For defense contractors handling Controlled Unclassified Information (CUI), understanding CMMC Level 2 requirements is an important part of maintaining a secure and compliant technology environment.
CMMC Level 2 is based on the protection requirements established for CUI and is associated with the 110 security requirements in NIST SP 800-171 Revision 2. Under the current CMMC framework, organizations subject to the Level 2 self-assessment requirement conduct an assessment every three years and provide an annual affirmation of compliance.
CMMC implementation continues to evolve, so organizations should always confirm the requirements that apply to their specific contracts and current assessment pathway.
What Are the CMMC Level 2 Requirements?
CMMC Level 2 addresses the protection of CUI in nonfederal systems and organizations.
The requirements cover areas including:
- Access Control
- Awareness and Training
- Audit and Accountability
- Configuration Management
- Identification and Authentication
- Incident Response
- Risk Assessment
- Security Assessment
- System and Communications Protection
- System and Information Integrity
The goal is not simply to have cybersecurity policies in place. Organizations need to demonstrate that applicable security practices are implemented and supported by appropriate evidence.
Who Needs to Prepare for CMMC Level 2?
CMMC applies to organizations within the Defense Industrial Base that are subject to applicable contractual cybersecurity requirements.
Organizations preparing for CMMC should first determine:
- Whether they handle CUI
- Which contracts contain applicable cybersecurity requirements
- Which systems process, store, or transmit CUI
- What CMMC level applies
- What assessment requirements currently apply
This initial review helps establish the appropriate scope for the preparation process.
Understanding Your CMMC Assessment Scope
Defining scope is one of the most important steps in CMMC preparation.
Organizations should understand where CUI enters, moves, and is stored within their environment and identify the systems, users, endpoints, applications, cloud services, and external providers connected to that environment.
Ask questions such as:
- Where is CUI stored?
- Which systems process CUI?
- Who can access it?
- Which endpoints connect to those systems?
- Which cloud services are involved?
- Which external providers support the environment?
A clearly defined scope helps organizations understand which requirements apply and what evidence they may need to provide.
How to Prepare for a CMMC Assessment
A practical CMMC assessment preparation process can be organized into five steps.
1. Identify CUI and Define Your Scope
Map where CUI is created, received, stored, processed, and transmitted.
Then identify the systems and assets associated with that environment and establish the appropriate assessment scope.
2. Review the CMMC Requirements
Review the applicable requirements against your actual technology environment.
Don't only ask whether a policy exists. Ask whether the corresponding security practice is actually implemented.
This may include reviewing:
- Access controls
- Authentication
- Endpoint security
- Configuration management
- Logging and monitoring
- Vulnerability management
- Incident response
- Security training
3. Review Documentation
Your documentation should accurately describe how your environment operates.
Depending on your organization and applicable requirements, this may include:
- System Security Plans
- Security policies and procedures
- Access control documentation
- Incident response procedures
- Risk assessments
- Training records
- System inventories
Documentation should reflect the current environment rather than describe controls that have not been implemented.
4. Identify and Address Gaps
A readiness review can help identify differences between your current environment and the applicable requirements.
For each gap, document:
- The requirement
- Current implementation
- Missing elements
- Remediation actions
- Responsible owner
- Supporting evidence
This creates a practical roadmap for addressing gaps before an assessment.
5. Organize Your Assessment Evidence
Organizations should be prepared to demonstrate how applicable requirements are implemented.
Evidence can include documentation, system configurations, network configurations, logs, training records, and other information relevant to the assessment objectives.
A useful way to organize this information is:
Requirement → Implementation → Evidence → Responsible Owner
This makes it easier to demonstrate how each requirement is addressed.
CMMC Readiness Checklist
Use this checklist as a starting point for reviewing your organization's readiness.
CUI and Scope
- Identify where CUI is stored, processed, and transmitted.
- Identify systems and assets associated with CUI.
- Document relevant data flows.
- Define the assessment scope.
- Review external service providers.
Security Controls
- Review applicable CMMC requirements.
- Evaluate current implementation.
- Review access and authentication controls.
- Review endpoint and network security.
- Review logging and monitoring.
- Review incident response processes.
Documentation
- Review policies and procedures.
- Maintain an accurate System Security Plan where applicable.
- Review training records.
- Maintain system and asset information.
- Document remediation activities.
Assessment Evidence
- Identify evidence for applicable requirements.
- Verify that evidence reflects the current environment.
- Organize documentation and technical evidence.
- Confirm responsible personnel understand their roles.
Common CMMC Readiness Challenges
Unclear CUI boundaries
Organizations may not have a clear picture of where CUI exists or which systems are involved.
Documentation gaps
Policies may not accurately reflect the organization's current technology environment.
Incomplete technical implementation
An organization may have documented procedures but still have security controls that are not fully implemented.
Insufficient evidence
Security practices may exist, but the organization may not have a consistent way to demonstrate implementation.
Changes to the environment
New users, devices, applications, and cloud services can change the scope and security requirements over time.
Preparing for CMMC Is an Ongoing Process
CMMC readiness should not be treated as a one-time documentation exercise.
Technology environments change, employees change roles, and new systems and services are introduced. Maintaining accurate documentation, reviewing security controls, and keeping the environment aligned with applicable requirements can support ongoing compliance.
Organizations should also monitor official CMMC guidance and confirm the requirements that apply to their specific contracts and assessment pathway.
Final Thoughts
Preparing for a CMMC Level 2 assessment starts with understanding your CUI environment, defining your scope, reviewing applicable security requirements, validating implementation, and organizing evidence.
A readiness checklist can provide structure, but successful preparation ultimately depends on having security practices that are implemented and can be demonstrated.
Preparing for a CMMC assessment? Contact Davis Tech Pro to discuss your organization's cybersecurity and technology environment.