Framework

CMMC 2.0
Levels 1, 2, and 3 assessment, evidence, and remediation

The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the US Department of Defense compliance regime for contractors handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Run CMMC scoping, control implementation, evidence collection, vulnerability scanning, POA&M tracking, and assessor-ready evidence packs aligned to NIST SP 800-171 Rev. 2, NIST SP 800-172, and 32 CFR Part 170 from one workflow.

Get Started Free

No credit card required. Free plan available forever.

CMMC 2.0 in context: the DoD's compliance regime for the Defense Industrial Base

The Cybersecurity Maturity Model Certification (CMMC) is the United States Department of Defense compliance regime that verifies how contractors in the Defense Industrial Base protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). CMMC was first published in 2020, restructured into CMMC 2.0 in late 2021, and codified in the final rule at 32 CFR Part 170 published by the DoD in October 2024. The DFARS rule that operationalises CMMC inside contracts (DFARS 252.204-7021) is rolling out under a phased implementation through 2025 and beyond, applied first to selected DoD acquisitions and then to the wider contract portfolio.

CMMC sits inside a wider US federal control ecosystem. The Level 2 control set is drawn directly from NIST SP 800-53 Rev. 5 as expressed in NIST SP 800-171 Rev. 2 for non-federal systems. The Level 3 enhancements come from NIST SP 800-172. For cloud services delivering capability into a CMMC environment, the cloud service provider must hold an equivalent FedRAMP authorisation (typically Moderate baseline or above) under DFARS 252.204-7012. The control catalogue, the risk language, and the assessment artefacts all map cleanly across these regimes, which matters most for organisations that have to satisfy more than one programme from the same body of work.

The three CMMC 2.0 levels and who they apply to

CMMC 2.0 collapsed the original five-level model into three levels. The level a contract requires is determined by the data classification handled (FCI or CUI) and the sensitivity of the programme. Many DoD primes and subcontractors operate at Level 2 because most CUI contracts land there; Level 1 is common for parts of a portfolio that touch FCI only; Level 3 is reserved for the highest-value programmes. A single organisation can hold different levels for different parts of its environment, with the boundary diagram and the SSP evidencing the separation.

Level 1: Foundational (FCI only)

Applies to contractors that handle Federal Contract Information (FCI) but not Controlled Unclassified Information. The 17 basic safeguarding requirements come directly from FAR 52.204-21. Assessment is annual self-assessment with senior official affirmation submitted to the Supplier Performance Risk System (SPRS). No third-party certification is required at Level 1, but the affirmation is auditable and a false affirmation carries False Claims Act exposure.

Level 2: Advanced (CUI)

Applies to contractors that store, process, or transmit Controlled Unclassified Information. The 110 controls are drawn from NIST SP 800-171 Rev. 2 across 14 families. Most Level 2 contracts require a triennial assessment by an authorised CMMC Third Party Assessor Organisation (C3PAO) registered with the CyberAB. A subset is permitted to self-assess based on the specific contract clauses and the type of CUI handled.

Level 3: Expert (high-value CUI)

Applies to contractors handling CUI on the most sensitive national security programmes. The baseline is the full 110 NIST SP 800-171 Rev. 2 controls plus 24 selected NIST SP 800-172 enhanced security requirements. Level 3 assessments are run by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) on a triennial cadence. Level 3 organisations also have to maintain Level 2 certification for the parts of their environment that are not Level 3 in scope.

Scoping CMMC: FCI, CUI, and the asset categories that decide effort

CMMC scope is the most consequential single decision in the programme. It determines which assets get assessed, which controls apply, and how much remediation effort is required. Scope is defined first by data classification (does the asset handle FCI, CUI, or neither) and then by asset category. The DoD CMMC scoping guidance defines five asset categories; each category drives a different assessment treatment.

CUI Assets

Assets that store, process, or transmit Controlled Unclassified Information. These are fully in scope for assessment and must implement every applicable NIST SP 800-171 control. The boundary diagram has to identify every CUI Asset and the data flows between them. Scope errors here are the single biggest cause of failed C3PAO assessments.

Security Protection Assets

Assets that provide security functions or capabilities to CUI Assets, even if they do not directly handle CUI themselves. Examples include identity providers, SIEMs, vulnerability scanners, and configuration management servers. Security Protection Assets are in scope and must meet the relevant control requirements that protect the CUI environment.

Contractor Risk Managed Assets

Assets that are physically or logically connected to the CUI environment but which the contractor has determined cannot reasonably store, process, or transmit CUI. They are documented in the SSP and the network diagram, but they are not assessed against every NIST SP 800-171 control. The assessor still verifies the boundary controls that prevent CUI from reaching them.

Specialized Assets

Government Furnished Equipment, Internet of Things devices, Operational Technology, restricted information systems, and test equipment. These are documented in the SSP and the network diagram and may have control implementation tailored to their nature. They are still part of the assessment scope and the evidence record.

Out-of-Scope Assets

Assets that are physically or logically isolated from the CUI environment with documented evidence of separation. They are not part of the assessment. The assessor reviews the isolation evidence to confirm the scoping decision rather than assessing the assets themselves.

The fastest way to inflate a CMMC programme's cost is to scope too broadly: pulling every workstation, file share, and SaaS account into the CUI environment when only a subset actually handles CUI. The fastest way to fail a C3PAO assessment is to scope too narrowly and miss CUI flows that the assessor finds during the on-site review. The boundary diagram, the data flow inventory, and the asset classification have to be defensible against both risks at once.

Level 2: NIST SP 800-171 Rev. 2 and the 14 control families

Level 2 is the centre of gravity of the CMMC programme. The 110 controls are organised into 14 families that mirror the broader NIST SP 800-53 catalogue but are tailored for non-federal systems handling CUI. Every control has a one-line basic security requirement and a more detailed derived security requirement; both have to be evidenced for the assessment. The NIST SP 800-171 framework page covers the requirement families, the DoD Assessment Methodology scoring, and the SPRS submission workflow that underpin every CMMC Level 2 assessment.

3.1 Access Control: account management, least privilege, separation of duties, remote access, and wireless access controls
3.2 Awareness and Training: security awareness training, role-based training, and insider threat training requirements
3.3 Audit and Accountability: audit event logging, audit record content, audit review, audit storage capacity, and protection of audit information
3.4 Configuration Management: baseline configuration, change control, security impact analysis, access restrictions for change, and least functionality
3.5 Identification and Authentication: identifier and authenticator management, multi-factor authentication, replay-resistant authentication, and password complexity
3.6 Incident Response: incident handling, incident reporting, incident response testing, and incident response plan maintenance
3.7 Maintenance: controlled maintenance, maintenance tools, non-local maintenance, and maintenance personnel authorisation
3.8 Media Protection: media access, media marking, media storage, media transport, media sanitisation, and removable media use
3.9 Personnel Security: personnel screening, personnel termination, and personnel transfer procedures for CUI access
3.10 Physical Protection: physical access authorisations, monitoring of physical access, visitor control, and alternate work site safeguards
3.11 Risk Assessment: vulnerability scanning, risk assessment, and risk response with documented periodicity
3.12 Security Assessment: security assessment, plan of action, system security plan, and continuous monitoring activities
3.13 System and Communications Protection: boundary protection, separation of system functions, denial of service protection, network disconnect, and cryptographic key management
3.14 System and Information Integrity: flaw remediation, malicious code protection, system monitoring, security alert handling, and information input validation

For the day-to-day vulnerability scanning required under family 3.11, the vulnerability assessment workflow keeps scan output, severity, and evidence linked per asset. For the SI family flaw remediation work, the remediation tracking workflow keeps owners, deadlines, and verified close evidence linked to the original finding.

Level 3: NIST SP 800-172 enhancements

Level 3 layers 24 selected NIST SP 800-172 enhanced security requirements on top of the full Level 2 baseline. The SP 800-172 enhancements are written for adversaries with advanced capabilities and persistence, and they assume the contractor is operating against a credible threat model rather than against generic compliance text. Themes include penetration-resistant architecture, damage-limiting operations, designed-in security, and cyber resiliency. Level 3 assessments are run by the DIBCAC and a single Level 3 finding can scope the contractor out of a programme, which makes the evidence discipline at Level 3 materially heavier than at Level 2.

DFARS clauses: how CMMC ends up in your contract

CMMC reaches contractors through DFARS clauses, not directly through the CMMC rule. Understanding the four clauses below is the difference between treating CMMC as an operational programme and treating it as a paperwork exercise.

DFARS 252.204-7012

The Safeguarding Covered Defense Information and Cyber Incident Reporting clause. Requires contractors handling Covered Defense Information (a category that includes CUI) to implement NIST SP 800-171 Rev. 2 and to report cyber incidents to the DoD within 72 hours. This clause is the original NIST SP 800-171 trigger and remains in effect alongside the CMMC clauses.

DFARS 252.204-7019

The Notice of NIST SP 800-171 DoD Assessment Requirements clause. Requires offerors to have a current DoD Assessment Methodology score posted in the Supplier Performance Risk System (SPRS) before contract award when a 7012 clause applies.

DFARS 252.204-7020

The NIST SP 800-171 DoD Assessment Requirements clause. Requires contractors to provide DoD access to facilities, systems, and personnel for higher level DoD assessments and to flow the requirement down to subcontractors handling CDI.

DFARS 252.204-7021

The Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirement clause. The clause that operationalises CMMC inside DoD contracts: identifies the required level, the assessment cadence, and the affirmation requirement, and applies the requirement to the contractor and to in-scope subcontractors.

The flowdown matters. A Level 2 prime with a Level 1 subcontractor is in scope at Level 2 for the prime portion of the work and has to ensure the subcontractor meets at least the contract-required level for any CUI or FCI passed down. The contract clauses, the asset inventory, and the data flow diagrams have to evidence the boundary at every supplier hop.

The DoD Assessment Methodology, SPRS scoring, and the POA&M window

The DoD Assessment Methodology is the scoring rubric that turns NIST SP 800-171 control implementation into a single number posted to the Supplier Performance Risk System (SPRS). It is the artefact most often cited in pre-award reviews and the artefact most often misunderstood. The mechanics are deliberate.

Starting score is 110 points (one per NIST SP 800-171 Rev. 2 security requirement) when every control is fully implemented
Each unimplemented or partially implemented control deducts 1, 3, or 5 points depending on the control weight in the methodology
The score is posted to SPRS by the contractor as a self-assessment for Level 2 contracts that permit it, and validated by a C3PAO at higher confidence levels
A 1-point deduction (the lightest weight) is generally eligible for POA&M coverage; 3-point and 5-point controls typically must be fully implemented at assessment time
POA&M items must close within 180 days of the assessment under CMMC 2.0; failure to close in window can invalidate the certification
False or inflated SPRS scores carry False Claims Act exposure; the score record is the legal artefact, not just the operational one

For severity calibration on findings discovered during scanning or assessment, the severity calibration research covers how to defend a CVSS-derived severity against an assessor or auditor. The vulnerability prioritisation framework covers how to triage what reaches the POA&M against what can be closed before the assessment window opens.

Penetration testing and vulnerability scanning under CMMC

CMMC does not mandate an annual penetration test in the same prescriptive way that PCI DSS does for the cardholder data environment, but several controls assume regular pentest evidence in practice. Risk Assessment family controls (3.11.2 and 3.11.3) require periodic vulnerability scanning and remediation. System and Information Integrity controls require flaw remediation in a timely manner. Configuration Management controls require periodic validation of the secure baseline. A defensible Level 2 programme runs vulnerability scanning on a defined cadence, supplements scanning with internal or external penetration testing for high-value boundaries, and retains the evidence linked to the asset and the control.

For the operational pentest workflow that supports a CMMC programme, the penetration testing workflow keeps scope, sampled assets, findings, and the retest evidence linked to the engagement record. For the wider scanning programme, the authenticated versus unauthenticated scanning guide covers when each mode is the right evidence for which control family.

Cloud, FedRAMP equivalence, and shared responsibility under CMMC

Cloud services that store, process, or transmit CUI in a CMMC environment have to meet FedRAMP equivalence under DFARS 252.204-7012, typically FedRAMP Moderate baseline or above. The shared responsibility split has to be documented in a Customer Responsibility Matrix (CRM) so the contractor knows which controls the cloud service provider satisfies, which the contractor satisfies, and which are shared. The CRM is part of the CMMC evidence pack; a missing or stale CRM is one of the most common findings during C3PAO assessments.

Evidence the C3PAO assessor (and the senior official) actually want

CMMC programmes that fail review usually fail because the evidence is scattered across drives, ticketing systems, and screenshots in personal folders. Build the evidence pack as the work happens, retain raw artefacts alongside the structured record, and tie every artefact back to the control, the asset, and the senior official affirmation. The C3PAO report reads the way the underlying evidence record reads.

System Security Plan (SSP) describing the assessment boundary, system architecture, data flows, and per-control implementation against NIST SP 800-171 Rev. 2
Asset inventory with each asset classified as CUI Asset, Security Protection Asset, Contractor Risk Managed Asset, Specialized Asset, or Out-of-Scope Asset
Network diagram showing the assessment boundary, CUI flows, segmentation devices, and the isolation evidence for any Out-of-Scope Assets
Configuration baselines, change control records, and authorised configuration deviations per CM family control
Access control records: user provisioning, privileged account inventory, multi-factor authentication evidence, and periodic access reviews
Vulnerability scan output retained per scan window, with authenticated scans against in-scope assets and remediation evidence per finding
Penetration test reports for in-scope external and internal services where required by contract or by the contractor risk decision
Incident response plan, tabletop exercise records, and any actual incident handling evidence
Continuous monitoring records: monthly scan summaries, audit log reviews, and configuration change reports
POA&M with affected control, weakness, owner, milestones, evidence, target completion date, and the SPRS submission record

Common CMMC pitfalls and how to avoid them

Scoping by org chart instead of by data flow. CMMC scope follows where CUI lives, not which department owns the asset. Map the data flow first, then the assets, then the boundary.
Missing the SPRS affirmation deadline. The senior official affirmation is the legal artefact, not the assessment report itself. Track the submission date and renewal cadence as a programme milestone, not an admin task.
Treating MFA as a checkbox. NIST SP 800-171 3.5.3 requires multi-factor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. SMS-based MFA does not meet the replay-resistant requirement at higher levels.
Cloud services without FedRAMP equivalence. Productivity, file-sharing, and email tools used to handle CUI must meet FedRAMP Moderate equivalence under 7012. Confirm authorisation status before relying on any SaaS in the CUI workflow.
POA&M items past the 180-day window. CMMC 2.0 tightened the POA&M window. Items still open after 180 days can invalidate the certification. Track the closeout date as a contractual deadline.
Subcontractor flowdown gaps. Primes are responsible for the flowdown of CMMC requirements to subcontractors handling FCI or CUI. A missing subcontractor affirmation can fail the prime's assessment.

Where SecPortal fits in the CMMC workflow

SecPortal is the operating layer for the CMMC programme: the workspace where scoping decisions, control implementation evidence, vulnerability scan output, findings, POA&M items, and the closure pack live as a structured workflow rather than as a long folder of screenshots and Word documents. SecPortal does not replace a C3PAO, it does not issue certifications, and it does not submit to SPRS on the contractor's behalf. It makes the underlying programme reproducible and auditable so the assessment is a refresh of an existing record rather than a rebuild.

Engagement management dedicated to the CMMC programme, with phases (scoping, control implementation, internal validation, C3PAO assessment, POA&M closure) tracked as workstreams rather than as one PDF
Findings management with CVSS 3.1 scoring, MITRE ATT&CK tagging, 300+ templates, and Nessus and Burp Suite imports so existing scanner output can flow directly into the workflow
Compliance tracking that maps every finding and control implementation to the NIST SP 800-171 Rev. 2 control family alongside FedRAMP, NIST SP 800-53 Rev. 5, ISO 27001, and SOC 2 for environments carrying multiple authorisations
External scanning across 16 modules covering CVE correlation, exposed services, weak TLS, and outdated software for boundary and SC family evidence
Authenticated scanning behind login or with stored credentials for CM, IA, and SI family evidence on web applications and APIs inside the assessment boundary
Continuous monitoring with scheduled scans and trend tracking aligned to the contractor risk-managed cadence and the DoD Assessment Methodology
AI report generation that turns control results, findings, and remediation actions into an assessor-ready narrative with executive summary, technical detail, and remediation roadmap for the C3PAO and the senior official

For consultancies and MSSPs delivering CMMC readiness or assessment preparation work to multiple DoD contractors, the security consultants workspace and the MSSP workspace bundle the platform with branded client portals and AI-generated readiness reports so each contractor engagement runs as a structured client workspace rather than a shared Google Drive. For internal CMMC programme owners, the internal security teams workspace carries the same workflow without the multi-client overhead. For pentest firms whose practice is specifically concentrated on federal and defense industrial base clients, the SecPortal for government penetration testing firms page covers the FedRAMP, CMMC, NIST 800-171, and NIST 800-53 aligned operating model end-to-end.

For continuity between formal assessments, the continuous monitoring capability and attack surface management capability produce the cadence and coverage record that triennial CMMC programmes are expected to keep between certifications. For the broader compliance landscape that often runs alongside CMMC at the same group level, the NIST SP 800-53 framework page, FedRAMP framework page, and ISO 27001 framework page cover the surrounding regimes a CUI-handling organisation typically maintains.

Key control areas

SecPortal helps you track and manage compliance across these domains.

Scoping: FCI, CUI, and the assessment boundary

CMMC scope is defined by the data classification handled and the assets that store, process, or transmit it. Identify which contracts trigger DFARS 252.204-7012 CUI handling, classify in-scope assets (CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, Out-of-Scope Assets), and document the assessment boundary diagram. Scope errors are the single most common cause of failed assessments and reauthorisation cycles.

Level 1: 17 FAR 52.204-21 safeguarding requirements

Level 1 applies to contractors handling Federal Contract Information only. The 17 basic safeguarding requirements come from FAR 52.204-21 and require an annual self-assessment with senior official affirmation in the Supplier Performance Risk System (SPRS). No third-party certification is required, but the assessment record and the affirmation are auditable by the DoD.

Level 2: 110 NIST SP 800-171 Rev. 2 controls

Level 2 applies to contractors handling Controlled Unclassified Information. The 110 controls are drawn from NIST SP 800-171 Rev. 2 across 14 families (Access Control, Audit and Accountability, Awareness and Training, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, System and Information Integrity). Most Level 2 contractors require a triennial C3PAO assessment; a subset is permitted to self-assess based on contract clauses.

Level 3: 110 NIST SP 800-171 controls plus 24 NIST SP 800-172 enhancements

Level 3 applies to contractors handling CUI associated with the most critical national security programmes. The baseline is the full Level 2 control set plus 24 selected NIST SP 800-172 enhanced security requirements. Level 3 is assessed by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) on a triennial cadence and is the highest CMMC tier under the 2.0 model.

System Security Plan (SSP) and supporting documentation

NIST SP 800-171 requires a System Security Plan describing the assessment boundary, system architecture, data flows, and per-control implementation. Track the SSP alongside supporting documents: incident response plan, configuration management plan, contingency plan, access control policy, media protection procedures, and the asset inventory. Keep these linked to the assessment record so the next reassessment is a refresh rather than a rebuild.

POA&M, scoring, and the SPRS submission

The DoD Assessment Methodology assigns a starting score of 110 with point deductions per unimplemented control (1, 3, or 5 points each). A POA&M is permitted for selected controls (typically those scored at 1 point) with a 180-day closeout window under CMMC 2.0. Track every POA&M item with affected control, weakness, owner, milestones, evidence, and the SPRS submission date so the score and the closeout trail are auditable.

Related features

Compliance tracking without a full GRC platform

Vulnerability management software that tracks every finding

Orchestrate every security engagement from start to finish

AI-powered reports in seconds, not days

Test web apps behind the login

Vulnerability scanning tools that map your attack surface

Monitor continuously catch regressions early

Run a defensible CMMC programme without spreadsheet sprawl

Track scoping, control implementation, evidence, vulnerability scans, POA&M items, and SPRS submissions in one workflow. Start free.