Introduction#
CMMC 2.0 is the Department of Defense's framework for ensuring contractors adequately protect Controlled Unclassified Information (CUI).
Level 2 certification will be required for most defense contractors handling CUI. This guide walks through all 110 practices and provides practical implementation guidance.
CMMC 2.0 Structure#
CMMC 2.0 simplified the model to three levels, each with clear requirements and assessment mechanisms.
Assessment Requirements
Level 1: Foundational
17 practices for FCI protection. Self-assessment permitted. Required for contracts with Federal Contract Information only.
Level 2: Advanced
110 practices aligned with NIST SP 800-171. Third-party assessment required. Required for CUI handling.
Level 3: Expert
110+ practices including subset of NIST SP 800-172. Government-led assessment. Required for highest-priority programs.
Scoping Your CUI Environment#
Proper scoping dramatically reduces compliance burden. Smaller scope means fewer systems to protect and assess.
Identify CUI Sources
Review contracts for CUI markings and DFARS clauses. Not all government data is CUI—only information marked as such or meeting CUI registry categories.
Map Data Flows
Document where CUI enters, is processed, is stored, and exits your organization. Include all systems, applications, and storage locations.
Define Boundaries
Create clear boundaries around CUI-handling systems. Consider enclave strategies to minimize scope by isolating CUI into dedicated environments.
Document Scope
Create a formal scope document for assessor review. Include network diagrams, data flow diagrams, and asset inventories.
Practice Families Overview#
The 110 Level 2 practices are organized into 14 families aligned with NIST SP 800-171. Each family addresses a specific security domain.
Implementation Tip
Critical Practices#
These practices frequently cause assessment failures. Pay special attention to implementation and evidence.
System Security Plan#
The System Security Plan is your primary compliance artifact. It documents how you implement each of the 110 practices.
Use DoD Template
Start with the NIST SP 800-171A assessment template or CMMC assessment guide. Assessors expect familiar formats.
Be Specific
Describe exactly how you implement each practice in your environment. Generic statements like "we use MFA" are insufficient—specify what systems, which users, and what methods.
Link to Evidence
Reference specific evidence artifacts for each practice. This makes assessment walkthroughs efficient and demonstrates thoroughness.
Track POA&Ms
Document Plan of Action & Milestones for any incomplete implementations. Assessors may accept POA&Ms for partial credit if remediation timelines are reasonable.
Assessment Preparation#
Prepare thoroughly before engaging a C3PAO. Assessment readiness directly impacts assessment duration and success.
Common Failure Point
Next Steps#
CMMC compliance requires sustained effort. Start your journey now to be ready when requirements take effect.
Gap Assessment
Evaluate your current state against all 110 practices. Use our gap assessment template to identify remediation priorities.
Scope Definition
Define your CUI boundary. Consider enclave strategies to minimize scope and reduce compliance burden.
SSP Development
Begin documenting your System Security Plan. This is a living document that evolves as you implement controls.
Get Expert Help