# CMMC Level 2 Requirements: What a Small Manufacturer Has to Build

URL: https://limehawk.io/reports/cmmc-level-2-requirements
Published: 2026-10-02
Author: Corey Watson, Managing Member
Topic: Guides
Read time: 7 min

CMMC Level 2 means meeting all 110 NIST SP 800-171 Rev 2 requirements to protect CUI, with a score in SPRS, an SSP, and a yearly affirmation.

> **TL;DR** CMMC Level 2 applies when your DoD contract puts Controlled Unclassified Information (CUI) on your systems. The rule at 32 CFR 170 requires all 110 security requirements in NIST SP 800-171 Revision 2, not Revision 3. You either self-assess and post your score in SPRS, or a C3PAO certifies you, depending on what the contract says. A POA&M can buy you 180 days on some gaps, but only if you score at least 88 out of 110. On July 13, 2026, the Department of War suspended the move to Phase 2, so for now new contracts can only ask for a Level 2 self-assessment. The 110 requirements didn't go anywhere.

- Lowest score allowed with a POA&M: 88 of 110

## What is CMMC Level 2?

CMMC Level 2 is the Department of Defense's cybersecurity requirement for contractors that process, store, or transmit Controlled Unclassified Information (CUI) on their own systems. To meet it, you have to implement all 110 security requirements in NIST SP 800-171 Revision 2, and you have to prove it with an assessment.

CUI is the step up from Federal Contract Information. If your work for a prime or the DoD only involves FCI, you're looking at Level 1, which we cover in our [CMMC Level 1 guide](/reports/cmmc-level-1). If you get drawings, specs, or technical data marked CUI, you're at Level 2. For a lot of machine shops and fabricators, that's the drawing package itself.

The program rule is [32 CFR Part 170](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170). It defines the CMMC security requirements as "the 110 Level 2 requirements from NIST SP 800-171 R2." Those 110 requirements fall into 14 families: access control, awareness and training, audit, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.

## Does CMMC Level 2 use NIST SP 800-171 Rev 2 or Rev 3?

Rev 2. NIST [withdrew Revision 2](https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final) on May 14, 2024 and replaced it with Revision 3. The CMMC rule doesn't follow NIST automatically, though. Section 170.2 incorporates the February 2020 Revision 2 by reference, so that's the version you're scored against.

The July 2026 suspension memo says the same thing. During the review, DoW will "enforce baseline compliance with NIST SP 800-171 Rev 2." Build to Rev 2. If the rule changes, you'll be starting from a working baseline, not a blank page.

## Do I need a self-assessment or a C3PAO certification?

Your contract decides that, not you. The rule has two Level 2 statuses. **Level 2 (Self)** means you assess yourself and post the score in the Supplier Performance Risk System (SPRS). **Level 2 (C3PAO)** means an authorized third-party assessment organization does the assessment and uploads the results. Both have the same 110 requirements, the same scoring, and a three-year cycle. Both need an affirmation of compliance at the time of assessment and every year after.

The rule's [phased rollout](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170#p-170.3(e)) started Phase 1 when the [DFARS acquisition rule](https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of) took effect on November 10, 2025. Phase 2 was supposed to start one year later and bring C3PAO certification in as a condition of award.

That changed. On July 13, 2026, the Under Secretary for Acquisition and Sustainment issued a [memo suspending the Phase 2 transition](https://dowcio.war.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf). While the DoW CIO reviews the program, contracting offices "may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments." The only designations allowed are Level 1 (Self) and Level 2 (Self). Contracts that already have a C3PAO requirement get it removed at the next option period or administrative modification. DFARS 252.204-7012 stays in effect. On September 3, 2026, DoD wrote the same limits into contracting rules with [Class Deviation 2026-O0025 Revision 3](https://www.acq.osd.mil/dpap/dars/classdev/DFARS_RFO/Part-240/2026-O0025_Rev3_TAB_A_Deviation_Memo.pdf). The memo promised more guidance after a 60-day review; as of October 2, 2026, no review outcome has been published, so check the solicitation in front of you, not a blog's timeline.

None of this makes a self-assessment easier. The rule still lets DoD run a DCMA DIBCAC assessment on a self-assessed contractor. If that assessment finds gaps, its results take precedence over your score.

## What is a POA&M, and what are its limits?

A POA&M (plan of action and milestones) lets you get a conditional status while you finish fixing a few gaps. [Section 170.21](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170#p-170.21(a)(2)) puts hard limits on it:

- **Score floor.** Your score divided by 110 has to be at least 0.8. That's 88 of 110.
- **One-point items only.** Requirements worth 3 or 5 points can't go on the POA&M. The one exception is encryption that's in place but not FIPS-validated.
- **Never on a POA&M:** the system security plan, external connections, control of public information, visitor escorts, physical access logs, and managing physical access devices.
- **180 days.** You have to close every item and pass a closeout assessment within 180 days, or the conditional status expires.

Scoring starts at 110 and subtracts 1, 3, or 5 points for each requirement that's not met. The score can go negative. MFA, account control, audit logging, incident response, and malware protection are 5-point requirements. If any of those are missing, a POA&M won't cover it. Fix them first.

## What is a System Security Plan?

The SSP is the document that describes your CUI environment and how each of the 110 requirements is met there. [Section 170.24](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170#p-170.24(c)(2)(i)(B)(5)) says you must have one at the time of assessment. Without one, the assessment "could not be completed."

A useful SSP names the systems in scope, draws the boundary, and says who does what. If you use a cloud provider or an MSP for in-scope work, the rule says that relationship belongs in your SSP too, along with the provider's customer responsibility matrix. Evidence has to be final, not draft, and you keep it for six years.

## What does IT actually have to build and document?

The paperwork follows the build. Here's what a small manufacturer's IT has to be able to show an assessor:

1. **A scope.** An asset inventory and a network diagram that sort every device into CUI assets, security protection assets, contractor risk managed assets, specialized assets, or out of scope. A smaller CUI enclave makes everything else cheaper to run.
2. **Accounts and MFA.** Named accounts only, least privilege, and MFA for every user, not just admins and remote users.
3. **Encryption** for CUI at rest and in transit, using FIPS-validated cryptography. We've written up how we [roll out BitLocker across a fleet with escrowed recovery keys](/reports/bitlocker-encryption-automation). Turning encryption on is the easy half. Proving the module is validated is a separate check.
4. **Logging** that's kept, reviewed, and tied to individual users.
5. **Baseline configurations and patching**, with changes tracked.
6. **An incident response plan** that you've actually tested.
7. **Training records** and physical access controls for the rooms where CUI lives.

Plant-floor equipment gets its own treatment. Under the [scoping rules](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170#p-170.19(c)(1)), operational technology and IIoT count as Specialized Assets. They aren't assessed against the other requirements, but they have to show up in your inventory, your SSP, and your network diagram, and you have to manage them under written risk-based policies. An old Windows box running a CNC machine can stay. It just has to be documented and walled off. That's the same segmentation work we describe on our [manufacturing IT page](/industries/manufacturing).

An inventory you can trust is the base layer. We pulled one together for an insurer in [our automated hardware inventory report](/reports/automated-hardware-inventory), with serials, specs, and encryption status for every machine.

## Key takeaways

- Level 2 is for CUI. The rule ties it to the 110 requirements in NIST SP 800-171 Revision 2, even though NIST has since published Revision 3.
- Since July 13, 2026, new solicitations can only ask for Level 2 (Self). Third-party C3PAO requirements are suspended while DoW reviews the program.
- A POA&M only works if you score 88 of 110 or better, and the gaps on it get 180 days to close. The SSP itself can never be on a POA&M.
- Self-assessment is not a lighter standard. You still have to meet all 110 requirements, post the score in SPRS, and affirm it every year.
- Plant-floor OT can be scoped as a Specialized Asset, but only if it's in your inventory, your network diagram, and your SSP.

## What this looks like when we do it

Limehawk isn't a C3PAO, a Registered Practitioner Organization, or an assessor. We can't certify you or sign your affirmation. A senior official at your company signs that.

What we do is the IT under it. We scope the environment, segment the plant floor from the office, enforce MFA, roll out encryption, set up logging and patching, and pull evidence straight from the tools that run those controls. Then your SSP describes systems that actually exist. If we manage in-scope systems for you, we're an external service provider in your SSP, and our part gets assessed along with yours. We plan for that from day one.

If you're a manufacturer with CUI drawings coming in, our [manufacturing IT support](/industries/manufacturing) page covers how we handle the OT side.

Have a prime asking for your SPRS score and a list of gaps you haven't counted yet? Book a call and we'll go through it.