CMMC Level 2 Preparation Playbook

The 12-Month Readiness Roadmap for Defense Contractors Handling CUI

By Leonard Esere, Founder — AeoliTech

April 2026

Abstract

The Cybersecurity Maturity Model Certification (CMMC) Level 2 certification is now a contractual reality for every defense contractor that processes, stores, or transmits Controlled Unclassified Information (CUI). With the 32 CFR Part 170 final rule effective December 16, 2024, and the DFARS acquisition rule taking effect November 10, 2025, the four-phased rollout places C3PAO-mandatory assessments at the center of contract eligibility beginning November 2026. For most organizations in the Defense Industrial Base (DIB), that deadline is not a horizon — it is already uncomfortably close.

This playbook provides a structured, phase-by-phase roadmap that walks prime contractors and subcontractors through every stage of CMMC Level 2 preparation: from scoping and gap analysis through System Security Plan (SSP) development, SPRS score submission, C3PAO selection, and the formal assessment itself. The guidance maps directly to the 110 security requirements in NIST SP 800-171 Rev 2 — the governing standard under CMMC Level 2 — and references the phased compliance timeline codified in 32 CFR Part 170. Whether your organization is starting from scratch or closing the final gaps before an assessment, this document will tell you exactly what to do, in what order, and how much time to allocate. Timelines are based on industry patterns observed across dozens of DIB engagements; cost ranges reflect documented market rates for GRC tooling, remediation labor, and C3PAO assessment fees.

Table of Contents

1. Why CMMC Level 2 Cannot Wait

2. The Regulatory Framework: 32 CFR Part 170 and the Phased Rollout

3. What CMMC Level 2 Actually Requires

4. The 12-Month Readiness Roadmap

5. SPRS Score: What It Is and Why It Matters Before the Assessment

6. Selecting a C3PAO: What to Look For

7. What Assessors Actually Check

8. Budget Ranges and Resource Planning

9. Compressed Timelines: The 6–8 Month Accelerated Path

10. Common Failure Modes and How to Avoid Them

11. About the Author

12. References

1. Why CMMC Level 2 Cannot Wait

Every DIB contractor that touches CUI under a DoD contract has been technically obligated to comply with NIST SP 800-171 since December 31, 2017, under DFARS 252.204-7012. What changed with 32 CFR Part 170 is verification. Self-attestation alone is no longer sufficient for CUI contracts after November 2026. An accredited third-party assessment organization — a C3PAO — must validate your controls, and their findings go directly into the Enterprise Mission Assurance Support Service (eMASS) and are reflected in your SPRS record.

The stakes are straightforward: no valid CMMC Level 2 (C3PAO) status, no contract award on applicable solicitations after Phase 2. Organizations that have been deferring compliance work on the assumption that enforcement would be further delayed should understand that the November 10, 2025 Phase 1 activation and the November 2026 Phase 2 C3PAO mandate are tied to the already-effective DFARS acquisition rule.

The DIB math is stark. DoD estimates approximately 8,350 medium and large entities will be required to meet Level 2 C3PAO requirements. The number of authorized C3PAOs is constrained by the Cyber AB's rigorous authorization process. Scheduling queues for C3PAO assessments are already extending 8–12 weeks from initial engagement to assessment start. Organizations that delay until mid-2026 will find assessment slots scarce.

2. The Regulatory Framework: 32 CFR Part 170 and the Phased Rollout

The CMMC Program rule (32 CFR Part 170) was published in the Federal Register on October 15, 2024, and became effective December 16, 2024. It establishes the structure of the three-level CMMC program, defines assessment types and requirements, and codifies the roles of organizations seeking certification (OSC), C3PAOs, and the Cyber AB as the accrediting body. The parallel DFARS acquisition rule took effect November 10, 2025, embedding CMMC requirements into contract solicitations.

Phased Implementation Timeline

| Phase | Start Date | Key Requirement |

|-------|-----------|-----------------|

| Phase 1 | November 10, 2025 | CMMC Level 1 and Level 2 self-assessments appear as conditions for applicable new contracts and solicitations |

| Phase 2 | November 10, 2026 | C3PAO certification required for Level 2 on applicable new contracts; DoD retains discretion to require C3PAO earlier |

| Phase 3 | November 10, 2027 | C3PAO required for contract option exercises; Level 3 (DIBCAC) requirements introduced |

| Phase 4 | November 10, 2028 | Full CMMC implementation across all applicable contracts and option periods |

A critical nuance in Phase 1: DoD retains discretion under § 170.3(e) to require Level 2 C3PAO certification even during Phase 1 for high-priority programs. Contractors bidding on classified or sensitive programs should not assume self-assessment is sufficient.

Conditional CMMC Status and POA&Ms

The final rule allows contractors to hold a conditional CMMC Level 2 (C3PAO) status for up to 180 days while closing out an approved Plan of Action and Milestones (POA&M). To be eligible for conditional status, the SPRS score at time of assessment must be at least 88 (out of 110), and outstanding POA&M items may only apply to controls weighted at 1 point in the DoD's scoring methodology — not to the high-value 3- or 5-point controls. This is a narrow window, not a backdoor to certification.

3. What CMMC Level 2 Actually Requires

CMMC Level 2 maps one-to-one to the 110 security requirements in NIST SP 800-171 Revision 2, organized across 14 control families. No additional requirements, no subtractions. This is important: NIST published SP 800-171 Revision 3 in May 2024, which reduced the total control count to 97 while adding three new control families and expanding assessment objectives. However, DoD issued Class Deviation 2024-O0013 mandating that contractors continue to comply with Revision 2 for DFARS and CMMC purposes. All current C3PAO assessments evaluate against the 110 Rev 2 requirements.

NIST SP 800-171 Rev 2 — Control Family Summary

| Control Family | Controls | Representative Requirements |

|---|---|---|

| Access Control (AC) | 22 | Least privilege, remote access, mobile device management |

| Awareness & Training (AT) | 3 | Security awareness training, insider threat awareness |

| Audit & Accountability (AU) | 9 | Log generation, review, protection, retention |

| Configuration Management (CM) | 9 | Baseline configurations, change control, least functionality |

| Identification & Authentication (IA) | 11 | MFA, password management, identifier management |

| Incident Response (IR) | 3 | IR plan, testing, reporting to DoD |

| Maintenance (MA) | 6 | Controlled maintenance, sanitization of maintenance equipment |

| Media Protection (MP) | 9 | CUI media marking, transport, sanitization |

| Personnel Security (PS) | 2 | Screening, termination procedures |

| Physical Protection (PE) | 6 | Physical access controls, visitor management |

| Risk Assessment (RA) | 3 | Risk assessments, vulnerability scanning |

| Security Assessment (CA) | 4 | SSP, POA&M, system assessment, monitoring |

| System & Comms Protection (SC) | 16 | Network segmentation, encryption in transit, boundary protection |

| System & Info Integrity (SI) | 7 | Malware protection, security alerts, patching |

| Total | 110 | |

The 110 requirements expand to 320 assessment objectives in NIST SP 800-171A Rev 2 — the companion assessment methodology guide. These objectives are what C3PAO assessors actually evaluate. A control can have multiple objectives, each of which must be individually satisfied for a MET finding.

Assessment Types at Level 2

• Level 2 Self-Assessment: Permitted during Phase 1 (through November 2026) for certain contracts. The affirming official — a senior company executive — attests under penalty of law to the accuracy of the self-assessment score entered in SPRS.
• Level 2 Certification Assessment (C3PAO): Required beginning Phase 2 for applicable contracts. Conducted by an authorized C3PAO. Results are uploaded to eMASS and reflected in SPRS with a CMMC Unique Identifier (UID). Valid for three years, with annual affirmations required.

4. The 12-Month Readiness Roadmap

The timeline below is calibrated for organizations starting from an unvalidated or partially implemented posture. Organizations with mature GRC programs may compress Phase 1 significantly. Those starting from minimal implementation should plan for 15–18 months.

Phase 1: Scoping and Discovery (Months 1–3)

The foundation of any successful CMMC preparation is an accurate understanding of where CUI lives in your environment. Every control you implement should be justified by the CUI that flows through a documented system.

Month 1 — CUI Inventory and Boundary Definition

• Identify all contracts that contain DFARS 252.204-7012 or 252.204-7021 clauses; these signal CUI.
• Map CUI data types to NARA CUI Registry categories (e.g., Controlled Technical Information under the Defense group).
• Document every location where CUI is created, received, stored, processed, or transmitted: endpoints, servers, cloud storage, email, collaboration platforms, removable media.
• Identify all personnel with access to CUI systems.

Month 2 — Data Flow Mapping and Boundary Decision

• Produce a network diagram showing CUI data flows, including ingress/egress points, third-party connections, and cloud service providers.
• Make the enclave vs. whole-organization scoping decision. An enclave (isolated CUI environment) typically reduces assessment scope and cost but requires real network segmentation — not just policy.
• Identify External Service Providers (ESPs) and Cloud Service Providers (CSPs) in scope. CSPs must be FedRAMP Moderate authorized or equivalent.

Month 3 — Gap Analysis

• Conduct a formal gap assessment against all 110 NIST SP 800-171 Rev 2 requirements and all 320 assessment objectives in 800-171A.
• Calculate a preliminary SPRS score.
• Build a prioritized remediation backlog organized by control family and weighted point value. Address 5-point and 3-point deficiencies first.
• Produce the initial SSP and POA&M structure.

Deliverables at End of Phase 1: CUI inventory, network/data flow diagrams, scoping boundary decision, gap analysis report, preliminary SPRS score, initial SSP outline, prioritized POA&M.

Phase 2: Remediation and Documentation (Months 4–8)

With gaps documented, the majority of preparation time is consumed by technical remediation, policy development, and SSP documentation. These activities run in parallel.

Technical Remediation Priorities (Months 4–7)

| Priority | Control Family | Common Gaps |

|---|---|---|

| Critical | IA (Identification & Authentication) | MFA deployment across all CUI system access points |

| Critical | SC (System & Comms Protection) | Network segmentation, encryption-in-transit, FIPS-validated modules |

| High | AU (Audit & Accountability) | SIEM deployment, log retention (minimum 90 days online) |

| High | CM (Configuration Management) | Hardened baselines, software inventory, change management process |

| Medium | RA (Risk Assessment) | Documented risk assessment process, vulnerability scanning cadence |

| Medium | IR (Incident Response) | IR plan documentation, tabletop exercise, DoD reporting procedures |

| Medium | CA (Security Assessment) | SSP completion, security assessment process, continuous monitoring |

Documentation Development (Months 4–8)

• Complete the System Security Plan (SSP) with implementation narratives for all 110 controls and 320 assessment objectives.
• Develop or update all referenced policies (access control policy, IR plan, configuration management plan, media protection policy, etc.).
• Establish an evidence library: screenshots, configuration exports, training records, audit logs, vendor agreements, network diagrams.
• Update POA&M to reflect remediated items and realistic closure dates for remaining gaps.

Month 8 — Internal Mock Assessment

• Conduct a full internal dry-run against the CMMC Assessment Guide Level 2 (DoD CIO, Version 2.13 or current) using NIST 800-171A assessment objectives as the evaluation criteria.
• For each of the 320 objectives, document: MET, NOT MET, or NOT APPLICABLE with supporting evidence references.
• Identify residual gaps and close or document in POA&M.

Deliverables at End of Phase 2: Complete SSP, updated POA&M, evidence vault organized by control family, completed SPRS self-assessment score, tabletop exercise record, mock assessment report.

Phase 3: Assessment Preparation and Execution (Months 9–12)

Month 9 — SPRS Score Submission

• Calculate your official self-assessment score per the DoD Assessment Methodology.
• Submit to SPRS via the Procurement Integrated Enterprise Environment (PIEE). Include SSP name, version, date, and CAGE code(s).
• The affirming official submits the annual affirmation. This is a legal attestation.

Month 10 — C3PAO Engagement

• Select and contract with an authorized C3PAO from the Cyber AB Marketplace (cyberab.org/marketplace).
• Submit pre-assessment documentation: SSP, POA&M, network diagrams, system inventory, CUI boundary documentation.
• Receive and respond to the C3PAO's pre-assessment questionnaire.

Months 11–12 — Assessment Execution and Closeout

• Participate in the formal Level 2 certification assessment: document review, personnel interviews, and technical validation.
• Address any NOT MET findings. If POA&M-eligible (score ≥ 88, only 1-point items), receive Conditional Level 2 (C3PAO) status.
• Close all POA&M items within the 180-day conditional window.
• C3PAO uploads results to eMASS; SPRS reflects Final Level 2 (C3PAO) status with CMMC UID.

Deliverables at End of Phase 3: SPRS score posted, C3PAO assessment completed, CMMC UID issued, Final Level 2 (C3PAO) status in SPRS.

5. SPRS Score: What It Is and Why It Matters Before the Assessment

The Supplier Performance Risk System (SPRS) is DoD's authoritative database for contractor cybersecurity posture. Your NIST SP 800-171 self-assessment score must be posted in SPRS before contract award for any applicable contract.

The scoring methodology starts at a baseline of 110 (full compliance). For each unimplemented control, points are deducted based on impact:

• 5-point deductions: High-impact controls (e.g., MFA for privileged accounts, FIPS-validated encryption)
• 3-point deductions: Medium-impact controls
• 1-point deductions: Lower-impact controls

The theoretical minimum score is -203 (all controls unimplemented). The CMMC Level 2 conditional certification threshold is a SPRS score of at least 88 at the time of C3PAO assessment — meaning POA&M items can only account for a maximum of 22 points of remaining deficiencies, and none of those deficiencies may be in the 3- or 5-point tier.

SPRS Score Thresholds

| Score Range | Interpretation | Contract Eligibility |

|---|---|---|

| 110 | Full implementation | Maximum eligibility |

| 88–109 | Conditional Level 2 eligible (with qualifying POA&Ms) | Eligible with POA&M closeout commitment |

| 1–87 | Significant gaps | Restricted; unlikely for CUI contracts |

| -1 to -203 | Major implementation failures | Not eligible for CUI contracts |

An accurate SPRS score is a legal attestation. False claims about cybersecurity compliance have resulted in Department of Justice False Claims Act enforcement actions against DIB contractors.

6. Selecting a C3PAO: What to Look For

All authorized C3PAOs are listed on the Cyber AB Marketplace. Authorization requires: DIBCAC-conducted CMMC Level 2 assessment, ISO 17021 certification, FOCI review, minimum cyber insurance ($1M general liability, $1M errors and omissions, cybersecurity breach policy), and association with at least one Lead Certified CMMC Assessor (LCCA). Not all authorized C3PAOs have equal experience in your industry sector.

C3PAO Selection Criteria

| Criterion | What to Evaluate |

|---|---|

| Authorization status | Confirmed authorized on Cyber AB Marketplace; verify CAGE code and authorization date |

| Industry experience | Prior assessments in your sector (aerospace, manufacturing, IT services, R&D) |

| Technical depth | Assessor team's background in OT/ICS environments if applicable |

| Geographic reach | On-site capacity if your facilities require physical presence |

| Assessment timeline | Current scheduling queue; 8–12 weeks from engagement to assessment start is typical |

| Pre-assessment support | Whether they offer a readiness review before formal assessment |

| References | Speak to organizations they have assessed |

| Pricing | Formal assessment fees range $30K–$100K depending on scope and complexity |

Having worked across DoD programs at MITRE and LANL, I've seen the consequences of selecting a C3PAO solely on price. An assessor with deep experience in your technology stack will conduct a more efficient and accurate assessment. A generalist team may spend excessive time on areas that are clearly compliant, while missing nuanced gaps in specialized systems.

7. What Assessors Actually Check

The CMMC Level 2 Assessment Guide (DoD CIO, Version 2.13) is the assessors' playbook. It maps each of the 110 controls to specific assessment objectives and specifies the methods: examine (documentation), interview (personnel), and test (technical verification). Most controls require all three methods.

Evidence Assessment Methods

| Method | What Assessors Do | Example |

|---|---|---|

| Examine | Review documentation for existence, completeness, and accuracy | SSP, policies, configuration baselines, audit logs |

| Interview | Question personnel with roles related to the control | Ask the IR lead to walk through the incident response process |

| Test | Technical verification of implementation | Run a vulnerability scan, review MFA configuration, trace a CUI data flow |

Assessors do not "pass" organizations who have the right documentation but cannot demonstrate implementation. A policy that says "we perform quarterly vulnerability scans" must be corroborated by actual scan reports with timestamps. An MFA policy must be validated by testing that non-MFA login paths are disabled.

Most Frequently Failed Domains

Based on patterns across CMMC assessments, the most common NOT MET findings cluster in:

• IA.3.083: Multi-factor authentication for local and network access to privileged accounts
• SC.3.177: Employing FIPS-validated cryptography for CUI transmission
• AU.2.041: Ensuring audit records can be correlated and reviewed
• CM.2.061: Establishing and maintaining baseline configurations
• RA.3.097: Periodically scanning for vulnerabilities

8. Budget Ranges and Resource Planning

CMMC Level 2 preparation costs vary significantly based on starting posture, organization size, scope of the CUI environment, and the degree to which automation and managed services are employed.

Indicative Budget Ranges

| Category | Small Org (< 50 employees) | Mid-Size (50–500) | Large (500+) |

|---|---|---|---|

| Gap assessment / consulting | $15K–$30K | $25K–$75K | $50K–$150K |

| Technical remediation (labor) | $20K–$50K | $50K–$150K | $150K–$500K+ |

| GRC tooling (annual) | $5K–$15K | $15K–$40K | $30K–$100K+ |

| Policy and SSP documentation | $10K–$20K | $15K–$40K | $25K–$75K |

| C3PAO assessment fee | $30K–$50K | $40K–$75K | $60K–$100K |

| Total Range | $80K–$165K | $145K–$380K | $315K–$925K+ |

These are professional services and licensing costs, exclusive of internal labor. Organizations with existing ISO 27001 or SOC 2 programs will find meaningful overlap in documentation and control implementation, reducing the incremental cost.

9. Compressed Timelines: The 6–8 Month Accelerated Path

For organizations facing an immediate contract deadline, a 6–8 month compressed timeline is achievable with three enablers:

1. Pre-existing NIST 800-171 documentation. If an SSP and POA&M exist and are reasonably current, discovery compresses from 3 months to 4–6 weeks.

2. GRC automation tooling. Platforms that map controls to evidence, auto-generate SSP language, and provide continuous monitoring dashboards can compress documentation timelines by 40–60%.

3. Dedicated internal resources. A full-time compliance lead and engaged IT/security staff are non-negotiable. Organizations that try to run CMMC preparation with fractional attention from an already-loaded IT team consistently overrun their timelines.

Compressed Timeline Structure

| Weeks | Activity |

|---|---|

| 1–4 | CUI scoping, gap analysis, boundary definition |

| 5–10 | High-priority technical remediation (MFA, encryption, segmentation) |

| 8–16 | SSP completion, policy development, evidence collection |

| 12–20 | Mock assessment, SPRS submission, POA&M finalization |

| 18–28 | C3PAO engagement, formal assessment, closeout |

Even in a compressed scenario, scheduling a C3PAO 8–12 weeks before you need the assessment window is mandatory given current demand.

10. Common Failure Modes and How to Avoid Them

Scoping too broadly. Including systems that don't touch CUI in the assessment scope dramatically increases remediation cost and assessment time. Invest early in a defensible enclave boundary.

SSP as a policy document rather than an implementation record. An SSP that describes what your organization intends to do, rather than what it currently does, will generate NOT MET findings. Every control statement must describe the actual implemented configuration.

Treating POA&M items as "free passes." POA&Ms require a realistic remediation timeline and must be closed within 180 days of conditional certification. Assessors and DoD program offices scrutinize POA&M credibility.

Underestimating C3PAO scheduling lead time. Assessor availability is constrained. Organizations that wait until they feel "ready" to engage a C3PAO often find their desired window is months away.

Not preparing personnel for interviews. Assessors will question specific individuals — the IT administrator, the IR lead, the ISSO. If those individuals cannot articulate implementation without reading from the SSP, assessors take note.

Ignoring subcontractor flowdown. If you have subcontractors that process CUI under your prime contract, CMMC Level 2 flows down. Their compliance posture is your risk.

About the Author

Leonard Esere is the Founder of AeoliTech, a cybersecurity and compliance advisory firm serving the Defense Industrial Base. Leonard holds DoD Secret and DoE Q clearances and has led cybersecurity architecture and compliance programs across some of the most demanding classified environments in the federal government, including work with MITRE on CMMC framework development, full ATO program execution at Los Alamos National Laboratory (LANL), and PCI DSS compliance implementation at Frontier Airlines. His work sits at the intersection of rigorous technical implementation and regulatory defensibility — the combination that CMMC assessments demand.

References

1. 32 CFR Part 170 — CMMC Program Final Rule (eCFR)

2. CMMC Assessment Guide Level 2, Version 2.13 — DoD CIO

3. NIST SP 800-171 Revision 2 — Protecting CUI in Nonfederal Systems

4. NIST SP 800-171A Revision 2 — Assessing Security Requirements for CUI

5. Cyber AB — C3PAO Authorization Requirements and Marketplace

6. SPRS — NIST SP 800-171 Assessment Module (DISA)

7. Federal Register — CMMC Final Rule Publication, October 15, 2024

8. DFARS Final Rule Implementing CMMC — White & Case Analysis

9. DoD CIO — CMMC Program Documentation and Scoping Guides

10. NARA CUI Registry — Category and Subcategory List

> Ready to begin your CMMC Level 2 journey?

>

> AeoliTech offers a structured CMMC Gap Assessment that maps your current posture to all 110 NIST SP 800-171 Rev 2 requirements, produces a defensible SPRS score, and delivers a prioritized remediation roadmap.

>

> - Schedule a CMMC Gap Assessment → /services/cmmc-gap-assessment

> - Contact AeoliTech → /contact