What is CMMC Level 2?

CMMC Level 2 is the CMMC tier for contractor systems that process, store, or transmit Controlled Unclassified Information (CUI). It assesses implementation of the 110 requirements from NIST SP 800-171 Revision 2. Depending on the solicitation and the current phase of implementation, Level 2 may be a self-assessment or an independent C3PAO assessment, with annual affirmation of continuing compliance in SPRS.

Do I need CMMC if I am a subcontractor?

A subcontractor can be in scope when it will process, store, or transmit FCI or CUI in performance of a DoD subcontract and the applicable CMMC requirement is flowed down. Scope follows the information and systems used for the work, not company size or whether the organization contracts directly with DoD. Review the prime contract, subcontract, and data flows before deciding your required level.

How long does CMMC certification take?

The timeline depends on the CUI boundary, existing technology, documentation quality, and remediation workload. A small contractor with a well-defined boundary and mature identity, endpoint, logging, and incident-response practices can prepare faster than one redesigning its environment. Reserve time for evidence collection, internal testing, and C3PAO scheduling when the solicitation requires a third-party assessment; do not treat the assessment date as the start of readiness work.

What is the cost of CMMC compliance?

CMMC cost is driven by the size and design of the CUI enclave, the 110-requirement gap, necessary licensing or infrastructure changes, documentation work, and ongoing operation of controls such as log review and vulnerability management. Separate readiness advisory, technology remediation, recurring managed-security services, and the independent C3PAO assessment in a budget. A credible estimate starts with a scoped gap assessment, not a fixed package.

What are the 110 CMMC Level 2 controls?

Level 2 uses the 110 security requirements in NIST SP 800-171 Revision 2 across 14 families, including Access Control, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Risk Assessment, System and Communications Protection, and System and Information Integrity. The assessment evaluates implemented practices and evidence, not merely whether the organization owns a policy template.

What is the difference between a C3PAO and an RPO?

A C3PAO is an independent CMMC Third-Party Assessment Organization that conducts official Level 2 assessments when required by a solicitation. An RPO is a Cyber AB Marketplace advisory organization that can support gap analysis, remediation, documentation, and readiness. An RPO does not issue CMMC status, and an organization that prepared a client should not be selected to independently assess that same client.

Do we need a GCC High tenant for CMMC?

CMMC does not name a required cloud tenant. The requirement is to protect CUI in accordance with the applicable controls and contract requirements. GCC High can be an appropriate Microsoft environment when it matches a contractor’s CUI workflow and contractual obligations, but it is not automatically required for every contractor. Start by mapping where CUI enters, moves, and is retained before selecting or migrating a tenant.

What is the difference between CUI, CDI, and FCI?

FCI is nonpublic information provided by or generated for the Government under a contract, excluding public and simple transactional information; it generally maps to Level 1. CUI is information requiring safeguarding or dissemination controls under law, regulation, or Government-wide policy; it generally maps to Level 2. Covered Defense Information (CDI) is the DFARS 252.204-7012 term that includes certain controlled technical information and other CUI handled for DoD.

Can we self-attest at CMMC Level 1?

Yes. CMMC Level 1 uses an annual self-assessment against the 15 basic safeguarding requirements in FAR 52.204-21, followed by an annual senior-official affirmation in SPRS. The status must be Final Level 1 (Self) for award when a solicitation requires Level 1; Level 1 does not use a conditional status or a POA&M path to satisfy the award requirement.

What is the CMMC assessment timeline for a small defense contractor?

Small contractors should begin by confirming the solicitation, CUI boundary, and assessment type, then conduct a gap analysis against the applicable requirements. The practical schedule must include remediation, SSP and evidence development, internal validation, and assessor availability if a C3PAO assessment is required. The number of employees is less important than the number of in-scope systems, CUI workflows, and unresolved operational controls.

How does CMMC 2.0 differ from CMMC 1.0?

CMMC 2.0 simplified the original five-level model to three levels and aligned Level 1 with FAR 52.204-21 and Level 2 with the 110 requirements in NIST SP 800-171 Revision 2. It also allows defined conditional Level 2 statuses and POA&Ms under 32 CFR Part 170. The acquisition rule and solicitation determine which assessment type applies to a specific award.

Are we required to have MFA for CMMC Level 2?

Yes. NIST SP 800-171 Revision 2 requirement 3.5.3 requires multifactor authentication for local and network access to privileged accounts and for network access to nonprivileged accounts. An assessor will expect evidence that the configuration is enforced in the CUI environment, not only that MFA is available. Account inventory, conditional-access settings, exceptions, and access-review records are commonly relevant evidence.

What is a Shared Responsibility Matrix?

A Shared Responsibility Matrix records who performs each control activity when responsibility is divided among the contractor, a cloud provider, and service providers. For every in-scope requirement, it identifies the accountable owner, supporting parties, evidence source, and review cadence. It is especially useful for logging, backups, patching, incident escalation, access approvals, and vulnerability remediation, where a provider capability alone does not prove the contractor operates its part of the control.

What happens if we fail a CMMC assessment?

The result depends on the assessment type and the nature of the findings. Under 32 CFR Part 170, certain Level 2 deficiencies may be eligible for a conditional status and a time-bounded POA&M, while other findings require remediation before final status. A failed or incomplete assessment should trigger evidence-preserving root-cause analysis, a remediation plan, and confirmation with the contracting team before making award or performance assumptions.

How often is CMMC re-assessment required?

CMMC assessments are generally valid for three years, with an annual affirmation of continuing compliance in SPRS. Level 1 self-assessments and affirmations occur annually. Level 2 and Level 3 assessment statuses have their own assessment and conditional-status rules under 32 CFR Part 170. Contractors must also maintain the status required by the solicitation throughout the contract, so continuous evidence and operating discipline matter between formal assessments.

CMMC 2.0 · NIST 800-171 · DFARS 252.204-7012

CMMC compliance for the U.S. defense contractors who can’t afford to lose the contract.

Final rule December 16, 2024. Phase I self-assessments remain in force. Phase II, originally November 10, 2026, is suspended. We get U.S. defense contractors and government subcontractors, from coast to coast, from current-state to assessment-ready, then run the long-term controls afterward.

Level 1 and Level 2 scoping, gap, and remediation
SSP authoring + POA&M tracking + evidence library
GCC High migration + Sentinel + Defender XDR
24/7 SOC for continuous monitoring controls

Schedule a discovery call All services

CMMC 2.0 timeline

Three dates to know.

DoW has been clear about the phased rollout. The dates are not moving. If you carry FCI or CUI on a current contract, or want to bid on the next one, the timeline below is non-negotiable.

01

Dec 16, 2024

CMMC final rule published

32 CFR Part 170 published in the Federal Register. Rule officially in force.
02

Nov 10, 2025

Phase 1 enforcement begins

Self-assessment requirements (Level 1 and self-Level 2) appear in new DoW solicitations.
03

July 13, 2026

Phase II suspended

Third-party C3PAO requirement paused. Phase I self-assessments remain in force.

CMMC services in Honolulu & the Pacific Defense Industrial Base

A Honolulu-headquartered CMMC partner for Pacific defense contractors.

Cyberuptive is headquartered in Honolulu at 401 Kamakee St, serving Pacific defense subcontractors and INDOPACOM supply-chain firms across all CMMC 2.0 levels. The Pacific Defense Industrial Base, the manufacturers, shipyards, MRO providers, integrators, software shops, and professional-services firms supporting Pacific Air Forces (PACAF), Pacific Fleet (PACFLT), Marine Forces Pacific (MARFORPAC), and U.S. Army Pacific (USARPAC), faces the same CMMC requirements as Atlantic-coast primes, but with shorter assessor pipelines and tighter time-zone overlap with HQ-side compliance teams.

Our CMMC level 1 services and CMMC level 2 services in Honolulu cover the same nationwide scope, scoping the CUI boundary, NIST SP 800-171 gap assessment, SSP authoring, POA&M tracking, SPRS scoring support, GCC High migration, and 24/7 continuous monitoring, with the addition of HST-based scoping calls, Pacific-time SOC operations, and personal relationships with the C3PAO assessors covering Region IX. If your CMMC assessment services need to map to a Honolulu-headquartered prime or a JBPHH-, Schofield-, or Wheeler-adjacent subcontractor footprint, the work is already familiar to us.

CMMC 2.0 services we deliver to Pacific contractors

CMMC Level 1 services in Honolulu, the 15 basic safeguarding requirements for contractors handling Federal Contract Information (FCI). Annual self-assessment, SPRS posting, and the controls baseline to support it.
CMMC Level 2 services in Honolulu, all 110 NIST SP 800-171 controls for contractors handling Controlled Unclassified Information (CUI). C3PAO-ready evidence packs, SSP, POA&M, and the long-term operational controls (SOC, SIEM, vulnerability management, incident response) that the assessment requires you to keep running afterward.
CMMC 2.0 services in Honolulu, SPRS & DFARS support, calculating, posting, and defending the SPRS score; mapping NIST 800-171 control implementations to DFARS 252.204-7012 expectations; and producing the rapid 72-hour incident reporting evidence trail.
CMMC assessment services in Honolulu, mock C3PAO assessment with assessor-style questioning, evidence-pack QA, and the remediation lift between mock and live assessment.

Why a Honolulu-based CMMC partner matters

For CUI engagements, Cyberuptive scopes advisory and managed-security work to U.S. persons working from U.S. soil. Many Pacific defense subcontractors operate small IT teams without 24/7 SOC capability, and the natural fallback: outsourcing to a continental U.S. MSSP, can introduce time-zone friction (a 0200 HST incident hits the East Coast MSSP at 0700, queued behind their overnight backlog) and occasionally CUI-handling complications when the MSSP's analyst rotation includes non-U.S. persons. A Honolulu-headquartered partner with U.S.-citizen analysts and HST primary coverage removes both problems.

Engagement model

From scoping to assessment-ready, with the long-term controls already running.

01

Scope

Define the CUI boundary. Inventory in-scope assets, users, data flows. Confirm Level 1 vs Level 2.
02

Gap

Score current-state against all 15 (L1) or 110 (L2) controls. Output: scored gap report + remediation roadmap.
03

Remediate

Close gaps. GCC High migration, Defender + Sentinel deployment, SOC + VM stand-up, IR retainer.
04

Document

SSP authored, POA&M live, evidence library populated, mock assessment with C3PAO-style questioning.

U.S. defense contractor team reviewing CMMC compliance evidence

Built for U.S. defense contractors

Your contracts are on the line. We’re the guide that gets you assessment-ready.

CMMC 2.0 reaches every primes-and-subs corner of the Defense Industrial Base, manufacturers, integrators, software shops, professional services, and engineering firms across all 50 states. If your contracts touch Federal Contract Information or Controlled Unclassified Information, the compliance bar is the same whether you’re in Huntsville, Hartford, or San Diego.

We operate as your CMMC readiness partner: scoping the CUI boundary, scoring against NIST SP 800-171, authoring the SSP, running the POA&M, posting your SPRS score, and standing up the long-term controls, SIEM, SOC, vulnerability management, and incident response, that DFARS 252.204-7012 expects you to keep running after the C3PAO leaves.

• Nationwide engagements for DoW primes and subcontractors
• NIST 800-171, DFARS 252.204-7012, and SPRS scoring expertise
• Evidence library, SSP, and POA&M built to C3PAO standards
• U.S.-based analysts handling CUI under DFARS-aligned controls

Control families we operate long-term

Pass the assessment. Stay passed.

The hardest-to-sustain control families are continuous monitoring, audit logging, and incident response. We run those as managed services so you do not have to staff them.

AC · Access Control

Conditional Access, Entra ID PIM, role review, session controls.

AU · Audit & Accountability

Sentinel SIEM with 1-year retention, alert review, integrity protection.

CM · Configuration Management

Baselines, change control, deviation tracking, periodic review.

IR · Incident Response

24/7 SOC triage, IR retainer, tabletop exercises, post-incident review.

RA · Risk Assessment

Continuous vulnerability scanning, KEV/EPSS prioritization.

SI · System & Information Integrity

Defender XDR, threat hunting, flaw remediation tracking.

The CMMC 2.0 model

Three levels. Your solicitation, not a vendor, sets the target.

CMMC is a contract requirement framework for unclassified contractor systems that process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). 32 CFR Part 170 establishes the program; the CMMC clause in a solicitation tells a contractor which level, assessment type, and systems are in scope. That applies to a prime and to a subcontractor when its work or information system falls inside the contract requirement.

Level 1: foundational protection for FCI

Level 1 is for contractors handling FCI but not CUI. It maps to the 15 basic safeguarding requirements in FAR 52.204-21. The organization performs a self-assessment and a senior official makes the required annual affirmation in SPRS. A Level 1 status must be final, not conditional, when the solicitation requires Level 1 at award.

Level 2: broad protection for CUI

Level 2 uses the 110 requirements in NIST SP 800-171 Rev. 2. During the current Phase I pause, the Department of War may require Level 2 self-assessments; the solicitation controls whether a C3PAO assessment is required. The correct question is not “are we a Level 2 company?” but “which systems will process, store, transmit, or protect CUI for this award?”

Level 3: highest-priority CUI programs

Level 3 is reserved for selected higher-priority programs. It builds on Level 2 with a subset of NIST SP 800-172 requirements and a government-led assessment. It is not a default requirement for every CUI subcontractor. Contract language and program-office direction determine whether it applies.

The acquisition rule matters as much as the program rule. Under DFARS 204.7502, a contracting officer cannot award when the offeror lacks the CMMC status specified in the solicitation for systems used to process, store, or transmit FCI or CUI. Read every prime-flowdown and subcontract clause early: a small supplier can be in scope even when it never connects directly to a government network.

Assessment readiness

What a Level 2 assessment actually tests.

An assessor is looking for a defensible implementation, not a binder of generic policies. The System Security Plan (SSP) should define the CUI boundary, responsible roles, technology, and how each NIST SP 800-171 requirement is met. Interviews, examination of evidence, and technical testing must tell the same story. A Plan of Action & Milestones (POA&M) can document allowable, time-bounded remediation; it is not a substitute for an implemented control.

The Cyber AB ecosystem: prepare, assess, and keep the roles independent

A C3PAO is the independent organization that conducts an official Level 2 assessment when the contract requires one. An RPO is a registered advisory organization in the Cyber AB Marketplace ecosystem: it can help with readiness, remediation, evidence, and assessment preparation, but it does not issue a CMMC status. CCPs and CCAs are qualified individuals who support and conduct assessment work within the C3PAO model. Cyberuptive provides RPO-track readiness advisory and managed-security support; Cyberuptive does not represent itself as a C3PAO.

Five recurring Level 2 failures

An undefined CUI boundary. CUI sits in email, shared storage, endpoints, backups, or an MSP workflow that never made it into scope.
An SSP that is not the environment. The document names controls and owners that do not match the tenant configuration, logs, or daily operating process.
Identity evidence without consistent enforcement. MFA, least privilege, privileged-account separation, and periodic access review must be implemented and demonstrable: not merely policy statements. NIST SP 800-171 Rev. 2 requirement 3.5.3 specifically addresses MFA.
Logging with no review process. Collecting events is not enough. The organization needs retained evidence of alert triage, investigation, escalation, and corrective action across the AU and IR control families.
Unowned shared responsibilities. Cloud platforms, managed service providers, and internal teams may each operate part of a control, but nobody has recorded the handoff or retained the evidence.

A Shared Responsibility Matrix makes those handoffs explicit. It maps each in-scope control activity, such as patching, log review, account approvals, backup recovery tests, and incident escalation, to the contractor, the cloud provider, and any managed-security partner. It also identifies the evidence owner and review cadence. That matrix turns a plausible architecture into an assessable operating model.

For a cost baseline, see our managed SOC pricing guide. For the detection and response layer that supports continuous monitoring, review our managed detection and response service. Defense contractors in Hawaiʻi can also explore our Hawaii cybersecurity services, and procurement teams comparing providers can use our 2026 MSSP comparison.

FAQ

Frequently asked

Don't see your question? Talk to a real person: we're 833-92-CYBER.

When does CMMC 2.0 actually start affecting my contracts?

The CMMC final rule was published December 16, 2024. Phase 1 enforcement began November 10, 2025, with self-assessment requirements appearing in new DoW solicitations. On July 13, 2026 the Department of War suspended Phase II, which had been scheduled for November 10, 2026. Phase I self-assessments remain in force. If you bid on DoW work touching CUI, the safeguarding duty did not pause.
What level do I need?

If you handle Federal Contract Information (FCI) only, Level 1 (15 requirements, annual self-assessment). If you handle Controlled Unclassified Information (CUI), Level 2 (110 controls from NIST 800-171, third-party C3PAO assessment for most). Level 3 is for the highest-priority programs and is rare for subcontractors. We do a 1-hour scoping call to confirm.
What does a CMMC engagement actually look like?

Four phases: (1) Scoping, define the CUI boundary, identify in-scope assets, classify data flows. (2) Gap assessment, current-state against all 110 controls, scored. (3) Remediation, close gaps, deploy GCC High where required, harden M365, build SOC + VM + IR programs. (4) Documentation & assessment prep, SSP, POA&M, evidence library, mock assessment. Typical duration: 6–12 months depending on starting maturity.
What does a CMMC readiness partner actually do?

A CMMC readiness partner does the work most defense contractors can’t staff in-house: scoping the CUI boundary, running the gap assessment against NIST SP 800-171, authoring the System Security Plan, maintaining the POA&M, posting and defending the SPRS score, and operating the long-term controls, SIEM, 24/7 SOC, vulnerability management, and incident response, that DFARS 252.204-7012 expects you to keep running. We do this for U.S. defense contractors and government subcontractors nationwide, with U.S.-based analysts handling CUI.
Do you produce the SSP and POA&M, or just review what we have?

Both. Most engagements include authoring the System Security Plan from scratch (or a substantial rewrite) and standing up a working POA&M with quarterly review. We produce evidence-ready documentation that matches what your C3PAO will request: not generic templated language.
Can you operate the long-term controls (SOC, VM, IR)?

Yes, that is the most cost-effective model. Continuous monitoring (SI.L2-3.14.6), audit logging (AU family), and incident response (IR family) are the controls medium and large contractors most often lack. Our managed SOC, vulnerability management, and IR retainer satisfy all three with one provider, US-based, and assessment-mapped. See SOC as a Service.
What about GCC High?

If you handle CUI in Microsoft 365, you almost certainly need GCC High, commercial M365 will not satisfy DFARS 252.204-7012 by itself. We scope, license, migrate, and document the tenant. See Microsoft 365 services.
How much does this cost?

Honest answer: it depends on size and starting maturity. A 25-person defense subcontractor starting from minimal NIST 800-171 maturity typically invests $80K–$180K across 9–12 months for full Level 2 readiness, plus ongoing managed services. We scope to the environment: not a fixed package. Lost contract revenue from non-compliance is a much bigger number.

Talk with a CMMC advisor

Need a real CMMC plan, not a spreadsheet?

A 30-minute scoping call tells us your level, your boundary, and your runway. From there we build a fixed-scope roadmap: not a sales pitch.

Schedule a discovery call Call 833-92-CYBER