Understand CMMC 2.0 Compliance Requirements

CMMC 2.0 is the Department of Defense’s cybersecurity certification framework for contractors and subcontractors that handle Federal Contract Information or Controlled Unclassified Information. It streamlines the earlier model into three levels. Level 1 addresses basic safeguards, while Level 2 is aligned with the 110 requirements in NIST SP 800-171 Rev. 2 and is the primary focus for organizations handling CUI.

NIST SP 800-171 provides security requirements for protecting CUI in nonfederal systems. CMMC 2.0 Level 2 uses those 110 requirements as its technical foundation but adds a certification and assessment framework tied to DoD contracting. In practical terms, NIST 800-171 guides control implementation, while CMMC establishes how applicable contractors demonstrate that implementation through required assessments and evidence.

CMMC 2.0 applies to DoD contractors and subcontractors when the applicable solicitation or contract includes a CMMC requirement. Organizations that process, store, or transmit CUI are commonly expected to pursue Level 2 readiness. Requirement timing and level depend on contract language, the information involved, and the DoD’s phased rollout, so teams should review each opportunity and flow-down requirement carefully.

CMMC 2.0 Level 2 is based on the 110 security requirements in NIST SP 800-171 Rev. 2, organized across 14 control families. These address areas such as access control, incident response, configuration management, media protection, risk assessment, system and communications protection, and personnel security. Organizations must implement applicable practices and maintain documentation and objective evidence supporting assessment.

Core Level 2 documentation generally includes a System Security Plan describing the system boundary and how requirements are implemented, plus Plans of Action and Milestones for any unresolved gaps where permitted. Teams also need objective evidence, such as policies, procedures, configurations, training records, logs, inventories, risk materials, and incident-response documentation. Evidence should be current, traceable, and consistent with actual operating practices.

Preparation time depends on your current NIST SP 800-171 maturity, CUI environment, system complexity, and documentation quality. Organizations with established controls may focus on gap closure and evidence organization, while others may need to define scope, implement technical safeguards, train personnel, and build governance processes. A structured gap assessment and prioritized remediation plan provide a realistic, defensible schedule.

Effective training gives technical, compliance, and program personnel a shared understanding of requirements and their responsibilities. It can help teams identify control gaps, develop SSP and POA&M content, collect evidence, and practice assessment-oriented discussions. QMS Learning adds role-specific online instruction, an AI Workbench for artifact development, and dashboard visibility so managers can monitor progress and retain evidence across the organization.

No. Training prepares your organization to implement requirements and organize assessment evidence, but it does not replace an assessment performed by an authorized C3PAO when a third-party Level 2 assessment is required. Training is most valuable before assessment because it helps personnel understand the controls, practice applying them, address gaps, and maintain the documentation assessors will evaluate.