CMMC 2.0 Explained: What Contractors Must Do to Keep DoD Work

What is CMMC 2.0 and why do contractors need it now?

CMMC 2.0 (Cybersecurity Maturity Model Certification) is the Department of Defense's tiered cybersecurity standard that verifies contractors protect sensitive government data before they can win or keep DoD work. It has three levels tied to the type of information you handle, and the requirement is now being written into contracts on a phased rollout. No qualifying certification, no eligibility to bid.

What are the three levels of CMMC 2.0?

CMMC 2.0 collapsed the old five-tier model into three levels, each mapped to how sensitive the data is and how it must be verified:

• Level 1 (Foundational): 15 basic safeguarding practices for contractors that handle only Federal Contract Information (FCI). Verified by an annual self-assessment and a signed affirmation from a senior company official.
• Level 2 (Advanced): The big one for most defense subs. It aligns with the 110 security controls in NIST SP 800-171. Contractors handling Controlled Unclassified Information (CUI) will need either a self-assessment or, for most contracts, a third-party assessment every three years.
• Level 3 (Expert): For the highest-priority programs and the most sensitive CUI. It builds on Level 2 and adds a subset of NIST SP 800-172 controls, assessed by the government itself.

The vast majority of the defense supply chain lands at Level 2. If you build, machine, code, or ship anything touching CUI, plan around it. Our overview for managed IT for defense contractors breaks down where most firms fit.

What is NIST SP 800-171 and how does it connect to CMMC?

NIST SP 800-171 is the federal publication that spells out the 110 security controls organizations must use to protect CUI in their own systems. CMMC 2.0 Level 2 does not invent new rules — it takes those 110 controls and adds a verification layer so the DoD can confirm you actually implemented them instead of just claiming you did. The controls span 14 families, including access control, identity management, incident response, and system monitoring.

Here is the part many contractors miss: that 800-171 obligation is not new. Through the DFARS 252.204-7012 clause, defense contractors handling CUI have been contractually required to implement 800-171 for years. CMMC 2.0 is the enforcement mechanism that finally checks the homework. If you have been treating 800-171 as aspirational, you are already behind.

What is a SPRS score and why does it matter?

Before a certified assessment, contractors must post a self-assessment score in the Supplier Performance Risk System (SPRS). You score your implementation of the 110 NIST 800-171 controls on a scale that tops out at 110, subtracting points for each control not yet met — which means a fully compliant firm posts 110 and a struggling one can post a negative number.

Contracting officers can see that score. A low or missing SPRS score is one of the fastest ways to get screened out of an award, and posting a knowingly inflated score carries serious False Claims Act exposure. Getting an honest score up first, then closing the gaps, is the practical starting point for most firms — which is where a managed compliance IT services partner earns their keep.

What is a C3PAO assessment?

For most Level 2 contracts, self-attestation is not enough. You must be assessed by a C3PAO — a Certified Third-Party Assessment Organization authorized by the Cyber AB (the DoD's accreditation body). The C3PAO reviews evidence that all 110 controls are implemented, interviews your team, and certifies the result for a three-year period. C3PAO capacity is limited, and demand is climbing as the rollout accelerates, so booking early matters.

Before you spend on an assessment, you want a mock audit and a documented System Security Plan (SSP) and Plan of Action & Milestones (POA&M). Walking into a C3PAO assessment unprepared wastes the slot and the fee. A good provider runs the readiness gap analysis first so the real assessment is a formality, not a gamble.

What should defense contractors do to prepare?

The work is very doable if you start now instead of when a contract clause forces your hand. A sensible sequence looks like this:

• Scope your CUI. Map exactly where CUI lives, flows, and is stored. A tight boundary (a dedicated enclave) shrinks the controls you must certify.
• Run a NIST 800-171 gap assessment. Score all 110 controls honestly and post to SPRS.
• Remediate and document. Close gaps, then write the SSP and POA&M that assessors will demand.
• Book a C3PAO once your readiness is verified.

Many small and mid-market contractors do not have the in-house security team to carry all of this, which is why they lean on a specialized managed cybersecurity provider to run the enclave, monitoring, and evidence collection. If you want the deeper walkthrough of the clauses and timeline, see our companion guide on CMMC compliance for defense contractors.

What does non-compliance actually cost?

The blunt answer: your eligibility. Once a contract carries the CMMC requirement, you cannot be awarded the work without the matching certification, and you cannot flow the requirement down to your own subs if you are not compliant yourself. In relative terms, the cost of getting certified is far less than the cost of losing a single program you have held for years — or the legal exposure of misrepresenting your posture. Treating CMMC as a business-continuity investment rather than an IT expense is the mindset that keeps contractors in the game.

Frequently asked questions

Does CMMC 2.0 apply to subcontractors?

Yes. If you are a sub that receives or handles FCI or CUI, the prime contractor must flow the appropriate CMMC level down to you. Subs handling CUI generally need Level 2, same as primes.

Can I self-assess for CMMC Level 2?

Only for a limited set of non-prioritized contracts. Most Level 2 work requires a C3PAO third-party assessment every three years, plus an annual affirmation from a senior official.

How long does CMMC certification take?

It depends on your starting gap. Firms with mature NIST 800-171 practices may need only a few months; those starting from scratch should plan for a longer remediation runway before booking a C3PAO. Starting early is the single biggest advantage.

Ready to protect your DoD pipeline? Compare vetted providers — free and find a partner who can get you certification-ready.