Two-minute brief
CMMC 2.0 requirements explained: video brief
A two-minute brief on the three CMMC 2.0 levels and what each asks of a defence contractor.
Key takeaways
- CMMC has three levels of fixed security requirements.
- Scope comes first, with assets sorted into defined categories at Level 2.
- Level 1 applies the 15 FAR 52.204-21 requirements to FCI.
- Level 2 equals the 110 requirements of NIST SP 800-171 Revision 2.
- Results and affirmations are recorded in SPRS.
Fixed requirements at each level
CMMC has no management system clauses. Each level is a fixed set of security requirements, and the assessment asks whether each is met across the assets in scope. This short film walks through the levels.
Everything starts with the assessment boundary: every asset that processes, stores or transmits Federal Contract Information or Controlled Unclassified Information, and what protects those assets, is identified first. At Level 2 assets are sorted into CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets such as operational technology and test equipment, and Out-of-Scope Assets, with a network diagram and a CUI flow map. Level 1 covers basic safeguarding of Federal Contract Information through the 15 requirements of FAR 52.204-21.
Level 2, Level 3 and how results are recorded
Level 2 is identical to the 110 requirements of NIST SP 800-171 Revision 2, grouped in 14 families that CMMC calls domains, from access control, configuration management and incident response to media protection, risk assessment and the integrity of systems and information. Level 3 adds further requirements for the most sensitive programmes and is assessed by DCMA DIBCAC.
Results are recorded in the Supplier Performance Risk System. Levels 1 and 2 can be self-assessed and affirmed by a senior official; Level 2 can also require a certification assessment by an authorised C3PAO. The rules sit in 32 CFR Part 170, in force since 16 December 2024, and the DFARS rule since 10 November 2025, with a phased roll-out. Contractors should check what each solicitation names and the phase currently in force.
Level 1 covers Federal Contract Information through the 15 requirements of FAR 52.204-21, self-assessed and affirmed every year. Level 2 covers Controlled Unclassified Information through the 110 requirements of NIST SP 800-171 Revision 2, which the rule incorporates by reference. The requirement flows down to subcontractors at every tier that process, store or transmit FCI or CUI on their own systems, wherever they are located, so the level and scope are agreed with the prime contractor early.
CMMC 2.0 at a glance
- Purpose
- Verifying that contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) on their own systems before the Department awards them work
- Relevant to
- Prime contractors and subcontractors at every tier, in the US and abroad, that process, store or transmit FCI or CUI for a DoW contract
- Edition
- 32 CFR Part 170 since 16 December 2024, the DFARS rule since 10 November 2025; Level 2 is NIST SP 800-171 Rev 2. Phase 1 applies; Phase 2 suspended on 13 July 2026 pending review
- Certification
- Levels 1 and 2 (Self): self-assessment in SPRS, affirmed by a senior official. Level 2 (C3PAO): certification assessment by an authorised C3PAO. Level 3: DCMA DIBCAC
- Sterling's role
- Scoping, gap analysis, system security plan and remediation with your team, Effivity, training, self-assessment and C3PAO readiness, then Sustain™
- Cost and timing
- Total investment for CMMC depends on the current maturity of your processes and security controls, the scope, locations and number of employees. The process typically takes 2 to 12 months
CMMC 2.0: questions people ask
What is the difference between CMMC Level 1, Level 2 and Level 3?
Level 1 covers FCI: the 15 requirements of FAR 52.204-21, self-assessed and affirmed every year, results in SPRS, no plan of action allowed. Level 2 covers CUI: the 110 requirements of NIST SP 800-171 Rev 2, assessed every three years by you, Level 2 (Self), or by an authorised C3PAO, Level 2 (C3PAO), as the solicitation specifies, and affirmed yearly. Level 3 adds 24 requirements from NIST SP 800-172, assessed every three years by DCMA DIBCAC, and needs Final Level 2 (C3PAO) status for the same scope first.
Is CMMC 2.0 still required after the July 2026 Phase 2 suspension?
Yes, at Phase 1. On 13 July 2026 the Department of War suspended Phase 2, which was to begin on 10 November 2026 and add Level 2 (C3PAO) as a condition of award, and set up a reform task force. It states that the Phase 1 self-assessment requirements remain in place and that NIST SP 800-171 Rev 2 will be enforced through self-assessments and select government-led assessments during the review. The rules remain published, so read each solicitation and flow-down for the level it names, and expect changes when the review concludes.
Do subcontractors and suppliers outside the United States need CMMC?
If they will process, store or transmit FCI or CUI on their own systems for a DoW contract, yes. The requirement flows down to every tier, with the level and assessment type set for each subcontract, and the rule makes no exception for location. Agree the level and scope with your prime early. Sterling supports suppliers from offices in 21 countries.
Can we self-assess Level 2, or do we need a C3PAO?
The solicitation or your prime decides. Phase 1 calls for Level 1 (Self) or Level 2 (Self) in applicable solicitations; Phase 2, which was to add Level 2 (C3PAO) as a condition of award, is suspended. Where a C3PAO assessment is required, only an authorised C3PAO can conduct it. The 110 requirements are the same either way, so prepare once, to the evidence standard a third party would expect.
What score do we need, and can we use a plan of action (POA&M)?
Final status needs every requirement for your level met. At Level 2 a conditional status with a POA&M is possible if your score is at least 88 of 110 (80%), every open item is worth one point, with one exception for encryption in place but not FIPS-validated, and none of six excluded requirements is open: control of external connections, control of CUI on publicly accessible systems, the system security plan, escorting visitors, physical access logs and management of physical access. The POA&M must close within 180 days or the conditional status expires. Level 1 allows no POA&M.
Keep exploring
Related to this video
The complete guide
Everything on CMMC 2.0
Start with the CMMC 2.0 page, or go straight to the guide you need.
On the CMMC 2.0 page
- What are the main CMMC 2.0 requirements?
- How do you get CMMC 2.0 certified?
- How much does CMMC 2.0 certification cost?
- How long does CMMC 2.0 certification take?
- Who needs CMMC 2.0 certification?
- How CMMC 2.0 supports defence contract eligibility and CUI protection
- Frequently asked questions about CMMC 2.0
Often combined with CMMC 2.0
More videos: Information security, cyber and cloud
- How to implement CSA STARImplementation walkthrough · 3 min 15 s
- CSA STAR requirements explainedTwo-minute brief · 2 min
- How to get Cyber Essentials certifiedImplementation walkthrough · 3 min 15 s
- Cyber Essentials requirements explainedTwo-minute brief · 2 min
- How to comply with the DESC Information Security Regulation (Dubai)Compliance walkthrough · 3 min 15 s
- DESC Information Security Regulation (Dubai) explainedTwo-minute brief · 2 min
- How to implement IEC 62443Implementation walkthrough · 3 min 15 s
- IEC 62443 requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27018Implementation walkthrough · 3 min 15 s
Talk to a consultant
Plan your CMMC 2.0 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice