CMMC Level 2: What Defence Suppliers Actually Have to Do
For years, defence suppliers handling controlled unclassified information (CUI) have attested to implementing NIST SP 800-171. Self-attestation is being replaced by assessment, through the Cybersecurity Maturity Model Certification programme.
The practical change is simple and significant: what you claimed now has to be demonstrated — in many cases to a third party — and the result gates contract eligibility.
The levels, briefly
Level 1 covers Federal Contract Information (FCI) and requires 15 basic safeguarding practices, with annual self-assessment. If you handle only FCI, this is your scope.
Level 2 covers CUI and aligns with the 110 controls of NIST SP 800-171. Most Level 2 contracts require assessment by a certified third-party organisation (C3PAO); a subset permit self-assessment. This is where most of the defence industrial base sits.
Level 3 adds controls from NIST SP 800-172 for the highest-priority programmes, assessed by the government.
The first question is therefore not "which level" but "do we handle CUI at all, and where is it?"
Start with scope, because it determines everything
The single highest-leverage decision in a CMMC programme is scoping. Every system that stores, processes or transmits CUI is in scope, along with everything that provides security protection to those systems.
Two broad approaches:
Enclave. Build a defined environment where CUI lives, and keep it out of everything else. The assessment covers the enclave and its supporting infrastructure. Dramatically smaller scope, usually much cheaper to assess and maintain.
Whole-environment. Everything is in scope. Simpler conceptually, far more expensive in practice, and every future change touches an assessed boundary.
For most small and mid-sized suppliers, an enclave is the right answer — but only if CUI genuinely stays inside it. An enclave with CUI leaking into general email and file shares is worse than no enclave, because the boundary is documented and demonstrably not holding.
That means the scoping work is mostly data discovery: finding where CUI actually is today. It is usually in more places than the org chart suggests — in email, in an engineer's local folder, in a shared drive, in a quoting system.
The documentation that is not optional
Two artefacts are central, and assessors will ask for both immediately:
System Security Plan (SSP). Describes your environment, its boundary, and how each of the 110 controls is implemented. Not a policy statement — a specific description of how your systems meet each requirement.
Plan of Action and Milestones (POA&M). Lists requirements not yet met, with remediation plans and dates. Important: CMMC limits which requirements may sit on a POA&M, and some must be fully met at assessment. Check the current rules rather than assuming anything can be deferred.
An SSP written as a generic template is the most common reason assessments go badly. It must describe your environment well enough that an assessor can test against it.
Where suppliers commonly fall short
Multi-factor authentication everywhere in scope. Often deployed for email and missing on the engineering systems where CUI actually lives.
FIPS-validated cryptography. The requirement is for validated modules, not merely "encryption". This catches people out because products often support both a validated and a non-validated mode, and the default is frequently the latter.
Audit logging and review. Collecting logs is common; reviewing them, with evidence, is not.
Media protection and sanitisation. Marked media, controlled disposal, documented sanitisation.
Physical controls around the enclave, including visitor logs and escort procedures.
Flow-down to subcontractors. You must pass requirements down, and confirm they are met. Your assessment covers your boundary, but contractual obligation does not stop there.
Cloud providers. If CUI touches a cloud service, FedRAMP equivalence requirements apply. This frequently drives a move to a government-community cloud offering, which is a project in itself and should be identified early rather than discovered late.
A realistic sequence
- Determine whether you handle CUI, and get contractual clarity on what is CUI in your contracts. Ask the contracting officer if it is ambiguous — this is a normal question.
- Discover where it lives. Technical discovery plus interviews. Expect surprises.
- Decide the boundary. Enclave or whole-environment, with the cost consequence stated.
- Gap assessment against all 110 requirements.
- Write the SSP describing the target state, and the POA&M for the gaps.
- Remediate, prioritising the requirements that cannot sit on a POA&M.
- Operate for long enough to have evidence. Assessors sample; controls need a history.
- Pre-assessment with an independent party before the real one.
- Third-party assessment.
Timelines of twelve to twenty-four months from standing start are normal for an organisation beginning with ordinary commercial IT. Suppliers that already run a mature environment move faster.
The commercial framing
It is tempting to treat this as a compliance cost. For defence suppliers it is more accurately a market access cost: as the requirement flows into contracts, suppliers without an assessment become ineligible regardless of their technical merit or price.
Which also makes it an opportunity. Readiness ahead of your competitors is a real advantage on bids where the requirement is in force and the field has narrowed.
The thing not to do is wait for a specific contract to require it and then begin. The elapsed time — remediation, then operating long enough to have evidence, then scheduling an assessor — is far longer than any bid window.
