CMMC Level 2

All 110 practices across 14 domains, with practice-level evidence, SPRS scoring, and the official self-assessment and POA&M artifacts a C3PAO asks for by name.

What CMMC Level 2 is

CMMC Level 2 is the Department of Defense's certification requirement for contractors handling Controlled Unclassified Information. Its practice set is NIST SP 800-171 — the same 110 security requirements across fourteen families that DoD contractors have nominally been obliged to meet since DFARS 252.204-7012 took effect, with the difference that CMMC replaces self-attestation with assessment.

The mechanics that make CMMC distinct from every other framework here are the score and the affirmation. SPRS scoring starts at 110 and deducts a weight of 1, 3 or 5 for each unmet requirement, with a small set eligible for partial credit; the resulting number, which can be negative, is what gets reported. Alongside it, a senior official affirms continuing compliance, and that affirmation carries False Claims Act exposure. This is the one framework in the catalogue where the output is a legally consequential number rather than a report.

Level 2 assessments are either self-assessments or C3PAO-conducted, depending on the contract and the criticality of the information. Both produce the same artefacts, and both require a POA&M for anything not met, with closure deadlines.

Who it applies to

• Prime contractors and subcontractors at any tier who receive, store, process or transmit CUI.
• Suppliers whose contracts carry DFARS 252.204-7012, 7019, 7020 or 7021 clauses.
• Manufacturers and services firms in the defence industrial base being flowed down requirements by a prime.
• Organisations that already self-attested a SPRS score and now need to defend it.

How it is structured in CMDash

CMDash seeds all 110 Level 2 practices across the fourteen 800-171 families, with each practice carrying the verbatim NIST SP 800-171 Rev 2 requirement text — public-domain content, reproduced rather than paraphrased, because a paraphrased requirement is not something an assessor can accept.

The control text

What CMDash does for CMMC Level 2

• SPRS scoring computed from your practice statuses using the published 1/3/5 weights, with the partial-credit set applied where eligible. The score updates as practice statuses change rather than being recalculated by hand each quarter.
• An official NIST 800-171 / CMMC Level 2 self-assessment package rendered as a PDF, including the cover page, the senior-official affirmation statement and the POA&M — in the shape a C3PAO or a government customer expects to receive it.
• A CMMC-format POA&M export with the extended columns — POA&M identifier, weakness description, risk level, point of contact, resources required, scheduled completion date, milestones and source of finding — rather than a generic gap list.
• A read-only assessor seat scoped to CMMC alone, expiring on a date you set, with every page the assessor opened recorded. That removes the shared-login habit that most CMMC assessments still run on.
• The regulatory radar tracks the CMMC 2.0 programme itself as a dated entry mapped onto specific L2 and L3 practices, so programme milestones and your control state sit in the same view.

What it shares with your other frameworks

CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.

Where the evidence comes from

CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to CMMC Level 2’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.

All 47 integrations →

Where CMDash stops

Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.

• CMDash is not a C3PAO and cannot certify anyone. It produces the evidence and the artefacts; the assessment is conducted by an authorised third party or by you.
• The generated System Security Plan emits explicit "contractor action required" placeholders for the system description, the authorisation boundary and governance sections. Those are deliberately not auto-derived — a boundary description invented by software is exactly the kind of SSP defect that fails an assessment — and they are labelled in the document rather than silently blank.
• SPRS submission is a DoD system with its own access process. CMDash computes and packages the score; it does not file it for you.
• The seeded crosswalk from Level 2 reaches Level 3 but not directly to NIST CSF. Level 3 does carry a CSF mapping.

Common questions

Also in Government & Defense

Paid plans cap how many frameworks you run at once, never which ones — CMMC Level 2 is available on every paid plan.