CMMC Level 2 Compliance in 6 Months
For manufacturers processing Controlled Unclassified Information (CUI) who need NIST SP 800-171 aligned security and audit-ready evidence.
What Level 2 Requires
Level 2 is intended for organizations that handle CUI. It aligns with NIST SP 800-171 (110 requirements across 14 control families). Depending on contract requirements, validation may be self-assessment or a third-party C3PAO assessment.
Manufacturing Examples of CUI
- Engineering drawings/technical data packages treated as controlled
- Inspection criteria, test results, and manufacturing data for controlled programs
- CUI shared with primes/subs via email, SharePoint, file transfer, or portals
- Supplier documentation that includes controlled program details
Cyber9 Level 2 Outcomes
- CUI boundary defined (often an enclave so the whole shop is not in scope)
- Identity + endpoint + network controls implemented without breaking operations
- Logging/monitoring and backup strategy for the scoped environment
- Documentation approach suitable for assessment (SSP-style narrative and evidence organization)
- Assessment prep: mock walk-through + readiness sign-off plan
6-Month Roadmap
A 6-month plan focusing on discovery, security controls, policy creation, and training, followed by evidence validation and assessment prep, ensuring your organization is ready for CMMC Level 2 compliance.
Phase 1 (Weeks 1–4) - Discovery + Scoping + Gap Assessment
- Map where CUI is stored/processed/transmitted (engineering + email + file shares + portals)
- Map users, devices, apps, and vendor access paths that touch CUI
- Choose strategy: enclave (recommended for many manufacturers) vs full environment
- Build backlog against the 14 NIST SP 800-171 families
Phase 2 (Weeks 5–10) - Security Engineering (Core Controls)
- Identity: MFA, account lifecycle, privileged access controls, admin separation
- Endpoints: EDR, encryption where required, hardening, patching
- Network: segmentation for enclave, secure remote access, firewall cleanup
- Logging: centralized logging plan, retention, high-signal alerts
- Backups: protected backups + restore validation for scoped systems
Phase 3 (Weeks 11–16) - Policies + Procedures + Training
- Write practical policies that match manufacturing reality
- Awareness training for office + targeted engineering/vendor workflows
- Incident response playbook (simple, usable) and escalation paths
- Basic change control so security doesn’t drift
Phase 4 (Weeks 17–20) - Evidence + Control Validation
- Verify each control family is implemented and operating
- Capture evidence: configs, screenshots, logs, procedures, training records
- Internal testing so controls can be demonstrated confidently
Phase 5 (Weeks 21–24) - Assessment Preparation
- Mock assessment preparation: who answers what, how evidence is shown
- Finalize the system boundary narrative and evidence library
- Remediation plan and readiness sign-off
Why Level 2 is hard for manufacturers (Cyber9 advantage)
- Mixed environments: office IT + shop systems + vendors
- Engineering data flows and revision control across the supply chain
- Vendor remote access that must be locked down without stopping production
- Keeping scope controlled so compliance stays affordable
Level 2 FAQ
When will Level 2 show up in our contracts?
It already can. Since November 10, 2025, DoD solicitations may require a CMMC Level 2 self-assessment. From November 10, 2026, they may require a Level 2 certification from an authorized third-party assessor (C3PAO) as a condition of award, and by November 2028 CMMC applies across applicable contracts and option periods. Primes flow the requirement down to their suppliers.
Do we need a self-assessment or a C3PAO assessment?
The solicitation decides. A small share of Level 2 contracts allow a self-assessment; most contracts involving CUI will require a C3PAO certification. Either way, the 110 requirements of NIST SP 800-171 are the same — only who verifies them changes.
What score do we need to pass?
All 110 requirements are scored. A score of at least 88 (80%) can earn a Conditional status, provided the open items are ones the rule allows on a Plan of Action & Milestones (POA&M) — mostly 1-point requirements. Every open item must then be closed and verified within 180 days, or the conditional status expires.
How long does a Level 2 certification last?
Three years. In between, a senior official must affirm in SPRS every year that the requirements are still implemented and maintained — so the controls and the evidence have to keep working long after the assessment.
Do we have to move everything to GCC High?
No. CMMC doesn’t name a product, but DFARS 252.204-7012 requires any cloud service that stores or processes CUI to meet FedRAMP Moderate or equivalent. For many manufacturers — especially those handling ITAR or export-controlled data — the practical answer is a GCC High enclave for the people and systems that touch CUI, while the rest of the business stays where it is.
Do our CNC machines and shop-floor equipment have to meet all 110 requirements?
Usually not. Machine controllers, test equipment and other operational technology that can’t be fully secured are treated as Specialized Assets: they must be documented in your System Security Plan, shown on your network diagram and managed under your security policies, but they aren’t assessed against every requirement. Good scoping is what keeps the shop floor running and the assessment affordable.