CMMC Level 2 Requirements: What a Small Manufacturer Has to Build

What is CMMC Level 2?

CMMC Level 2 is the Department of Defense’s cybersecurity requirement for contractors that process, store, or transmit Controlled Unclassified Information (CUI) on their own systems. To meet it, you have to implement all 110 security requirements in NIST SP 800-171 Revision 2, and you have to prove it with an assessment.

CUI is the step up from Federal Contract Information. If your work for a prime or the DoD only involves FCI, you’re looking at Level 1, which we cover in our CMMC Level 1 guide. If you get drawings, specs, or technical data marked CUI, you’re at Level 2. For a lot of machine shops and fabricators, that’s the drawing package itself.

The program rule is 32 CFR Part 170. It defines the CMMC security requirements as “the 110 Level 2 requirements from NIST SP 800-171 R2.” Those 110 requirements fall into 14 families: access control, awareness and training, audit, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.

Does CMMC Level 2 use NIST SP 800-171 Rev 2 or Rev 3?

Rev 2. NIST withdrew Revision 2 on May 14, 2024 and replaced it with Revision 3. The CMMC rule doesn’t follow NIST automatically, though. Section 170.2 incorporates the February 2020 Revision 2 by reference, so that’s the version you’re scored against.

The July 2026 suspension memo says the same thing. During the review, DoW will “enforce baseline compliance with NIST SP 800-171 Rev 2.” Build to Rev 2. If the rule changes, you’ll be starting from a working baseline, not a blank page.

Do I need a self-assessment or a C3PAO certification?

Your contract decides that, not you. The rule has two Level 2 statuses. Level 2 (Self) means you assess yourself and post the score in the Supplier Performance Risk System (SPRS). Level 2 (C3PAO) means an authorized third-party assessment organization does the assessment and uploads the results. Both have the same 110 requirements, the same scoring, and a three-year cycle. Both need an affirmation of compliance at the time of assessment and every year after.

The rule’s phased rollout started Phase 1 when the DFARS acquisition rule took effect on November 10, 2025. Phase 2 was supposed to start one year later and bring C3PAO certification in as a condition of award.

That changed. On July 13, 2026, the Under Secretary for Acquisition and Sustainment issued a memo suspending the Phase 2 transition. While the DoW CIO reviews the program, contracting offices “may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments.” The only designations allowed are Level 1 (Self) and Level 2 (Self). Contracts that already have a C3PAO requirement get it removed at the next option period or administrative modification. DFARS 252.204-7012 stays in effect. On September 3, 2026, DoD wrote the same limits into contracting rules with Class Deviation 2026-O0025 Revision 3. The memo promised more guidance after a 60-day review; as of October 2, 2026, no review outcome has been published, so check the solicitation in front of you, not a blog’s timeline.

None of this makes a self-assessment easier. The rule still lets DoD run a DCMA DIBCAC assessment on a self-assessed contractor. If that assessment finds gaps, its results take precedence over your score.

What is a POA&M, and what are its limits?

A POA&M (plan of action and milestones) lets you get a conditional status while you finish fixing a few gaps. Section 170.21 puts hard limits on it:

• Score floor. Your score divided by 110 has to be at least 0.8. That’s 88 of 110.
• One-point items only. Requirements worth 3 or 5 points can’t go on the POA&M. The one exception is encryption that’s in place but not FIPS-validated.
• Never on a POA&M: the system security plan, external connections, control of public information, visitor escorts, physical access logs, and managing physical access devices.
• 180 days. You have to close every item and pass a closeout assessment within 180 days, or the conditional status expires.

Scoring starts at 110 and subtracts 1, 3, or 5 points for each requirement that’s not met. The score can go negative. MFA, account control, audit logging, incident response, and malware protection are 5-point requirements. If any of those are missing, a POA&M won’t cover it. Fix them first.

What is a System Security Plan?

The SSP is the document that describes your CUI environment and how each of the 110 requirements is met there. Section 170.24 says you must have one at the time of assessment. Without one, the assessment “could not be completed.”

A useful SSP names the systems in scope, draws the boundary, and says who does what. If you use a cloud provider or an MSP for in-scope work, the rule says that relationship belongs in your SSP too, along with the provider’s customer responsibility matrix. Evidence has to be final, not draft, and you keep it for six years.

What does IT actually have to build and document?

The paperwork follows the build. Here’s what a small manufacturer’s IT has to be able to show an assessor:

1. A scope. An asset inventory and a network diagram that sort every device into CUI assets, security protection assets, contractor risk managed assets, specialized assets, or out of scope. A smaller CUI enclave makes everything else cheaper to run.
2. Accounts and MFA. Named accounts only, least privilege, and MFA for every user, not just admins and remote users.
3. Encryption for CUI at rest and in transit, using FIPS-validated cryptography. We’ve written up how we roll out BitLocker across a fleet with escrowed recovery keys. Turning encryption on is the easy half. Proving the module is validated is a separate check.
4. Logging that’s kept, reviewed, and tied to individual users.
5. Baseline configurations and patching, with changes tracked.
6. An incident response plan that you’ve actually tested.
7. Training records and physical access controls for the rooms where CUI lives.

Plant-floor equipment gets its own treatment. Under the scoping rules, operational technology and IIoT count as Specialized Assets. They aren’t assessed against the other requirements, but they have to show up in your inventory, your SSP, and your network diagram, and you have to manage them under written risk-based policies. An old Windows box running a CNC machine can stay. It just has to be documented and walled off. That’s the same segmentation work we describe on our manufacturing IT page.

An inventory you can trust is the base layer. We pulled one together for an insurer in our automated hardware inventory report, with serials, specs, and encryption status for every machine.

Key takeaways

What this looks like when we do it

Limehawk isn’t a C3PAO, a Registered Practitioner Organization, or an assessor. We can’t certify you or sign your affirmation. A senior official at your company signs that.

What we do is the IT under it. We scope the environment, segment the plant floor from the office, enforce MFA, roll out encryption, set up logging and patching, and pull evidence straight from the tools that run those controls. Then your SSP describes systems that actually exist. If we manage in-scope systems for you, we’re an external service provider in your SSP, and our part gets assessed along with yours. We plan for that from day one.

If you’re a manufacturer with CUI drawings coming in, our manufacturing IT support page covers how we handle the OT side.

Have a prime asking for your SPRS score and a list of gaps you haven’t counted yet? Book a call and we’ll go through it.