 5-point, 0 from 3-point and 1 from 1-point requirements
- 3.7 Maintenance18 points: 10 from 5-point, 6 from 3-point and 2 from 1-point requirements
- 3.8 Media protection23 points: 10 from 5-point, 9 from 3-point and 4 from 1-point requirements
- 3.9 Personnel security8 points: 5 from 5-point, 3 from 3-point and 0 from 1-point requirements
- 3.10 Physical protection14 points: 10 from 5-point, 0 from 3-point and 4 from 1-point requirements
- 3.11 Risk assessment9 points: 5 from 5-point, 3 from 3-point and 1 from 1-point requirements
- 3.12 Security assessment13 points: 10 from 5-point, 3 from 3-point and 0 from 1-point requirements
- 3.13 System and communications protection42 points: 30 from 5-point, 3 from 3-point and 9 from 1-point requirements
- 3.14 System and information integrity31 points: 25 from 5-point, 6 from 3-point and 0 from 1-point requirements
313 points in all, at full value. Bars share one scale.
Read the chart as a work plan, not a ranking of importance. The filled segments, 5 and 3 points, are requirements that cannot wait on a POA&M (non-FIPS encryption is the one exception), so a shop short on time spends it there first. Use the finder below to see exactly which ones they are, then score yourself requirement by requirement in the SPRS score calculator.
Pick a weight or a POA&M rule to list the requirements that carry it.
42 requirements worth 5 points. Could lead to significant exploitation of the network, or exfiltration of CUI. Never on a POA&M.
- Access control
- AC.L2-3.1.1AC.L2-3.1.2AC.L2-3.1.12AC.L2-3.1.13AC.L2-3.1.16AC.L2-3.1.17AC.L2-3.1.18
- Awareness and training
- AT.L2-3.2.1AT.L2-3.2.2
- Audit and accountability
- AU.L2-3.3.1AU.L2-3.3.5
- Configuration management
- CM.L2-3.4.1CM.L2-3.4.2CM.L2-3.4.5CM.L2-3.4.6CM.L2-3.4.7CM.L2-3.4.8
- Identification and authentication
- IA.L2-3.5.1IA.L2-3.5.2IA.L2-3.5.10
- Incident response
- IR.L2-3.6.1IR.L2-3.6.2
- Maintenance
- MA.L2-3.7.2MA.L2-3.7.5
- Media protection
- MP.L2-3.8.3MP.L2-3.8.7
- Personnel security
- PS.L2-3.9.2
- Physical protection
- PE.L2-3.10.1PE.L2-3.10.2
- Risk assessment
- RA.L2-3.11.2
- Security assessment
- CA.L2-3.12.1CA.L2-3.12.3
- System and communications protection
- SC.L2-3.13.1SC.L2-3.13.2SC.L2-3.13.5SC.L2-3.13.6SC.L2-3.13.15
- System and information integrity
- SI.L2-3.14.1SI.L2-3.14.2SI.L2-3.14.3SI.L2-3.14.4SI.L2-3.14.6
The 14 families, and what a small shop builds
Each family below says what Level 2 asks in plain words, what a 5 to 50 person shop usually stands up to meet it, and where the points sit. The requirement numbers after each item show which ones it answers. For the exact wording of all 110, with the NIST SP 800-171A objectives an assessor checks, work through the NIST SP 800-171 checklist; for a one-page reference by family, see NIST SP 800-171 controls.
Access control (AC)
22 requirements, 70 objectives, 54 points at stake; 11 may sit on a POA&M, 2 on the never-on-a-POA&M list; 4 also in Level 1
What Level 2 asks. Who and what may reach the systems that hold CUI, and what they may do there: accounts, least privilege, separate admin accounts, failed-logon limits, screen lock, remote access, Wi-Fi, phones, outside systems, and what gets posted where the public can see it.
What a small shop typically builds
- One account per person in a central directory, with groups that follow jobs (office, programming, shop floor) and CUI folders open only to the groups that need them. 3.1.1, 3.1.2, 3.1.5
- A separate admin account for whoever runs IT, used only for admin work, with admin actions logged. 3.1.6, 3.1.7
- Lockout after failed logons, a pattern-hiding screen lock and sessions that end on their own, pushed as policy rather than set by hand. 3.1.8, 3.1.10, 3.1.11
- One managed, encrypted way in from outside; Wi-Fi with authentication and encryption; phones enrolled before they touch CUI, and CUI encrypted on them. 3.1.12 to 3.1.19
- A written rule for personal devices, outside clouds and USB drives on home computers, and one named person who approves anything posted to the website. 3.1.20 to 3.1.22
5-point requirements in this family
- AC.L2-3.1.1
- AC.L2-3.1.2
- AC.L2-3.1.12
- AC.L2-3.1.13
- AC.L2-3.1.16
- AC.L2-3.1.17
- AC.L2-3.1.18
Watch for: The two cheapest-looking items here, external connections and public posting, are each worth 1 point and still sit on the never-on-a-POA&M list. They have to be done on the day.
Awareness and training (AT)
3 requirements, 9 objectives, 11 points at stake; 1 may sit on a POA&M
What Level 2 asks. Everyone with access knows the security risks of their work and the policies that apply; people with security duties are trained for them; staff can recognise and report signs of an insider threat.
What a small shop typically builds
- A short awareness session for every user, repeated on a cycle you set in the SSP, with a record of who took it and when. 3.2.1
- Role training for whoever administers the systems, and for the person who manages the IT provider. 3.2.2
- An insider-threat module that says what to look for and who to tell. 3.2.3
5-point requirements in this family
- AT.L2-3.2.1
- AT.L2-3.2.2
Watch for: Training is cheap and the records are the evidence. An assessor reads the attendance list, not the slide deck. See CUI training for a small contractor's staff.
Audit and accountability (AU)
9 requirements, 29 objectives, 19 points at stake; 6 may sit on a POA&M
What Level 2 asks. Logs that tie every action to one person, kept long enough to investigate, reviewed and correlated, with an alert if logging stops, clocks synchronised to an authoritative source, and the logs themselves protected.
What a small shop typically builds
- Audit logging switched on in the directory, the email and file platform, the firewall and the endpoints, and sent to one place. 3.3.1, 3.3.2
- A review on a schedule you can show, with a note of what was looked at and what was done. 3.3.3, 3.3.5, 3.3.6
- Time sync from an authoritative source, an alert when a log source goes quiet, and log admin limited to a few people. 3.3.4, 3.3.7 to 3.3.9
5-point requirements in this family
- AU.L2-3.3.1
- AU.L2-3.3.5
Watch for: Collecting logs is not the requirement; reviewing them is. Correlated review (3.3.5) is a 5-point requirement, and a log nobody reads leaves it unmet.
Configuration management (CM)
9 requirements, 44 objectives, 33 points at stake; 3 may sit on a POA&M
What Level 2 asks. A known, documented baseline for every system and an inventory of what is in scope, enforced security settings, controlled and reviewed changes, only the functions the business needs, and control over what software may run.
What a small shop typically builds
- An inventory of every in-scope device and the software on it: the system security plan needs the same list. 3.4.1
- A hardened configuration for laptops and servers, written down and pushed centrally. 3.4.2, 3.4.6, 3.4.7
- A change log: who asked, who approved, what the security impact was, who may make changes. 3.4.3 to 3.4.5
- Application allow-listing or deny-listing, and a rule for software users install themselves. 3.4.8, 3.4.9
5-point requirements in this family
- CM.L2-3.4.1
- CM.L2-3.4.2
- CM.L2-3.4.5
- CM.L2-3.4.6
- CM.L2-3.4.7
- CM.L2-3.4.8
Watch for: Machine-tool PCs running old software are where baselines break. Place them with the scoping rules before you try to harden them: the rule evaluates Specialized Assets by their asset category. See CMMC scoping worksheet.
Identification and authentication (IA)
11 requirements, 25 objectives, 27 points at stake; 7 may sit on a POA&M; 2 also in Level 1
What Level 2 asks. Every user, process and device identified and authenticated before access; multifactor authentication; replay-resistant logons; identifiers retired and disabled on schedule; password rules; passwords only ever stored and sent encrypted.
What a small shop typically builds
- Named logons everywhere, including the shop-floor terminal: no shared accounts. 3.5.1, 3.5.2
- MFA on every account, starting with remote and admin users. 3.5.3
- Password and account policy set centrally: complexity, no reuse, temporary passwords that must change, accounts disabled after inactivity. 3.5.4 to 3.5.9, 3.5.11
- A password manager or directory that stores only protected passwords. 3.5.10
5-point requirements in this family
- IA.L2-3.5.1
- IA.L2-3.5.2
- IA.L2-3.5.10
Watch for: MFA is one of the two partial-credit requirements: MFA for remote and privileged users only costs 3 points, none at all costs 5. See password managers for CMMC.
Incident response (IR)
3 requirements, 14 objectives, 11 points at stake; 1 may sit on a POA&M
What Level 2 asks. An operational incident-handling capability (prepare, detect, analyse, contain, recover, respond), incidents tracked and reported inside and outside the company, and the capability tested.
What a small shop typically builds
- A written incident response plan that names who does what, including the IT provider. 3.6.1
- An incident log, and a DoD reporting path ready before you need it: under DFARS 252.204-7012 a cyber incident is reported within 72 hours of discovery, and the report needs a DoD-approved medium assurance certificate. 3.6.2
- A tabletop exercise on a cycle you set, with notes on what changed after it. 3.6.3
5-point requirements in this family
- IR.L2-3.6.1
- IR.L2-3.6.2
Watch for: Get the certificate before you need it: looking for one during an incident spends the 72 hours. See DFARS 252.204-7012 explained.
Maintenance (MA)
6 requirements, 10 objectives, 18 points at stake; 2 may sit on a POA&M
What Level 2 asks. Maintenance performed and controlled: the tools and people who do it, equipment cleaned of CUI before it leaves for repair, diagnostic media checked for malware, MFA on remote maintenance sessions that end when the work does, and visiting technicians supervised.
What a small shop typically builds
- A maintenance log for in-scope systems and a rule for which tools may be used. 3.7.1, 3.7.2
- Drives wiped or removed before a laptop or controller goes out for repair. 3.7.3
- Remote support from the IT provider or a machine vendor only through an MFA-protected session that is closed afterwards. 3.7.5
- Diagnostic media scanned for malware before use, and an escort for the visiting technician who has no account of their own. 3.7.4, 3.7.6
5-point requirements in this family
- MA.L2-3.7.2
- MA.L2-3.7.5
Watch for: A machine vendor's standing remote-support link is easy to forget, and nonlocal maintenance without MFA (3.7.5) is a 5-point requirement.
Media protection (MP)
9 requirements, 15 objectives, 23 points at stake; 4 may sit on a POA&M; 1 also in Level 1
What Level 2 asks. CUI on media, paper and digital, physically controlled and stored, limited to authorised users, marked, accounted for in transport and encrypted there, sanitised before disposal or reuse, removable media controlled, ownerless USB drives banned, backups protected.
What a small shop typically builds
- A locked cabinet or room for printed drawings and other paper CUI, with a sign-out habit. 3.8.1, 3.8.2, 3.8.5
- CUI markings on printed drawings, travellers and drives that carry CUI. 3.8.4
- USB storage blocked by default, with approved, owned, encrypted drives as the exception. 3.8.6 to 3.8.8
- A sanitisation method for drives and paper, and encrypted backups. 3.8.3, 3.8.9
5-point requirements in this family
- MP.L2-3.8.3
- MP.L2-3.8.7
Watch for: The printed drawing at the machine is media too: the family says paper and digital, and the paper half is easy to forget. See media sanitization for shop laptops.
Personnel security (PS)
2 requirements, 4 objectives, 8 points at stake; none may sit on a POA&M
What Level 2 asks. People screened before they get access to systems holding CUI, and those systems protected when someone leaves or changes role.
What a small shop typically builds
- A screening step in hiring for anyone who will reach CUI, recorded in the personnel file. 3.9.1
- An offboarding checklist run the same day: accounts disabled, keys, badges and devices back, shared passwords changed. 3.9.2
5-point requirements in this family
- PS.L2-3.9.2
Watch for: Neither personnel requirement is a 1-pointer, so neither can wait on a POA&M.
Physical protection (PE)
6 requirements, 16 objectives, 14 points at stake; 1 may sit on a POA&M, 3 on the never-on-a-POA&M list; 4 also in Level 1
What Level 2 asks. Physical access to systems and the rooms they sit in limited to authorised people, the facility protected and monitored, visitors escorted, physical access logged, keys and badges controlled, and CUI safeguarded at home and other alternate work sites.
What a small shop typically builds
- Locked doors on the rooms where CUI systems and paper live, and a list of who may enter. 3.10.1, 3.10.2
- A visitor log and an escort rule that the front office actually runs. 3.10.3
- A record of physical access, from a badge system or a paper log, kept and reviewed. 3.10.4
- A key and badge register: who holds what, collected when they leave, locks changed when one goes missing. 3.10.5
- Written rules for working on CUI from home. 3.10.6
5-point requirements in this family
- PE.L2-3.10.1
- PE.L2-3.10.2
Watch for: Visitors, access logs and access devices are all on the never-on-a-POA&M list. They are 1-point items, and they still have to be met on the day.
Risk assessment (RA)
3 requirements, 9 objectives, 9 points at stake; 1 may sit on a POA&M
What Level 2 asks. Risk to operations, assets and people assessed periodically, systems and applications scanned for vulnerabilities on a schedule and when new ones are announced, and vulnerabilities fixed according to that risk.
What a small shop typically builds
- A written risk assessment, repeated on the cycle your SSP states. 3.11.1
- Vulnerability scans of in-scope systems on a schedule, and again when a new vulnerability affects them. 3.11.2
- A remediation list ranked by that risk, with dates closed. 3.11.3
5-point requirements in this family
- RA.L2-3.11.2
Watch for: Scanning (3.11.2) is the 5-pointer; the risk assessment that tells you what to fix first is worth 3.
Security assessment (CA)
4 requirements, 14 objectives, 13 points at stake; none may sit on a POA&M, 1 on the never-on-a-POA&M list
What Level 2 asks. Security controls assessed periodically, plans of action to correct what is found, controls monitored on an ongoing basis, and a system security plan that describes the boundary, the environment and how each requirement is met.
What a small shop typically builds
- The system security plan, kept current: it is the first document an assessor reads. 3.12.4
- A self-assessment against the NIST SP 800-171A objectives on a set cycle, and a monitoring routine between them. 3.12.1, 3.12.3
- An operational plan of action for every gap you find, with owners and dates. 3.12.2
5-point requirements in this family
- CA.L2-3.12.1
- CA.L2-3.12.3
Watch for: CA.L2-3.12.4 carries no point value, yet without an up-to-date SSP at the time of assessment, the assessment cannot be completed. See SSP template.
System and communications protection (SC)
16 requirements, 41 objectives, 42 points at stake; 10 may sit on a POA&M; 2 also in Level 1
What Level 2 asks. Communications monitored and protected at the boundary, a secure architecture, user and admin functions separated, public-facing systems on their own subnetwork, traffic denied by default, no split tunnelling, CUI encrypted in transit and at rest with FIPS-validated cryptography, keys managed, sessions ended and authenticated, and cameras, mobile code and VoIP controlled.
What a small shop typically builds
- A firewall at the edge with deny-by-default rules, and the public website kept off the internal network. 3.13.1, 3.13.5, 3.13.6
- Remote access that sends all traffic through the company connection while it is up, and sessions that time out. 3.13.7, 3.13.9
- FIPS-validated encryption on laptops, email and file sharing, and keys you manage. 3.13.8, 3.13.10, 3.13.11, 3.13.16
- Cloud services that hold CUI at FedRAMP Moderate (or higher) or equivalent, with their Customer Responsibility Matrix in your SSP. 32 CFR 170.16(c)(2)
- Conference cameras and microphones that cannot be switched on remotely and show when in use; rules for VoIP and mobile code. 3.13.12 to 3.13.14
5-point requirements in this family
- SC.L2-3.13.1
- SC.L2-3.13.2
- SC.L2-3.13.5
- SC.L2-3.13.6
- SC.L2-3.13.15
Watch for: Encryption that is not FIPS-validated costs 3 points instead of 5, and that one case may sit on a POA&M. No other requirement above 1 point may. See CMMC enclaves for small shops.
System and information integrity (SI)
7 requirements, 20 objectives, 31 points at stake; none may sit on a POA&M; 4 also in Level 1
What Level 2 asks. System flaws found, reported and fixed in time, malicious-code protection in place and kept current, security alerts and advisories acted on, systems scanned, traffic monitored for attacks, and unauthorised use detected.
What a small shop typically builds
- Patching on a schedule, with a record of what was applied and when. 3.14.1
- Endpoint protection that updates itself and scans files as they arrive. 3.14.2, 3.14.4, 3.14.5
- A named person who reads security advisories for the products you run and logs the action taken. 3.14.3
- Monitoring of inbound and outbound traffic and of account use, by your firewall, your IT provider or both. 3.14.6, 3.14.7
5-point requirements in this family
- SI.L2-3.14.1
- SI.L2-3.14.2
- SI.L2-3.14.3
- SI.L2-3.14.4
- SI.L2-3.14.6
Watch for: Every requirement in this family is worth 3 or 5 points, so no SI gap can sit on a POA&M.
How each requirement is marked
An assessor, or you, marks every requirement with one of three findings, and only one of them costs points. The finding is reached objective by objective: one unmet objective makes the whole requirement NOT MET.
MET
Every applicable objective is satisfied, on evidence in final form. Drafts, working papers and unapproved policies do not count.
Also MET: an enduring exception described in the SSP with its mitigations, and a temporary deficiency handled in an operational plan of action that shows progress.
NOT MET
One or more applicable objectives is not satisfied. The assessor records why the evidence falls short, objective by objective.
A POA&M does not change the finding: a requirement not implemented is NOT MET whether it is on a POA&M or not.
N/A
The requirement or objective does not apply when you are assessed, and counts as MET.
The rule's own example: public-access separation (SC.L2-3.13.5) when nothing in scope is publicly accessible.
Two requirements earn partial credit. MFA (IA.L2-3.5.3) costs 3 points if used only for remote and privileged users, 5 if not used at all; encryption (SC.L2-3.13.11) costs 3 points if not FIPS-validated, 5 if absent. Every other requirement is all or nothing.
A score from −203 to 110. Below 88 a POA&M cannot earn a Conditional status, so the filled band is the only ground a Conditional status can stand on; 110, every requirement MET, is Final.
Lowest possible score −203, zero, Conditional minimum 88, maximum 110.
The six requirements that can never wait
A Level 2 POA&M is allowed only if the score is at least 88, every item on it is worth 1 point (or is encryption that works but is not FIPS-validated), and none of the requirements below is on it. Five of the six are worth a single point, which makes them easy to leave for later. The rule does not let you.
| Requirement | What it says | Have on the day |
|---|---|---|
| AC.L2-3.1.20External Connections (CUI Data)1 point | Verify and control/limit connections to and use of external systems. | A list of the outside systems that touch CUI (personal phones, home computers, a customer's portal, cloud services) and the rule that limits each. |
| AC.L2-3.1.22Control Public Information (CUI Data)1 point | Control CUI posted or processed on publicly accessible systems. | A named person who approves what goes on the website and social accounts, and a record that posted material was checked for CUI. |
| CA.L2-3.12.4System Security PlanNo point value | Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. | A current system security plan that covers every system in scope, dated and approved. |
| PE.L2-3.10.3Escort Visitors (CUI Data)1 point | Escort visitors and monitor visitor activity. | A visitor log and an escort rule the front desk follows, including for drivers and vendor technicians. |
| PE.L2-3.10.4Physical Access Logs (CUI Data)1 point | Maintain audit logs of physical access. | Physical access records for the CUI areas, from a badge system or a paper log, kept and looked at. |
| PE.L2-3.10.5Manage Physical Access (CUI Data)1 point | Control and manage physical access devices. | A register of keys, badges and codes: who holds which, collected when people leave, changed when one is lost. |
Everything else that may wait has a clock on it. A POA&M must be closed out within 180 days of the Conditional CMMC Status Date, or the Conditional status expires. How to write one that holds up is in what a POA&M is, and the POA&M template builder refuses any item the rule refuses.
Level 2 on one sheet
| Requirements§ 170.14(c)(3) | 110, from NIST SP 800-171 Rev 2, in 14 families |
|---|---|
| What is checked§ 170.16(c)(1) | 320 NIST SP 800-171A assessment objectives |
| Score§ 170.24(c)(2) | 110 at most, −203 at the lowest; 5, 3 or 1 point per requirement |
| Conditional minimum§ 170.21(a)(2) | 88, with a POA&M of 1-point items (plus non-FIPS encryption) |
| Never on a POA&M§ 170.21(a)(2)(iii) | AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4, PE.L2-3.10.5 |
| POA&M closeout§ 170.21(b) | Within 180 days of the Conditional CMMC Status Date |
| Repeat and affirm§ 170.16(a), 170.22 | Assess every three years; affirm at each assessment and every year |
| Evidence§ 170.16(c)(4) | Kept six years from the CMMC Status Date |
| Cloud holding CUI§ 170.16(c)(2) | FedRAMP Moderate or higher, or equivalent; its CRM in your SSP |
| Which path applies todayStatus box, dated | See the status box at the top of this page |
Questions about Level 2
Does NIST SP 800-171 Rev 3 change the Level 2 requirements?
Not today. DoD binds Rev 2: Part 170 incorporates it and the deviated 7012 names it. Rev 3 (May 2024) has 97 requirements in 17 families against Rev 2's 110 in 14, so a Rev 3 gap list does not line up with your score.DoD's 2026 Regulatory Plan lists a Part 170 amendment (RIN 0790-AM01) that would set a deadline to move to Rev 3; the status box above says whether it has been published. Build to Rev 2 and keep an eye on what Rev 3 changes.
How long does a Level 2 status last?
Under the CMMC clause a Final Level 2 status is current for three years, with an affirmation of continuous compliance not older than one year. A Conditional status is current for 180 days, which is the window to close the POA&M. Either one stops being current if your compliance changes after the status date.
Can a requirement be not applicable?
Yes. A requirement or objective that does not apply when you are assessed is marked N/A and counts as MET; the rule's example is public-access separation when nothing in scope is public. If the DoD CIO has ruled a requirement not applicable or met by an equally effective alternative, that adjudication must be in your system security plan to be considered.
Does Level 2 cover the whole company?
Only what is in scope. Systems that process, store or transmit CUI are assessed against all Level 2 requirements; security tools that protect them against the requirements relevant to what they do; out-of-scope systems not at all. That is why many small shops put CUI in a small, separate environment. Compare the options in CMMC enclaves.
Do my IT provider and my cloud services count?
Yes, through your scope. A cloud service that holds CUI must be FedRAMP Authorized at Moderate or higher, or meet equivalent requirements, and its Customer Responsibility Matrix goes in your SSP. An IT provider that is not a cloud provider may hold CUI if the arrangement is in your SSP and its services are assessed inside your scope against all Level 2 requirements. How providers package that is in managed service providers for CMMC.
What does a Level 2 assessment cost?
DoD's own estimate, in 2023 dollars, covers the assessment, not the work to meet the requirements: for a small entity, $37,196 per cycle for Level 2 (Self) and $104,670 for Level 2 (C3PAO), affirmations included. Your own figure depends on scope and on what is already in place; the CMMC cost estimator starts from DoD's numbers.
Where does the score go?
Into SPRS, with the CMMC level, the status date, the assessment scope, every CAGE code in that scope, the overall score and whether a POA&M is in use. The steps are in how to submit an SPRS score.