Prepare for CMMC Level 2 with evidence that is always ready

CMMC Level 2 is the US Department of Defense cyber security tier for contractors that handle Controlled Unclassified Information (CUI). It requires all 110 security requirements of NIST SP 800-171 Revision 2, grouped into 14 domains. Depending on the contract, compliance is shown by a self-assessment or a certification assessment by an authorised third-party assessor (C3PAO), repeated every three years with an annual affirmation.

Any defence contractor or subcontractor that processes, stores or transmits Controlled Unclassified Information on a DoD contract that specifies CMMC Level 2 needs it. The requirement flows down the supply chain, so suppliers outside the US, including UK firms supporting US defence programmes, must meet it when their contract handles CUI. Companies handling only Federal Contract Information normally need Level 1 instead.

CMMC requirements began appearing in DoD contracts on 10 November 2025, when the DFARS rule took effect and Phase 1 of the rollout started with self-assessments. Phase 2, scheduled from 10 November 2026, makes C3PAO certification assessments the normal requirement for applicable Level 2 contracts. Contracting officers can include requirements earlier, so contractors should check each solicitation.

If you do not hold the CMMC Level 2 status a contract requires, you are not eligible for award of that contract or option. Status must be posted in SPRS and affirmed annually by a senior official. Inaccurate affirmations or misrepresented security can also expose a company to liability under the US False Claims Act, which the Department of Justice has pursued against defence contractors.

To pass, you must meet the 110 NIST SP 800-171 requirements, documented in a system security plan and backed by evidence for each assessment objective. Assessments use a 110-point scoring method. A limited set of requirements can sit on a plan of action and milestones for conditional status, but these must be closed within 180 days, after which a closeout assessment confirms them.

CMMC Level 2 is a verification programme for NIST SP 800-171 Revision 2: its 110 practices are the same requirements, and CMMC adds assessment, scoring and affirmation rules. ISO 27001 overlaps substantially on access control, logging, incident response and risk management, so existing ISO 27001 evidence helps, but it does not replace a CMMC assessment or cover every CUI-specific requirement.

The timeline depends on your starting point, how much of your environment handles CUI and the availability of C3PAO assessors. Scoping the CUI environment, closing gaps, writing the system security plan and gathering evidence for every requirement is usually a project measured in months rather than weeks, so contractors should start well before a bid requires certification.

Yes, on request. CMMC Level 2 is mapped in OneClickComply's control library across all 110 practices and is available on request rather than as a live framework today. Once enabled, controls you already run for ISO 27001, SOC 2 or Cyber Essentials map across, with automated evidence collection and monitoring. OneClickComply does not issue CMMC certification; that comes from an authorised C3PAO or your own self-assessment.