DoD Pause 2026: What U.S. Contractors Must Do About CMMC Level 2

CMMC Level 2 requires full implementation of all 110 security requirements in NIST SP 800-171 Revision 2, verified through either a self-assessment or a third-party certification assessment when your contract demands it. That obligation has not changed. What has changed is the assessment landscape: the DoD’s 2026 pause on Phase II third-party (C3PAO) certifications means your underlying compliance duty under DFARS 252.204-7012 still stands. Your job right now is to keep your System Security Plan, POA&M, and SPRS score accurate and current.

---

TL;DR:

• Organizations must maintain accurate System Security Plans, POA&Ms, and SPRS scores, as the 2026 pause on third-party audits does not relax compliance requirements.
• CMMC Level 2 enforces all 110 controls from NIST SP 800-171 Revision 2, with most audit findings stemming from access control, authentication, and system integrity families.
• Scope should focus on systems that process or store CUI, with precise asset inventories and network diagrams essential to reduce assessment effort and avoid common out-of-scope mistakes.
• Self-assessments and annual affirmations are mandatory, with documentation of evidence like configuration exports, logs, and policies critical for passing assessments.
• Preparers should prioritize identifying CUI pathways, strengthening identity controls, and documenting operational procedures before technical remediation to ensure smooth certification.

---

Table of Contents

• What Does CMMC Level 2 Require?
• What Are the Two CMMC Level 2 Assessment Types?
• How Do You Scope a CMMC Level 2 Assessment?
• SPRS Scoring, Annual Affirmation, and POA&M Deadlines
• What Evidence Do Assessors Expect for CMMC Level 2?
• Common Gaps and Where to Prioritize Remediation
• Step-by-Step: How to Prepare for CMMC Level 2
• The 17 CMMC Level 2 Practices Explained
• Level 1 vs. Level 2: How Much Harder Is the Step-Up?
• How Consultants Actually Deliver Level 2 Readiness
• How Tatemweb Helps Florida Contractors Reach Level 2 Readiness
• Primary Sources to Bookmark for CMMC Level 2
• Sources
• FAQ

What Does CMMC Level 2 Require?

CMMC Level 2 is not a separate, standalone rulebook. It’s a direct, one-to-one adoption of the 110 security requirements already published in NIST SP 800-171 Revision 2. If you’ve spent the last several years implementing NIST 800-171 to satisfy DFARS 252.204-7012, you’ve already been building toward Level 2. The certification framework simply formalizes how that implementation gets verified and reported.

Those 110 requirements break into 14 control families, and understanding the shape of each family matters more than memorizing every individual control. A few families carry a disproportionate share of the audit findings we see:

• Access Control (AC): Governs who can reach Controlled Unclassified Information (CUI) and under what conditions, including least-privilege enforcement and session controls.
• Identification and Authentication (IA): Covers multifactor authentication, credential management, and unique user identification.
• System and Information Integrity (SI): Addresses malware protection, flaw remediation, and system monitoring for unauthorized activity.
• Media Protection (MP): Dictates how CUI is stored, transported, and sanitized on removable media and retired hardware.
• Configuration Management (CM): Requires documented baseline configurations and change control for systems that touch CUI.
• Incident Response (IR): Establishes detection, reporting, and recovery procedures for security events.
• Audit and Accountability (AU): Requires logging sufficient to reconstruct events and detect unauthorized access.

None of these controls exist in a vacuum. Assessors need to see them documented, and that documentation has a name: the System Security Plan (SSP). Your SSP is the master narrative of your environment. It describes every system that touches CUI, how each of the 110 controls is implemented (or not, with a corresponding POA&M entry), and who owns each piece.

Beneath the SSP sits a layer of supporting policies and procedures. Assessors don’t just want to read that you enforce multifactor authentication. They want a written access control policy, a procedure describing how MFA gets provisioned and revoked, and evidence artifacts (screenshots, configuration exports, ticketing records) proving the control operates in practice. This three-layer structure — policy, procedure, evidence — is what assessors are trained to look for using NIST SP 800-171A, the companion document that defines specific assessment objectives for each of the 110 requirements.

Here’s the part organizations underestimate: NIST SP 800-171A breaks nearly every control into multiple discrete assessment objectives. Control 3.1.1 (limiting system access to authorized users) alone splits into several sub-objectives an assessor checks independently. That granularity is why a “we’re mostly compliant” self-assessment often collapses once someone applies the actual assessment methodology line by line.

What Are the Two CMMC Level 2 Assessment Types?

CMMC Level 2 uses two distinct assessment paths, and which one applies to you usually comes down to what your contract says, not what you’d prefer.

1. Level 2 Self-Assessment (OSA). The Organization Seeking Assessment (OSA) evaluates its own environment against all 110 controls, then enters a score into the Supplier Performance Risk System (SPRS). This path applies to contracts where the government has determined third-party verification isn’t required, typically for information with a lower risk profile. Annual affirmation by a senior company official is mandatory regardless of score.
2. Level 2 Certification Assessment (OSC). When a contract specifically requires third-party certification, the Organization Seeking Certification (OSC) engages a Certified Third-Party Assessment Organization (C3PAO) to conduct a formal audit. The C3PAO evaluates evidence against the same 110 controls but produces a certification decision rather than a self-reported score.
3. Scoring outcomes differ by pathway. A perfect implementation yields a maximum score of 110 in SPRS. Organizations with documented gaps can still achieve a Conditional status if deficiencies are captured in a POA&M and meet minimum scoring thresholds set by the 2023 Federal Register rule. A Final status requires either full implementation or POA&M closure within the allowed window.
4. Results flow through defined systems. For certification assessments, C3PAO findings route through DoD’s eMASS platform before summary results land in SPRS. Self-assessment results go directly into SPRS by the OSA.

The practical implication is straightforward: read your contract’s CMMC clause before assuming a self-assessment satisfies your obligation. A prime contractor flowing CUI to a subcontractor on a program requiring certification will typically pass that requirement down the supply chain. Guessing wrong here doesn’t just cost you a re-assessment. It can disqualify a bid.

How Do You Scope a CMMC Level 2 Assessment?

Scoping determines how much of your network actually falls under the microscope, and it’s often the single biggest lever for controlling assessment cost and effort. Get scoping wrong, and you either expose systems that didn’t need to be in scope or, worse, exclude something an assessor later flags as improperly out-of-scope.

The CMMC Scoping Guide for Level 2, tied to 32 CFR § 170.19, sorts every asset into one of five categories:

• CUI Assets: Systems that process, store, or transmit Controlled Unclassified Information directly. These get the full 110-control assessment.
• Security Protection Assets: Tools that provide security functions for the CUI environment, such as SIEM platforms, firewalls, and identity providers.
• Contractor Risk-Managed Assets: Systems that could potentially reach CUI but are managed under the organization’s risk-based security policy rather than full CMMC controls.
• Specialized Assets: Internet of Things devices, operational technology, government-furnished equipment, and test equipment, each with tailored handling rules.
• Out-of-Scope Assets: Systems with no logical or physical path to CUI, which are excluded entirely, provided that separation is documented and defensible.

Documenting scope means producing two things an assessor will ask for on day one: a complete asset inventory and a network diagram showing data flows and segmentation boundaries. Vague statements like “our CUI stays on the corporate network” don’t survive scrutiny. Assessors want to see the specific subnet, the specific VLAN, or the specific enclave where CUI lives, and they want the diagram to match what a technical scan of the environment reveals.

Segmentation is where most organizations find real relief. Grouping CUI-handling processes into a small number of well-defined enclaves, rather than letting CUI sprawl across every laptop and file share in the company, can shrink the assessed footprint dramatically. A firewall rule set that isolates a program office’s CUI workstations from the general corporate network, paired with a documented data flow diagram, is often enough to move the rest of the enterprise into contractor risk-managed or out-of-scope status.

The scoping mistakes that trip up organizations most often: claiming an asset is out-of-scope without a technical control (like a firewall rule or VLAN) actually enforcing that separation, forgetting that email and cloud storage integrations can silently pull CUI outside the intended enclave, and failing to update the network diagram after infrastructure changes.

SPRS Scoring, Annual Affirmation, and POA&M Deadlines

Every self-assessment ends the same way: a numeric score, entered into SPRS, tied to your organization’s Commercial and Government Entity (CAGE) code. That score isn’t a formality. It’s the figure contracting officers pull when evaluating bid eligibility, and it has to reflect your actual environment at the time of submission.

Annual affirmation is a separate, recurring obligation layered on top of the assessment itself. A senior company official, someone with the authority to speak for the organization, must affirm in SPRS every year that the reported controls remain accurate. Under the 2023 CMMC Federal Register rule, that affirmation is a formal certification, not a checkbox exercise.

POA&Ms give organizations a documented path to close gaps without failing outright, but the rules are specific:

• Certain high-value controls cannot be POA&M’d at all; they must be fully implemented before any score above the minimum threshold is achievable.
• Controls that can be deferred must be closed within a specified period after the initial assessment, as defined by the rules.
• A POA&M that expires without closure typically reverts the organization’s status, which can trigger contract performance issues.
• Annual affirmations require the SSP and POA&M to reflect the environment as it exists at affirmation time, not as it existed when the last full assessment happened.

Compliance risk callout: An inaccurate SPRS score or a false annual affirmation can create exposure under the False Claims Act, since the government treats these submissions as certifications made to secure federal contract dollars. That risk exists whether or not a third-party assessment ever occurs.

Treat your SPRS score the way you’d treat a signed contract representation, because legally, that’s close to what it is. Reviewing it before every proposal submission, not just once a year, is the safer habit.

What Evidence Do Assessors Expect for CMMC Level 2?

Assessors work from NIST SP 800-171A assessment objectives, and every objective breaks down to the same question: can you show, not just tell, that a control operates? Your SSP states the claim; your evidence proves it.

Start with the SSP itself. Each of the 110 controls needs a corresponding entry describing implementation status, the specific system or boundary it applies to, and a reference to supporting documentation. An SSP that says “MFA is enforced” without naming the identity provider, the enrollment process, or the systems covered will generate follow-up questions an assessor shouldn’t need to ask.

Technical controls carry the heaviest evidentiary weight because they’re the easiest to verify objectively:

• Multifactor authentication on all remote access and privileged accounts, demonstrated through identity provider configuration exports.
• Encryption for CUI at rest and in transit, shown through disk encryption status reports and TLS configuration checks.
• Endpoint protection with centralized management, evidenced by console dashboards showing coverage across all in-scope devices.
• Logging and SIEM correlation sufficient to reconstruct security events, shown through retained log samples and alert histories.
• Patch management cadence, demonstrated with vulnerability scan reports showing remediation timelines.
• Configuration baselines for servers and endpoints, verified against a documented hardening standard.

Operational evidence rounds out the picture and is where organizations most often fall short, not because the work wasn’t done, but because nobody kept a record of it. Training completion logs tied to specific employees and dates. Incident response tabletop exercise records showing the scenario, participants, and lessons captured. Change management logs tying configuration changes back to approval tickets. Vulnerability scan reports showing a consistent remediation cycle rather than a single scan run right before assessment week.

Pro Tip: Build your evidence folder structure to mirror the control families, not your org chart. Assessors work control by control, and an evidence set organized by department forces them to hunt across five folders to verify a single requirement, which slows the assessment and increases the odds they flag something as “insufficient” simply because they couldn’t locate it fast enough.

A well-organized artifact set typically groups evidence into three tiers per control: the policy document, the procedure document, and a folder of dated artifacts (screenshots, exports, logs) demonstrating the procedure in current use. Assessors move faster and form more favorable judgments when they can trace that chain without asking for a second document.

Common Gaps and Where to Prioritize Remediation

Every readiness engagement Tatemweb has walked through Florida contractors surfaces a familiar pattern of gaps, and the order in which you fix them matters as much as fixing them at all.

The recurring failure points, in roughly the order we encounter them: SSPs that describe an aspirational environment rather than the actual one, scope boundaries drawn without a technical control enforcing them, weak or missing multifactor authentication on legacy systems that “were going to be replaced eventually,” insufficient log retention to reconstruct a security event more than 30 days old, and POA&M entries that were opened, then never revisited.

A useful prioritization framework starts by identifying and locking down every pathway CUI travels through. You can’t protect what you haven’t mapped, and scope creep is the single fastest way to fail an assessment. From there:

• Shore up identity and access first. MFA and least-privilege enforcement touch the most controls per hour invested.
• Fix incident response and logging next, since these controls depend on identity data being accurate to be useful at all.
• Move to configuration management and patching last, because these tend to be ongoing operational disciplines rather than one-time fixes.

Pro Tip: Run an internal evidence walkthrough exactly the way a C3PAO would: pick five controls at random, ask someone outside your IT team to produce the evidence in under ten minutes each, and see what breaks. This exposes retrieval problems, not just implementation gaps, and retrieval problems are what actually sink assessments.

Time gets saved through repeatable tooling, not heroics. Evidence collection templates that map directly to the 110 controls, documented segmentation patterns you can replicate across new contract awards, and quarterly internal walkthroughs (rather than one panicked review before assessment week) consistently outperform last-minute scrambles. Organizations preparing for a first Level 2 assessment that build these habits early tend to move through certification with fewer surprises.

Step-by-Step: How to Prepare for CMMC Level 2

Readiness for CMMC Level 2 follows a logical sequence, and skipping steps almost always costs more time later than it saves now.

1. Define your assessment scope and build a CUI asset inventory. Identify every system, application, and data flow that touches Controlled Unclassified Information, then produce a network diagram showing where CUI lives and how it moves.
2. Draft or update your SSP, baseline policies, and initial POA&M entries. Every one of the 110 controls needs a documented implementation status, and any gap needs an entry describing the remediation plan and target date.
3. Implement and verify technical controls. Deploy multifactor authentication, encryption, and centralized logging, then run vulnerability scans to confirm the controls actually function as documented, not just as configured.
4. Conduct internal evidence walkthroughs and close POA&Ms where possible. Test whether your team can produce evidence quickly for a sample of controls, and resolve as many open POA&M items as you can before any external timeline forces your hand.
5. Submit your SPRS self-assessment score and affirm annually, or assemble your assessor package if certification is required. Confirm your CAGE code, enter the final score, and calendar the annual affirmation. If your contract requires third-party certification, package your SSP and evidence for C3PAO review once assessments resume in full.

Organizations that treat this as a sequential project, rather than a scramble to fill out one document, consistently produce cleaner SPRS scores and fewer POA&M surprises at affirmation time.

The 17 CMMC Level 2 Practices Explained

The “17 practices” framing that circulates in industry discussions is a holdover from CMMC’s earlier draft structure, and it can confuse contractors reading current guidance. Under the finalized rule, Level 2 does not carry a separate 17-practice list distinct from Level 1. Instead, Level 1 covers 15 basic safeguarding requirements drawn from FAR 52.204-21, and Level 2 absorbs and expands on those same practices as part of the full 110-control set in NIST SP 800-171 Rev 2.

In practice, this means every control a contractor implements for Level 1, basic access control, authentication, and media handling among them, carries forward and gets assessed with far greater rigor under Level 2’s expanded scope. A Level 1 practice like limiting system access to authorized users becomes, under Level 2, a control assessed against multiple discrete objectives in NIST SP 800-171A: user identification, session termination, and remote access authorization all get separately verified.

The practical takeaway: don’t search for a standalone “17 practices” checklist and assume it satisfies Level 2. The real baseline is the complete 110-requirement set, and any practice you implemented for Level 1 compliance is a starting point, not a finish line, once your CUI obligations trigger Level 2.

Level 1 vs. Level 2: How Much Harder Is the Step-Up?

The jump from Level 1 to Level 2 is substantial, and treating it as an incremental step tends to catch organizations off guard.

Level 1 covers 15 basic safeguarding requirements tied to Federal Contract Information (FCI), the kind of non-public information generated under a government contract that doesn’t rise to the sensitivity of CUI. It requires only annual self-assessment, no formal SSP, and no POA&M mechanism. Most small subcontractors handling only FCI can satisfy Level 1 with modest effort.

Level 2 applies whenever an organization handles Controlled Unclassified Information, and it multiplies the requirement count more than sevenfold, from 15 to 110. It demands a formal SSP, permits POA&Ms only within strict limits, requires annual affirmation by a senior official, and can require third-party certification depending on contract terms.

The real gap isn’t just control count. It’s documentation maturity. Level 1 asks whether a safeguard exists. Level 2 asks you to prove it, maintain it, and re-affirm it year after year under a legal certification. Contractors who assume Level 1 experience prepares them for Level 2 usually discover the documentation burden alone, SSP, policies, procedures, evidence, dwarfs anything Level 1 required.

How Consultants Actually Deliver Level 2 Readiness

Every readiness conversation starts the same way: a contractor asks whether they’re “close” to compliant, and the honest answer almost always depends on documentation, not technical controls. Most organizations have implemented more of the 110 requirements than they realize. What’s missing is the paper trail proving it, and the scoping clarity to know which systems even need to be assessed.

A typical readiness engagement runs in phases over several months rather than weeks: scoping and asset inventory first, gap analysis against the 110 controls second, SSP and policy drafting third, and technical remediation running in parallel throughout. Deliverables should include a defensible scope diagram, a complete SSP, a prioritized POA&M, and an evidence package organized by control family.

The lowest-cost, highest-impact first step is almost never a new tool purchase. It’s an honest internal scope exercise, mapping exactly where CUI lives, before spending a dollar on remediation. Contractors who skip this and jump straight to buying security software often end up protecting the wrong systems while the actual CUI pathway stays exposed. If you’re evaluating outside help, understanding how to choose a CMMC consultant before signing an engagement saves both time and budget.

— Matt

How Tatemweb Helps Florida Contractors Reach Level 2 Readiness

Getting to Level 2 readiness without outside help usually means piecing together guidance from federal documents, forum threads, and expensive national consulting firms that don’t know your business or your local contracting relationships. Tatemweb is the alternative: a Florida-based team that has spent over 26 years building technical and compliance solutions for small and mid-sized businesses, now applying that experience directly to CMMC Level 2 readiness for defense contractors and subcontractors across the state.

Our readiness engagements cover the work contractors find hardest to do alone: SSP drafting, scope definition and network diagramming, gap remediation planning, evidence packaging organized by control family, and staff training that produces the kind of documented completion records assessors expect to see. Because Tatemweb already builds and secures websites, ecommerce platforms, and business systems for South Florida companies, we bring hands-on technical context to controls like MFA enforcement, logging, and endpoint protection, not just policy templates. If your organization handles CUI and needs a clear path to an accurate SPRS score, explore our CMMC compliance consulting services or call 772-224-8118 to schedule a readiness consultation.

Primary Sources to Bookmark for CMMC Level 2

Keep these documents close throughout your readiness effort. 32 CFR § 170.14 defines the legal mapping between Level 2 and NIST SP 800-171. The 2023 Federal Register rule governs assessment procedures and POA&M limits. DFARS 252.204-7012 is the enforcement backbone that predates and outlasts any program pause. The Level 2 Assessment Guide and Scoping Guide translate all of it into the practical checklists assessors actually use.

Sources

• 32 CFR § 170.14 — Cybersecurity Maturity Model Certification: Level definitions
• Cybersecurity Maturity Model Certification (CMMC) program — Federal Register (2023 rule)
• CMMC Assessment Guide – Level 2 | Version 2.13 (DoD CIO)

FAQ

What Is the Difference Between CMMC Level 1 and Level 2?

Level 1 covers 15 basic safeguards for Federal Contract Information with annual self-assessment only, while Level 2 requires all 110 NIST SP 800-171 controls, a formal SSP, and possibly third-party certification for organizations handling Controlled Unclassified Information.

Does the 2026 CMMC Pause Mean I Can Stop Preparing?

No. The DoD paused Phase II third-party (C3PAO) assessments in 2026, but the underlying NIST SP 800-171 obligations under DFARS 252.204-7012 remain fully enforceable.

How Often Do I Need to Reaffirm My CMMC Level 2 Status?

Self-assessment results must be entered into SPRS, and a senior company official must submit an annual affirmation confirming the score still reflects the environment, with a full reassessment required at least every three years.

Can I Use a POA&M to Pass a CMMC Level 2 Assessment?

Certain controls allow a Plan of Action and Milestones for deficiencies, but they must be closed within a specified period after the initial assessment, and some high-priority controls cannot be deferred through a POA&M at all.

Who Can Help My Business Prepare for CMMC Level 2?

A qualified consultant familiar with NIST SP 800-171 and CMMC scoping rules can accelerate readiness; Tatemweb offers CMMC Level 2 compliance consulting for Florida-based contractors and subcontractors.

Recommended

• CMMC for Small Business: What to Do Right Now
• What a CMMC Level 2 Assessment Requires and How to Prepare
• How to Choose a CMMC Consultant for Your Business
• Cybersecurity Compliance for SMBs: 2026 Guide