What Is CMMC Level 2? Requirements, Self vs C3PAO
By Shaheer Malik · Updated Oct 28, 2026
CMMC Level 2 is the level for companies that handle Controlled Unclassified Information. It requires the 110 security requirements of NIST SP 800-171 Rev. 2, verified every three years either by your own self-assessment or by a certification assessment from an authorized C3PAO, with an affirmation every year.[1]
Two kinds of Level 2
| Level 2 (Self) | Level 2 (C3PAO) | |
|---|---|---|
| Requirements | 110 (NIST SP 800-171 Rev. 2) | Same 110 |
| Who assesses | You | An authorized or accredited C3PAO |
| Results go to | SPRS | CMMC eMASS, then SPRS |
| Valid for | 3 years + annual affirmations | 3 years + annual affirmations |
| DoD small-business estimate | $37,196 over 3 years | $104,670 over 3 years |
DoD’s estimates cover the assessments and affirmations only and assume the requirements are already implemented.[2] Which one you need is set by the contract; see self-assessment vs C3PAO.
Scoring
The maximum score equals the number of requirements, 110; each requirement NOT MET subtracts its value (1, 3 or 5 points), which can push the score below zero.[1] You can hold a Conditional status with a score of at least 80 percent if the open items are allowed on a POA&M, and must close them within 180 days.[1] See POA&M and Conditional status.
Level 2 in 2026
Since September 3, 2026, contracts may require Level 2 (Self) in place of Level 2 (C3PAO); the November 2026 move to third-party certification is suspended. NIST SP 800-171 Rev. 2 under DFARS 252.204-7012 remains the baseline.[3] You can still choose a C3PAO assessment, for example when a prime asks for one.
Getting there
Most of the work is scoping CUI and closing gaps against the 110 requirements before anyone assesses you. Read how to get CMMC certified, CMMC assessment scope and what a C3PAO assessment looks like.
Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.
FAQ
What are the CMMC Level 2 requirements?
The 110 security requirements of NIST SP 800-171 Revision 2, across 14 domains such as Access Control, Audit and Accountability and System and Communications Protection.
Is CMMC Level 2 a self-assessment?
It can be either. Level 2 (Self) is your own assessment; Level 2 (C3PAO) is a certification assessment by an authorized C3PAO. The contract says which.
When is CMMC Level 2 required?
When a DoD contract or subcontract involving CUI includes it. Under the September 2026 class deviation, contracts may specify Level 2 (Self) while third-party certification is suspended.
What score do I need for CMMC Level 2?
All 110 requirements MET for a Final status. A Conditional status needs at least 80 percent of the maximum score, with only eligible items on a POA&M closed within 180 days.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)
- Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)
More on levels and requirements
- CMMC Level 1 Self-Assessment: Requirements and Steps
- CMMC Level 2 Self-Assessment vs C3PAO Certification
- CMMC Levels and Controls: How Many Each Level Has
- CMMC Level 1 Requirements: All 15 Controls Listed
- What Is CMMC Level 3? Requirements and Who Assesses It
- Which CMMC Level Do I Need? A Quick Way to Decide
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.