CMMC Level 2 Quick Guide for Business Leaders

CMMC (Cybersecurity Maturity Model Certification) Level 2 is the DoD’s standard most commonly used when a contractor must protect CUI (Controlled Unclassified Information) in its own unclassified systems. Level 2 aligns to the NIST SP 800-171 Revision 2 baseline (110 requirements) and focuses on demonstrating those practices are consistently operating within the environment that touches CUI.

CMMC Level 2 uses NIST SP 800-171 Rev. 2 as the “requirements baseline,” but CMMC adds a formal verification model and expectations around how results are assessed, recorded, and sustained over time. The practical business difference is that it’s not enough to “implement controls”—you need to be able to show they’re operating consistently inside the defined scope.

CUI is unclassified information that still requires safeguarding and controlled sharing. It isn’t classified, but it also isn’t public. If CUI is involved in your contract work, it typically drives higher cybersecurity expectations for the systems and people that handle it.

A useful starting question is whether your organization receives, creates, stores, processes, or transmits information labeled or treated as CUI to perform contract work. If the answer is “yes” or “maybe,” treat scope as a business decision: identify where CUI shows up in real workflows (email, file shares, tickets, cloud folders) and define the boundary of systems and users that touch it. That boundary becomes “in scope” for Level 2 readiness.

Scope is the set of assets and workflows that touch CUI and therefore must meet Level 2 expectations. That includes systems and accounts that store/process/transmit CUI, the people who access it, and the supporting services that enable access, storage, and security. If vendors or cloud services are involved in handling CUI or operating in-scope systems, they also affect your scope and your evidence responsibilities.

A self-assessment is performed by your organization and is used in situations where the contract allows it. A third-party assessment is performed by an authorized C3PAO and is required when the contract calls for independent verification. Which one applies is driven by the solicitation/contract and flow-down requirements—so treat contract language as the deciding factor.

Tools help you implement controls, but assessment readiness depends on evidence that controls are operating consistently. Evidence usually includes policies (what you expect), procedures (how you do it), records (proof it happened), technical proof (system state like MFA/encryption), and operational proof (tickets, review notes, follow-up actions). The goal is to make evidence a normal byproduct of operations, not a last-minute scramble.

Assessment-ready means leadership can clearly explain the CUI scope, show that required practices operate consistently inside that scope, and produce evidence without disruption. In practice, this often includes a current System Security Plan (SSP) that matches reality, an evidence set that stays current, and a defined process for tracking and closing gaps when they exist.

Yes, you can outsource tasks, but accountability stays with the contractor. Providers can help operate controls and assemble evidence, but your organization remains responsible for meeting requirements and being able to demonstrate them. The most common failure mode is unclear division of responsibilities—so define “who does what” and “who proves what” early.

If a subcontractor or vendor touches your CUI or supports in-scope systems, they can introduce risk and evidence gaps unless expectations are clear. CMMC requirements commonly flow down in the supply chain when CUI is involved. The right approach is to align vendor/sub requirements to your contract needs and document oversight—then confirm specifics based on your flow-down language.

Unclear scope that expands over time, documentation that doesn’t match reality, inconsistent access governance (especially offboarding), routine security work without a reliable evidence trail, and vendor responsibilities that are assumed rather than documented. Most of these are leadership and process problems first—not “missing tool” problems.

Start by defining where CUI lives and selecting a scope strategy (contain CUI vs secure broadly). Then confirm what your contract and flow-down require at a high level (self vs third-party). From there, baseline your current state against the Level 2 expectations, build an evidence plan that matches how your business operates, and sequence remediation to avoid rework.