CMMC Level 2. 110 controls. 14 families. One certificate.
Level 2 is the bar required of every DoD contractor or subcontractor that handles Controlled Unclassified Information. It maps one-for-one to NIST SP 800-171 Rev. 2 and is assessed by an accredited C3PAO. There is no in-between status, no provisional posture, no “working toward it.” You are certified, or you are not.
Five artifacts that must exist before audit day.
Nothing about Level 2 is improvisational. The assessor will ask for these five artifacts within the first hour of the engagement. If any of them is unwritten, the engagement effectively halts.
- 01System Security Plan (SSP)
A written description of every system in the CUI boundary and how each of the 110 controls is implemented, by whom, with what tooling, and against what evidence.
- 02Plan of Action & Milestones (POA&M)
A dated, owned, closure plan for any control not fully implemented at the time of the score submission. CMMC 2.0 permits a POA&M for a defined subset; high-value controls cannot appear on it.
- 03SPRS Score (DoD)
A submitted score in the Supplier Performance Risk System computed against the 110 controls. The current threshold is 88 of 110, with a 180-day POA&M closure obligation.
- 04Authorization Boundary Diagram
A signed diagram of the CUI boundary: the systems, data flows, identities, and connections in scope. Out-of-scope exclusions must be justified to NIST 800-171A determination statements.
- 05Evidence Library
Per-control artifacts (configurations, screenshots, signed policies, training records) indexed by family and control number. This is the packet the assessor will read.
Each unmet control subtracts.
SPRS begins every contractor at 110 and subtracts a weight for each control not fully implemented. Weights run 1, 3, or 5 based on the assessed risk impact. The arithmetic floor is −203, the ceiling is +110, and the CMMC 2.0 minimum required for award eligibility is currently 88 with a closure plan.
A contractor who claims a score of 110 without a defensible evidence packet behind it is volunteering for a False Claims Act exposure. The DOJ’s Civil Cyber-Fraud Initiative has already produced multi-million-dollar settlements over inflated scores. The score must be earned, in writing, against artifacts.
- 110 starting score, deductions for each unmet control
- Weights of 1, 3, 5 based on assessment objective impact
- Minimum 88 with POA&M permitted on lower-weight controls
- 180-day POA&M closure obligation
- Annual affirmation by a senior company official
- Controls met
- 103 / 110
- POA&M (allowed)
- 7 of 7
- Confidence
- Audit-ready
- Submitted
- To DoD SPRS
You have 14 families to defend.
Three are usually failing.
This is the heatmap we produce in week two. Every cell is a defensible posture, not an opinion. Hover or tap a family to read the typical failure pattern.
Hover a family to read its typical failure pattern across DoD contractors we’ve assessed.
A POA&M is a scalpel, not a parachute.
CMMC 2.0 permits a Plan of Action and Milestones at certification — but only against a constrained list of controls and only inside a fixed 180-day closure window. Used surgically, a POA&M lets us deliver a certificate fast and then close the residue. Used broadly, it is a way to get your certificate revoked.
Lower-weight controls (weight 1) where the absence of implementation does not undermine the core protection objective. Examples include certain training documentation gaps.
High-impact controls (weight 5). Examples include FIPS-validated cryptography, multifactor authentication for privileged users, and incident reporting to DoD.
180 days from certification. Failure to close results in suspension of certification. We track closure inside the Annual Retainer.
The clauses are already live.
- 2016
DFARS 252.204-7012 finalized — CUI safeguarding and 72-hour incident reporting required of all DoD contractors.
- 2020
DFARS 7019, 7020, 7021 issued via Interim Rule — SPRS scoring, DoD assessment rights, and CMMC certification clauses.
- 2021
CMMC 2.0 announced — collapsed to three levels, NIST 800-171 alignment confirmed, POA&M permitted for limited controls.
- 2024
32 CFR Part 170 published (Oct 15, 2024) — formal CMMC program rule, effective December 16, 2024.
- 2025+
48 CFR rule phase-in via DFARS — contracting officers begin inserting CMMC certification requirements directly into solicitations.
- Today
Subcontractor flow-down is occurring. Primes are requiring evidence of SPRS scores from suppliers as a condition of teaming agreements.