hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
Contact Sterling Academy login
SterlingInternational Consulting Talk to a consultantTalk to us
← All videos

Implementation walkthrough

How to implement CMMC 2.0: video walkthrough

A walkthrough of preparing for CMMC 2.0, from confirming the level a solicitation names to self-assessment, a C3PAO certification assessment or DIBCAC.

  • Implementation walkthrough
  • 3 min 15 s

Key takeaways

  • CMMC protects Federal Contract Information and Controlled Unclassified Information.
  • Level 2 is identical to the requirements of NIST SP 800-171 Revision 2.
  • Scope every asset that handles FCI or CUI before assessing requirements.
  • A system security plan and remediation sit behind every affirmation.
  • Requirements flow down to subcontractors at every tier.

Protecting FCI and CUI before contract award

The Cybersecurity Maturity Model Certification is how the US Department of War, written DoD in the regulations, checks that contractors protect two kinds of unclassified information on their own systems: Federal Contract Information, provided by or generated for the government under a contract and not meant for public release, and Controlled Unclassified Information, which law, regulation or government-wide policy requires to be safeguarded. Contractors already had to protect both; CMMC adds a status in the Supplier Performance Risk System that a contracting officer must see before award.

It applies to prime contractors and subcontractors at every tier, in the United States and abroad, that process, store or transmit that information for a defence contract. This short film walks through how a contractor prepares.

From scoping to the assessment

Start by confirming the level, the assessment type and the information in scope, reading the solicitation for what it requires. Level 1 covers Federal Contract Information with a self-assessment. Level 2 covers CUI and is identical to the requirements of NIST SP 800-171 Revision 2, either as a self-assessment or as a certification assessment by an authorised C3PAO. Level 3 is assessed by DCMA DIBCAC.

Scoping comes next: every asset that processes, stores or transmits the information, and what protects those assets, is identified before any requirement is assessed, with a network diagram and a map of how CUI flows. A gap analysis against the requirements then feeds a system security plan and remediation, so each requirement is met across the assets in scope with evidence behind every affirmation. Self-assessment results are entered in SPRS and affirmed by a senior official; for a certification assessment, the C3PAO or DIBCAC reaches its own result, and only the contractor's Affirming Official affirms.

Sterling's expert and experienced consultants carry the scoping, gap analysis, system security plan and remediation with your team under Sterling OS™, and prepare you for self-assessment or C3PAO assessment. The phased roll-out follows the rules in force; check the current phase for the solicitations you bid on.

CMMC 2.0 at a glance

Purpose
Verifying that contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) on their own systems before the Department awards them work
Relevant to
Prime contractors and subcontractors at every tier, in the US and abroad, that process, store or transmit FCI or CUI for a DoW contract
Edition
32 CFR Part 170 since 16 December 2024, the DFARS rule since 10 November 2025; Level 2 is NIST SP 800-171 Rev 2. Phase 1 applies; Phase 2 suspended on 13 July 2026 pending review
Certification
Levels 1 and 2 (Self): self-assessment in SPRS, affirmed by a senior official. Level 2 (C3PAO): certification assessment by an authorised C3PAO. Level 3: DCMA DIBCAC
Sterling's role
Scoping, gap analysis, system security plan and remediation with your team, Effivity, training, self-assessment and C3PAO readiness, then Sustain™
Cost and timing
Total investment for CMMC depends on the current maturity of your processes and security controls, the scope, locations and number of employees. The process typically takes 2 to 12 months

CMMC 2.0: the complete guide →

CMMC 2.0: questions people ask

What is the difference between CMMC Level 1, Level 2 and Level 3?

Level 1 covers FCI: the 15 requirements of FAR 52.204-21, self-assessed and affirmed every year, results in SPRS, no plan of action allowed. Level 2 covers CUI: the 110 requirements of NIST SP 800-171 Rev 2, assessed every three years by you, Level 2 (Self), or by an authorised C3PAO, Level 2 (C3PAO), as the solicitation specifies, and affirmed yearly. Level 3 adds 24 requirements from NIST SP 800-172, assessed every three years by DCMA DIBCAC, and needs Final Level 2 (C3PAO) status for the same scope first.

Is CMMC 2.0 still required after the July 2026 Phase 2 suspension?

Yes, at Phase 1. On 13 July 2026 the Department of War suspended Phase 2, which was to begin on 10 November 2026 and add Level 2 (C3PAO) as a condition of award, and set up a reform task force. It states that the Phase 1 self-assessment requirements remain in place and that NIST SP 800-171 Rev 2 will be enforced through self-assessments and select government-led assessments during the review. The rules remain published, so read each solicitation and flow-down for the level it names, and expect changes when the review concludes.

Do subcontractors and suppliers outside the United States need CMMC?

If they will process, store or transmit FCI or CUI on their own systems for a DoW contract, yes. The requirement flows down to every tier, with the level and assessment type set for each subcontract, and the rule makes no exception for location. Agree the level and scope with your prime early. Sterling supports suppliers from offices in 21 countries.

Can we self-assess Level 2, or do we need a C3PAO?

The solicitation or your prime decides. Phase 1 calls for Level 1 (Self) or Level 2 (Self) in applicable solicitations; Phase 2, which was to add Level 2 (C3PAO) as a condition of award, is suspended. Where a C3PAO assessment is required, only an authorised C3PAO can conduct it. The 110 requirements are the same either way, so prepare once, to the evidence standard a third party would expect.

What score do we need, and can we use a plan of action (POA&M)?

Final status needs every requirement for your level met. At Level 2 a conditional status with a POA&M is possible if your score is at least 88 of 110 (80%), every open item is worth one point, with one exception for encryption in place but not FIPS-validated, and none of six excluded requirements is open: control of external connections, control of CUI on publicly accessible systems, the system security plan, escorting visitors, physical access logs and management of physical access. The POA&M must close within 180 days or the conditional status expires. Level 1 allows no POA&M.

More CMMC 2.0 questions and answers →

Keep exploring

Related to this video

Read next

Services

Next steps

The complete guide

Everything on CMMC 2.0

Start with the CMMC 2.0 page, or go straight to the guide you need.

On the CMMC 2.0 page

Often combined with CMMC 2.0

More videos: Information security, cyber and cloud

All videos

Talk to a consultant

Plan your CMMC 2.0 certification with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice