02 / Build / CMMC readiness / CMMC Level 2
CMMC Level 2:What It Requires and How to Prepare
Know what the assessor will ask for.
Level 2 applies when you handle controlled unclassified information. It covers 110 practices aligned to NIST SP 800-171, and it is judged on documentation, evidence and interviews.
Current status, October 15, 2026
DoD suspended CMMC Phase 2 on July 13, 2026, so third-party (C3PAO) assessments are not being required in new or existing contracts while a reform task force reviews the program. Level 1 and Level 2 self-assessments, SPRS scores, annual affirmations, and DFARS 7012 with NIST SP 800-171 still apply, and voluntary C3PAO assessments remain available. The 110 practices and your evidence are unchanged, because they drive your self-assessment score and your affirmation. See the details.
What you get
- A gap assessment against all 110 practices
- A system security plan and the policies behind it
- A plan of action with owners and dates
- Evidence preparation and a readiness check before assessment
- Ongoing operation of the controls after you pass
How it works
We start by confirming scope, because it drives cost and effort. Then we assess, remediate and assemble the evidence an assessor will look for. See our CMMC overview and CUI scoping page.
Common questions
What is the difference between CMMC Level 1 and Level 2?
Level 1 protects federal contract information and covers 15 basic safeguarding practices, verified through an annual self-assessment. Level 2 protects controlled unclassified information and covers 110 practices aligned to NIST SP 800-171. Which level you need depends on the information your contract says you will handle.
Do subcontractors need CMMC?
Yes. CMMC requirements flow down from the prime contractor to subcontractors that handle federal contract information or CUI. The level you need follows the information you handle, so ask your prime what applies to your work. See CMMC for subcontractors.
What is a plan of action and milestones, and what can it cover?
A plan of action and milestones (POA&M) lists requirements you have not fully met yet, with owners and dates. The final CMMC rule allows a limited POA&M for Level 2, but only above a minimum score and only for lower-weighted requirements, and open items must be closed within a set period. We will check the current rule text against your situation, because details have been changing.
Who performs a Level 2 assessment?
It depends on the contract. Some Level 2 requirements can be met with a self-assessment. Others require an assessment by a Certified Third-Party Assessment Organization (C3PAO). Logos prepares you for the assessment; the assessor is independent.
Results
Multiple Logos clients have passed their CMMC Level 2 C3PAO assessment with no plan of action and milestones (POA&M). Assessments are performed by independent C3PAOs.
Typical timeline
Most organizations that handle CUI should plan for 6 to 12 months to reach Level 2 readiness. Timelines vary with your scope, your starting point and assessment scheduling.
Credentials
Our team is CCP-trained or better. William Birchett holds Cyber AB Lead CCA, CCA and CCP credentials, along with CISSP, CISM and CISA. We prepare you for the assessment; an independent assessor performs it.
Build once. Comply many.
We run compliance on the Secure Controls Framework (SCF): one control set mapped to the frameworks you need, so the work is connected instead of repeated. See how we use SCF.
Check where you stand
Take a short readiness check for CMMC Level 1, CMMC Level 2, HIPAA and HITECH, or Texas SB 2610. Not sure what applies? Book a scoping call. It works for any framework.
Bring us the complicated part.
Talk with a credentialed CISO and an accountable team. Email [email protected] or call 877-855-CMMC.