Most defense contractors assume CMMC Level 2 applies to them. Many are wrong — and spending money they don't need to. This guide tells you definitively where you stand, what it actually costs, and what to do next.
CMMC Level 2 doesn't apply to every defense contractor. It triggers based on what your contracts require you to handle — specifically, Controlled Unclassified Information (CUI). Start here.
This clause requires NIST SP 800-171 compliance, which is the foundation of CMMC Level 2. If you've signed a contract with this clause — and you handle or process CUI — you're already in scope for Level 2.
Level 2 RequiredPull your top 3 contracts by value and search for "252.204-7012" or "DFARS" in the contract text. If you find it — you're in. If you don't, you may be Level 1 or not yet in scope.
Possibly Level 2FCI triggers CMMC Level 1 (17 practices, basic safeguarding). CUI triggers Level 2 (110 controls, full NIST 800-171). Many primes handle both — subcontractors often only handle FCI until a task order changes that.
Possibly Level 1If your work is purely commercial and none of your contracts include DFARS clauses or require CUI handling, CMMC may not apply to you at all. Confirm with your legal or contracting officer.
Likely Not in ScopeEven if your contract has the DFARS clause, Level 2 only applies to CUI you handle. Many contractors discover they thought they had CUI exposure when they didn't — and vice versa.
If your customer is a prime or subcontractor on a defense contract, assume CUI is in scope until proven otherwise. DoD contractors handling technical data, program information, or operational details almost always handle CUI.
Level 2 Likely RequiredClassified information falls under NISPOM / ICD 705, not CMMC. CMMC is for unclassified but sensitive information. Don't assume one means the other — they're separate compliance tracks.
Check NISPOM FirstThis is where most contractors get caught. NIST 800-171 requires cloud services to be FedRAMP Moderate authorized — or your organization must implement 39 specific controls for cloud-based CUI storage. The default Microsoft/Google configurations almost never meet this.
Requires Cloud ReviewIf you can affirmatively state that no CUI has been, is being, or will be generated, processed, stored, or transmitted on your systems — you may be out of scope. This requires a formal determination, not a guess.
CUI Assessment NeededBased on what you've read — here's where you stand and what to do next.
CMMC Level 2 maps directly to NIST SP 800-171. Check each area honestly. If you score below 80% in any category, that category will dominate your remediation timeline and cost.
MFA enforced on all accounts. Privileged access documented. No shared admin passwords.
CUI stored only on encrypted, labeled media. Sanitization procedures documented for disposal.
Security events logged centrally, retained 1+ years, reviewed monthly, anomalous activity flagged.
Baseline configurations documented, change control process exists, unauthorized changes detected and reversed.
PBI/CTR/PIV enforced for system access. No legacy password-only auth. Service accounts managed.
IR plan tested annually, incidents reported to DoD within 72 hours, evidence preserved, chain of custody maintained.
System security plan current, CUI data flow mapped, monthly vulnerability scans, annual risk assessment.
Boundary firewalls configured, traffic monitored, data in transit encrypted (TLS 1.2+), DISA STIGs applied.
Malware detection active, SIEM configured, threat signatures updated within 24 hours, false positives managed.
NDA and security awareness training completed before access granted. Annual refresher. Departing employee access revoked same day.
CUI systems in locked, access-controlled space. Visitor logs maintained. Media stored in GSA-approved containers.
POA&M current and tracked. Security assessment report prepared. Continuous monitoring plan in place.
Legend: ✓ = Implemented ◐ = Partially / Inconsistent ✕ = Missing ? = Unknown / Not Documented
Nobody publishes real numbers. Here's what contractors actually spend — based on 2025–2026 engagement data from the AltiriOS vCISO practice.
What drives the range? Primary cost drivers: how many systems process CUI, whether cloud environments are in scope, how many people need security training, and whether you have a current System Security Plan. A contractor who already has NIST 800-171 documentation is 40–60% cheaper to certify than one starting from scratch.
The CMMC rule allows 12–18 months for Level 2 certification from a standing start. In practice, most contractors who start today won't achieve certification until mid-to-late 2027 at the earliest. Here's why — and what's actually in your control.
⚠ Heads up: The CMMC rule is still being phased in by contract year. Your contracts won't all demand Level 2 at once. But the 2025 and 2026 contract awards are increasingly including Level 2 requirements. If you're bidding on new work, assume Level 2 is the floor — not the ceiling.
These questions come up in virtually every vCISO initial call. If any of these are keeping you up at night, we've answered them plainly.
Take a structured CMMC readiness assessment — or talk to a vCISO who can read your contracts and tell you exactly what you're on the hook for. No sales pitch. Just a clear picture.
Also available: CMMC Level 2 Deep-Dive · NIST 800-171 Controls Explorer