If your company handles Controlled Unclassified Information (CUI) for the Department of Defense, CMMC Level 2 is the cybersecurity bar you will be measured against. It decides whether you can bid, win, and keep defense contracts, and for many mid-sized contractors, it is also the single largest compliance investment they will make this decade.
Yet the path to certification is surrounded by moving parts: self-assessment versus third-party audit, conditional versus final status, and a program rollout that was recently paused. This guide cuts through that for executive decision-makers: what CMMC Level 2 requires, how assessment works, what has changed in 2026, and how to get certified without wasting budget.
What Is CMMC Level 2?
The Cybersecurity Maturity Model Certification (CMMC) program is the DoD’s mechanism for verifying that defense contractors actually protect sensitive information. It has three levels:
- Level 1: 15 basic safeguards for Federal Contract Information (FCI), assessed annually by self-assessment.
- Level 2: 110 requirements aligned to NIST SP 800-171 Rev. 2, for organizations that handle CUI.
- Level 3: 134 requirements, adding a selected set from NIST SP 800-172, for the highest-priority programs, assessed by the government (DIBCAC).
The rule of thumb is simple. If your contracts involve CUI, you need at least Level 2. If you only handle FCI, Level 1 applies.
Where Things Stand in 2026
This is where many online guides are out of date. In July 2026, the Department of War suspended the Phase 2 rollout of CMMC, which would have made third-party (C3PAO) Level 2 certification mandatory in new contracts. During the suspension, contracting officers may require only Level 1 (Self) or Level 2 (Self). Level 2 (C3PAO) and Level 3 requirements cannot be imposed in new solicitations while the program is under review.
Three points matter for planning:
- The program is paused, not canceled. The requirements, the DFARS clauses, and the annual affirmation remain in force.
- DFARS 252.204-7012 and NIST SP 800-171 obligations still apply. Your SPRS score and your duty to safeguard CUI remain unchanged.
- The timing could shift again. The suspension has been extended and reviewed more than once, so confirm the current status with the DoD CIO CMMC site or your contracting officer before making schedule or budget commitments.
The practical conclusion: do not treat the pause as a reprieve. Treat it as preparation time.
The CMMC Level 2 Assessment Process
There are two assessment paths at Level 2, and your contract determines which applies.
Level 2 (Self): You assess yourself against all 110 requirements, enter your results and affirmation in SPRS, and repeat every three years with an annual affirmation in between. This is the path available during the suspension.
Level 2 (C3PAO): A Certified Third-Party Assessment Organization, staffed by Certified CMMC Assessors, conducts an independent assessment. This is the path intended for contracts involving higher-priority CUI. Assessment is currently suspended for new solicitation requirements, but it remains the model the program is designed around.
Both paths follow the same underlying logic, and your readiness work is identical.
How scoring and conditional status work
- The maximum score is 110.
- To earn Conditional Level 2 status, you need a score of at least 88 (80%), and no high-risk requirements can be deferred. Certain high-impact controls, such as multifactor authentication and encryption, generally cannot be placed on a Plan of Action and Milestones (POA&M).
- Remaining gaps must be closed and verified within 180 days, or the conditional status expires.
- The final status is valid for three years, subject to a senior official’s annual affirmation of continued compliance.
False affirmations carry real risk. Inaccurate scores and attestations have already been the basis of False Claims Act settlements, which is why leadership, not just IT, should own this process.
How to Get CMMC Level 2 Certified: A Seven-Step Roadmap
- Confirm your requirement. Identify what CUI you handle and what level and assessment type your contracts specify.
- Define scope. Map where CUI is stored, processed, and transmitted. Reduce scope wherever the business allows.
- Run a gap assessment. Score your current state against all 110 requirements and 320 objectives, and be honest about it.
- Build the SSP and POA&M. Document how each requirement is met, and track every gap with an owner and a date.
- Remediate. Close gaps, prioritizing the high-weight controls that cannot be deferred. Depending on the findings, this typically takes several months.
- Test with a mock assessment. Simulate the real thing before the real thing. Late-stage surprises are the most expensive ones.
- Complete the assessment and affirm. Submit your self-assessment or engage a C3PAO, close any POA&Ms within 180 days, and file your annual affirmation.
Where Certification Budgets Go Wrong
- Scoping too broadly. Every additional system in scope is another system to secure, document, and assess.
- Treating NIST SP 800-171 and CMMC as separate projects. At Level 2 they share the same 110 controls, so a single program should satisfy both.
- Starting remediation late. The 180-day POA&M clock leaves little room for slippage, and assessor availability tightens when deadlines return.
- Documentation without implementation. Assessors test whether controls actually operate, not just whether a policy exists.
- Neglecting maintenance. Certification is a three-year cycle with annual affirmation, not a one-time event.
How iQuasar Cyber Helps You Get Certified Efficiently
iQuasar Cyber is a Virginia-based cybersecurity consulting firm whose consultants bring deep experience in CMMC, NIST, and related regulatory frameworks, including HIPAA, PCI, and NYDFS. Our CMMC 2.0 services are designed around the full journey described above: assessing your current controls, developing policies and procedures aligned with industry best practices, remediating deficiencies, and preparing you for either a self-assessment or an external C3PAO assessment.
Our model is built for contractors who want senior expertise without a large-firm price tag. We take ownership of the compliance documentation, including your System Security Plan, so your leadership team can focus on winning and delivering work rather than on paperwork. And because we map Level 2 work directly to NIST SP 800-171, you build one program that remains valid regardless of which assessment path the DoD ultimately requires.
If you handle CUI and want a clear view of your readiness, your score, and the shortest credible path to certification, contact iQuasar Cyber to start with a gap assessment.