CMMC Level 2 Requirements

Level 2 applies when you handle Controlled Unclassified Information. It carries 110 requirements across fourteen families, taken directly from NIST SP 800-171 Revision 2, and it is the level almost every serious defense supplier ends up at.

The number people quote is 110. The number that decides whether you pass is 320 — the assessment objectives in NIST SP 800-171A, against which each requirement is actually tested. A requirement counts as implemented only when every objective beneath it is satisfied, and that gap is where most self-assessments turn out to be optimistic.

What triggers Level 2

Not your size, your industry or your revenue. The trigger is DFARS 252.204-7012 in a contract, which means the government expects you to receive or generate covered defense information. In practice that usually arrives as a drawing, a specification or a technical data package carrying a distribution statement.

If you are unsure whether you are at Level 1 or Level 2, the test is contractual and takes an afternoon — see does CMMC apply to my company and FCI vs CUI.

The fourteen families and what they cost

Each requirement carries a weight of five, three or one point under the DoD Assessment Methodology, with one exception worth nothing. The weights total 313, which is why the SPRS scale runs from 110 down to -203.

The distribution is uneven and that is useful. Four families — Access Control, System and Communications Protection, Configuration Management, and System and Information Integrity — carry 160 of the 313 points at risk. More than half your exposure sits in four of fourteen families, which is the single most useful fact for sequencing remediation.

The full per-family table, with control counts, ID ranges and the named five-point requirements, is on the control families page.

Scoring and conditional status

You start at 110 and subtract the weight of everything not implemented. A perfect score is 110; the floor is -203.

Conditional Level 2 requires at least 88 — eighty percent of 110 — with the remaining gaps on a POA&M and a 180-day clock to close them. Below 88 the conditional route is not available and the gap has to be closed first.

A negative score on a first honest assessment is normal rather than alarming. With 313 points of available deduction against a starting 110, any environment not deliberately built to this standard begins underwater. See how the score is built.

What you cannot defer

Under 32 CFR 170.21 the general rule is that only one-point requirements may sit on a POA&M, with 3.13.11 the sole exception under its partial-credit condition. Six requirements can never be deferred regardless of weight:

3.1.20 · 3.1.22 · 3.12.4 · 3.10.3 · 3.10.4 · 3.10.5

3.12.4 deserves particular attention. It is the System Security Plan, it is the only unscored requirement in the standard, and its absence means an assessment cannot be completed at all — so you get no valid score rather than a low one. See the SSP template.

What Level 2 requires that Level 1 does not

Seven whole families appear only at Level 2: Audit and Accountability, Configuration Management, Incident Response, Maintenance, Risk Assessment, Security Assessment and Personnel Security. Level 1 has none of them.

Beyond the count, three operational differences matter. Level 2 requires a System Security Plan where Level 1 does not. It requires a score posted to SPRS under DFARS 252.204-7019 and 7020, where Level 1 requires an annual affirmation. And it is assessed against evidence rather than attestation — each of the 320 objectives expects an artefact. Level 1 asks you to say you do it; Level 2 asks you to show it.

Where Level 2 stands after the suspension

Third-party certification is paused. The Department of War suspended Phase 2 on 13 July 2026 and Class Deviation 2026-O0025 Revision 3 made that binding on 3 September, directing contracting officers to remove third-party assessment requirements from contracts.

Everything above still applies. The 110 requirements, the self-assessment, the SPRS score and the liability for its accuracy are untouched. What disappeared was the verification layer — which arguably raises rather than lowers the standard of care, because your own attestation is now the whole control. See program status.

For the sequence a Level 2 obligation follows on paper — scope, self-assess, post, affirm, and, when the pause lifts, certify — see the certification process. For what a third-party assessment actually involves when one is required of you, see C3PAO assessments. The CMMC Level 2 assessment guide explains how each of the 320 objectives is tested.

To find out how far you are from all 110, start with a CMMC gap assessment or a full CMMC readiness assessment. For budgeting, see how much CMMC certification costs.

A small number of programs go further. Their requirements sit at CMMC Level 3, which adds 24 NIST SP 800-172 requirements on top of these 110.