A detailed guide to achieving CMMC 2.0 Level 2 compliance for defense contractors and subcontractors handling Controlled Unclassified Information (CUI). This CMMC compliance guide maps all 110 NIST SP 800-171 Rev 2 controls across 14 families, provides C3PAO assessment preparation guidance, and includes gap analysis templates to help you pass your certification assessment.
The Cybersecurity Maturity Model Certification (CMMC) 2.0 program, administered by the Department of Defense (DoD), requires contractors and subcontractors to demonstrate cybersecurity practices proportional to the sensitivity of the information they handle. The CMMC final rule (32 CFR Part 170) became effective on December 16, 2024.
Starting in 2025, CMMC requirements are being phased into DoD contracts. Contractors who cannot demonstrate the required CMMC level will be ineligible for contract award. For the roughly 80,000+ companies in the Defense Industrial Base (DIB) that handle CUI, Level 2 certification is the target -- and it requires compliance with all 110 security controls in NIST SP 800-171 Rev 2.
This guide walks through every control family, explains what assessors look for, and provides a realistic timeline and budget framework.
- CMMC 2.0 Level Overview
- The 14 Control Families
- Control Family Deep Dives
- Assessment Preparation
- Gap Analysis Template
- Timeline and Budget Framework
- Common Pitfalls
- Key Acronyms
| Level | Description | Controls | Assessment Type | Who Needs It |
|---|---|---|---|---|
| Level 1 | Foundational | 15 practices (FAR 52.204-21) | Self-assessment (annual) | Contractors handling FCI only |
| Level 2 | Advanced | 110 practices (NIST SP 800-171 Rev 2) | C3PAO assessment (triennial) OR self-assessment | Contractors handling CUI |
| Level 3 | Expert | 110 + selected NIST SP 800-172 controls | Government-led assessment (DIBCAC) | Contractors handling CUI for highest-priority programs |
- FCI (Federal Contract Information): Information provided by or generated for the Government under contract, not intended for public release
- CUI (Controlled Unclassified Information): Information that requires safeguarding per law, regulation, or Government policy (marked as CUI)
- C3PAO (CMMC Third-Party Assessment Organization): Authorized organizations that conduct Level 2 assessments
- SPRS (Supplier Performance Risk System): Where self-assessment scores are submitted
- POA&M (Plan of Action and Milestones): Documented plan to remediate identified gaps (limited allowance under CMMC 2.0)
CMMC 2.0 allows limited use of POA&Ms, but with strict constraints:
- A maximum of 80% of objectives must be MET at the time of assessment
- POA&M items must be closed within 180 days of the conditional certification
- Certain controls cannot be on a POA&M (e.g., FIPS-validated encryption, MFA for privileged accounts)
- Failure to close POA&Ms within 180 days results in loss of certification
| # | Family | ID | Controls | Key Focus |
|---|---|---|---|---|
| 1 | Access Control | AC | 22 | Account management, least privilege, remote access, wireless |
| 2 | Awareness and Training | AT | 3 | Security awareness, role-based training |
| 3 | Audit and Accountability | AU | 9 | Audit logging, log review, log protection |
| 4 | Configuration Management | CM | 9 | Baselines, change control, least functionality |
| 5 | Identification and Authentication | IA | 11 | MFA, password management, authenticator management |
| 6 | Incident Response | IR | 3 | IRP, incident handling, reporting |
| 7 | Maintenance | MA | 6 | Controlled maintenance, remote maintenance |
| 8 | Media Protection | MP | 9 | Media access, marking, storage, transport, sanitization |
| 9 | Personnel Security | PS | 2 | Screening, personnel actions |
| 10 | Physical Protection | PE | 6 | Physical access, visitor control, monitoring |
| 11 | Risk Assessment | RA | 3 | Risk assessments, vulnerability scanning |
| 12 | Security Assessment | CA | 4 | Assessments, POA&Ms, system connections |
| 13 | System and Communications Protection | SC | 16 | Boundary protection, encryption, FIPS validation |
| 14 | System and Information Integrity | SI | 7 | Flaw remediation, malware protection, monitoring |
| Total | 110 |
Access Control is the largest family and often where assessors find the most gaps.
| Control | Requirement | What Assessors Look For |
|---|---|---|
| AC.L2-3.1.1 | Limit system access to authorized users | User account provisioning/deprovisioning procedures, access request forms |
| AC.L2-3.1.2 | Limit system access to authorized transactions and functions | Role-based access control (RBAC), least privilege implementation |
| AC.L2-3.1.3 | Control CUI flow per authorizations | Data flow diagrams showing CUI boundaries, DLP policies |
| AC.L2-3.1.4 | Separate duties to reduce risk | Duty separation matrix, no single person controls an entire process |
| AC.L2-3.1.5 | Employ least privilege | Admin accounts separate from daily use, privilege reviews |
| AC.L2-3.1.6 | Use non-privileged accounts for non-security functions | Admins use standard accounts for email, browsing |
| AC.L2-3.1.7 | Prevent non-privileged users from executing privileged functions | UAC enabled, sudo logging, no local admin for standard users |
| AC.L2-3.1.8 | Limit unsuccessful logon attempts | Account lockout policy (e.g., 3-5 attempts) |
| AC.L2-3.1.9 | Privacy and security notices | Login banners on all systems |
| AC.L2-3.1.10 | Session lock after inactivity | Screen lock after 15 minutes (or less) |
| AC.L2-3.1.11 | Terminate sessions after defined conditions | Auto-logoff after period of inactivity |
| AC.L2-3.1.12 | Monitor and control remote access | VPN with MFA, remote access policy, session logging |
| AC.L2-3.1.13 | Employ cryptographic mechanisms for remote access | VPN using FIPS-validated encryption |
| AC.L2-3.1.14 | Route remote access via managed access control points | All remote access through VPN concentrator, no direct RDP |
| AC.L2-3.1.15 | Authorize remote execution of privileged commands | Documented process for remote admin, PAM tool |
| AC.L2-3.1.16 | Authorize wireless access | Wireless access policy, WPA3/WPA2-Enterprise |
| AC.L2-3.1.17 | Protect wireless access using authentication and encryption | 802.1X, EAP-TLS, FIPS-validated encryption |
| AC.L2-3.1.18 | Control connection of mobile devices | MDM/MAM enrollment, mobile device policy |
| AC.L2-3.1.19 | Encrypt CUI on mobile devices | Full device encryption, remote wipe capability |
| AC.L2-3.1.20 | Verify and control connections to external systems | Documented external connections, firewall rules |
| AC.L2-3.1.21 | Limit use of portable storage devices | USB policy, endpoint DLP, device control |
| AC.L2-3.1.22 | Control CUI posted to publicly accessible systems | Review process before public posting, no CUI on public sites |
| Control | Requirement | What Assessors Look For |
|---|---|---|
| AT.L2-3.2.1 | Security awareness training | Annual training for all users, completion records |
| AT.L2-3.2.2 | Role-based training for privileged users | Additional training for admins, incident responders |
| AT.L2-3.2.3 | Insider threat awareness | Training covering indicators, reporting procedures |
| Control | Requirement | What Assessors Look For |
|---|---|---|
| AU.L2-3.3.1 | Create and retain audit logs | SIEM or centralized logging, defined retention period |
| AU.L2-3.3.2 | Ensure individual accountability | Unique user IDs, no shared accounts for CUI systems |
| AU.L2-3.3.3 | Review and update audited events | Defined list of auditable events, periodic review |
| AU.L2-3.3.4 | Alert on audit process failure | Monitoring for log collection failures |
| AU.L2-3.3.5 | Correlate audit information | SIEM correlation rules, dashboards |
| AU.L2-3.3.6 | Provide audit reduction and report generation | Log analysis tools, reporting capability |
| AU.L2-3.3.7 | System clocks synchronized | NTP configuration, time sync policy |
| AU.L2-3.3.8 | Protect audit information | Log integrity controls, restricted access to logs |
| AU.L2-3.3.9 | Limit management of audit functionality | Only admins can modify audit configs |
Detailed control mappings for all 14 families are available in the control-families/ directory.
Use this checklist in the 6-12 months before your C3PAO assessment.
- System Security Plan (SSP) -- Describes your CUI environment, boundaries, and how each control is implemented
- POA&M -- Lists known gaps with remediation timelines (max 20% of objectives)
- Network diagram -- Shows CUI data flow, system boundaries, and security controls
- Data flow diagram -- Maps how CUI enters, moves through, and leaves your environment
- Hardware/software inventory -- All assets in the CUI scope boundary
- Policies and procedures -- Written policy for each control family (minimum)
- Incident response plan -- Tested within the last 12 months
- Configuration baselines -- Documented standards for OS, applications, network devices
- Risk assessment -- Conducted within the last 12 months
- FIPS 140-2/140-3 validated encryption -- For CUI at rest AND in transit (this is non-negotiable and cannot be on a POA&M)
- Multi-factor authentication -- For all remote access AND all privileged accounts
- SIEM / centralized logging -- With defined retention (90+ days recommended)
- Endpoint detection and response (EDR) -- On all endpoints in CUI scope
- Vulnerability scanning -- Automated, at least monthly
- Patch management -- Defined process with SLAs (critical: 14 days, high: 30 days)
- Backup and recovery -- Tested, encrypted, access-controlled
- DNS filtering / web proxy -- Block known malicious domains
- Email security -- SPF, DKIM, DMARC, anti-phishing
- Security awareness training completed by all personnel (with records)
- Role-based training for privileged users
- Background checks for personnel with CUI access
- Incident response tabletop exercise conducted
- Physical security controls in place (badge access, visitor logs, cameras)
The #1 factor that determines assessment complexity and cost is your CUI boundary scope.
Minimize your CUI boundary:
- Identify where CUI lives -- Map every system, application, and storage location
- Consolidate -- Move CUI into as few systems as possible
- Segment -- Network segmentation isolates CUI systems from general IT
- Enclave approach -- Create a dedicated CUI enclave (separate VLAN, dedicated workstations)
- Cloud option -- Use a FedRAMP Moderate (or equivalent) cloud environment to offload controls
Boundary components that are always in scope:
- Systems that process, store, or transmit CUI
- Security protection assets (firewalls, SIEM, AD, MFA, EDR)
- Systems that provide security services to CUI assets
- Network segments connecting CUI assets
Use this template to assess your current state against each control.
| Control ID | Requirement Summary | Status | Evidence | Gap Description | Remediation Plan | Priority | Owner | Target Date |
|---|---|---|---|---|---|---|---|---|
| AC.L2-3.1.1 | Limit system access | MET / NOT MET / PARTIAL | High/Med/Low | |||||
| AC.L2-3.1.2 | Authorized functions | MET / NOT MET / PARTIAL | ||||||
| ... | ... | ... | ... | ... | ... | ... | ... | ... |
A complete spreadsheet-ready gap analysis template is available in templates/gap-analysis-template.md.
NIST SP 800-171A defines assessment objectives for each control. Your score is based on the SPRS methodology:
- Start at 110 points (perfect score)
- Each NOT MET control deducts 1, 3, or 5 points depending on severity (defined in DoD Assessment Methodology)
- Minimum score for Level 2: You must achieve at least 88 points (80% of objectives MET) at the time of assessment, with a POA&M to close remaining gaps within 180 days
| Phase | Duration | Activities |
|---|---|---|
| 1. Scoping and Gap Analysis | 4-8 weeks | CUI identification, boundary definition, gap assessment |
| 2. Remediation Planning | 2-4 weeks | POA&M development, budget allocation, vendor selection |
| 3. Technical Remediation | 3-9 months | Implement controls, deploy tools, configure systems |
| 4. Documentation | 4-8 weeks (parallel) | SSP, policies, procedures, evidence collection |
| 5. Internal Assessment | 2-4 weeks | Mock assessment, final gap closure |
| 6. C3PAO Assessment | 1-2 weeks | On-site and remote assessment activities |
| Total | 6-14 months | Depends on current maturity and scope |
| Item | Small (< 50 users) | Medium (50-250 users) | Large (250+ users) |
|---|---|---|---|
| Gap analysis and consulting | $15,000 - $30,000 | $30,000 - $75,000 | $75,000 - $150,000 |
| Technical remediation (tools) | $20,000 - $50,000 | $50,000 - $150,000 | $150,000 - $500,000 |
| Documentation (SSP, policies) | $10,000 - $25,000 | $25,000 - $50,000 | $50,000 - $100,000 |
| C3PAO assessment fee | $25,000 - $50,000 | $50,000 - $100,000 | $100,000 - $200,000 |
| Ongoing compliance (annual) | $15,000 - $30,000 | $30,000 - $75,000 | $75,000 - $200,000 |
| Total first-year estimate | $85,000 - $185,000 | $185,000 - $450,000 | $450,000 - $1,150,000 |
These are rough estimates. Actual costs depend heavily on your current maturity, scope, and technology stack.
Many organizations discover mid-assessment that CUI exists on systems they excluded from scope. Map CUI flows thoroughly before starting remediation.
FIPS 140-2/140-3 validated encryption is mandatory for CUI at rest and in transit. "AES-256" is not the same as "FIPS-validated." You need to verify that your specific product version is on the NIST CMVP validated modules list. This control cannot be placed on a POA&M.
Every user must have a unique account. Shared accounts (admin@, helpdesk@, generic service accounts with shared passwords) will result in NOT MET findings across multiple control families.
Assessors expect centralized log collection from all in-scope systems with at least 90 days of retention. Endpoint logs alone are not enough. Invest in a SIEM or managed log aggregation early.
Having a document is not enough. Assessors want evidence of testing -- tabletop exercises, after-action reports, and plan updates based on findings.
You cannot put critical controls on a POA&M and expect to pass. Certain controls (FIPS encryption, MFA, audit logging) are considered too fundamental to defer.
Physical access controls, visitor logs, and equipment protection are assessed. Many IT-focused teams overlook the Physical Protection (PE) family.
FedRAMP authorized cloud services handle many infrastructure controls, but you are still responsible for configuration, access management, data protection, and all endpoint/user controls. Use the Shared Responsibility Matrix.
| Acronym | Meaning |
|---|---|
| C3PAO | CMMC Third-Party Assessment Organization |
| CDI | Covered Defense Information |
| CMMC | Cybersecurity Maturity Model Certification |
| CUI | Controlled Unclassified Information |
| DFARS | Defense Federal Acquisition Regulation Supplement |
| DIB | Defense Industrial Base |
| FCI | Federal Contract Information |
| FIPS | Federal Information Processing Standards |
| FedRAMP | Federal Risk and Authorization Management Program |
| MFA | Multi-Factor Authentication |
| NIST | National Institute of Standards and Technology |
| POA&M | Plan of Action and Milestones |
| RBAC | Role-Based Access Control |
| SIEM | Security Information and Event Management |
| SPRS | Supplier Performance Risk System |
| SSP | System Security Plan |
Created by Petronella Technology Group, a cybersecurity and managed IT services firm based in Raleigh, NC. Our entire team holds CMMC-RP (Registered Practitioner) certification, and we have guided dozens of defense contractors through CMMC readiness assessments and remediation programs.
CMMC-RP Certified | BBB A+ Since 2003 | 23+ Years of Cybersecurity Experience
Contact us: (919) 348-4912 | petronellatech.com/contact-us
- CMMC Compliance Guide
- Cybersecurity Services
- Virtual CISO
- Emergency IT Support
- Free Security Assessment
Need help implementing these controls? Petronella Technology Group provides comprehensive compliance consulting:
- CMMC Compliance Guide - Full CMMC Level 2 preparation
- NIST 800-171 Compliance - CUI protection and DFARS alignment
- Cybersecurity Services - Managed security and assessments
- AI-Powered Security - AI infrastructure with compliance built in
Petronella Technology Group is a CMMC-RP certified cybersecurity firm headquartered in Raleigh, NC. Our entire team holds CMMC Registered Practitioner credentials. Contact us or call (919) 348-4912.
MIT License -- see LICENSE for details.