CMMC Level 2 in plain terms: the score, the clock, and what stays yours to fix

CMMC Level 2 covers 110 practices across 14 families of NIST SP 800-171 Rev 2. Three numbers matter more than the other 107 combined once you are actually preparing a self-assessment: the SPRS score, the POA&M close-out window, and the one honest sentence a tool should say about what it does and does not do for you.

The SPRS score

The Supplier Performance Risk System Basic Assessment score is computed from your NIST SP 800-171 practice assessments — not a separate number you enter, a derived one. Every practice you have not fully implemented subtracts points; the starting point is 110, and the floor most contracts require before award is well above zero. Our CMMC Level 2 readiness checklist walks through what moves that number, family by family; the SPRS and POA&M guide covers where it is calculated and exported.

The POA&M clock

Not every gap can sit on a Plan of Action & Milestones indefinitely. Level 2 allows a subset of practices to be POA&M'd rather than fully implemented at assessment time, and those items carry a 180-day close-out rule — miss it and the assessment result does not stand. Knowing which practices qualify, before you build a POA&M around the wrong ones, is most of what the readiness checklist above exists to walk through.

What stays yours

Here is the sentence every CMMC tool should say and most don't: no software product holds or grants CMMC certification. Certification is a property of the contractor's assessed environment, awarded by a C3PAO or via DoD self-assessment — not a status a dashboard can turn green on its own authority. Our own responsibility matrix (docs/product/cmmc-responsibility-matrix.md) draws that line for all 110 practices explicitly: for each one, CMDash either tracks status and evidence, or additionally automates part of the evidence from a connected integration — neither case means the underlying control is implemented for you, and a green status reflects what evidence exists, not a guarantee a C3PAO will accept it.

If you are scoping which CMMC level applies to you at all — Foundational, Advanced, or Expert — the CMMC Level 2 framework page has the practice count and family breakdown for this level specifically.