If you handle Controlled Unclassified Information (CUI) for the Department of Defense, you have probably heard two competing messages about CMMC Level 2. One says you can verify your own compliance. The other says you need an outside assessor to certify you. Both are true, which is exactly why so many defense contractors in the Upstate feel stuck. The path that applies to you depends on your contract, the type of CUI you touch, and the requirements your prime contractor passes down to you.
This guide at CMIT Solutions of Greenville explains how the two Level 2 paths differ, how to work out which one is yours, what each demands in practice, and what the recent suspension of Phase 2 means for your planning. It is written for owners, operations leaders, and IT managers at small and mid-sized manufacturers, engineering firms, and service providers in the defense supply chain.
A quick note on timing: CMMC has been moving fast, and the rules around third-party assessments changed in mid-2026. Details below reflect what was publicly reported as of late October 2026. Always confirm current requirements against your contract language and official Department of Defense (now styled the Department of War) announcements before making spending decisions.
The Short Answer First
Here is the quick version before the details:
- Level 2 self-assessment means your company evaluates itself against the 110 security requirements of NIST SP 800-171, posts a score to the government’s SPRS system, and an executive signs an annual affirmation of compliance.
- Level 2 third-party certification means an authorized outside organization, called a C3PAO, tests your environment and issues a certification that is generally valid for three years, with annual affirmations in between.
- Your path is set by the contract. The solicitation or contract states which Level 2 type applies. You do not get to choose, and your prime contractor may impose stricter expectations than the government does.
- Right now, self-assessment is the operative requirement. Third-party certification as a mandatory condition was scheduled to begin with Phase 2 on November 10, 2026, but that phase was suspended in July 2026 pending a program review.
The suspension does not mean you can relax. The security requirements themselves, the SPRS reporting, and your legal exposure for inaccurate claims remain in place.
A Quick Refresher on the CMMC Levels
CMMC is the Defense Department’s framework for verifying that contractors protect sensitive information. It has three levels.
Level 1: Foundational
Level 1 covers Federal Contract Information (FCI), which is non-public information provided by or generated for the government under a contract. It involves 15 basic safeguarding requirements and is always a self-assessment with an annual affirmation.
Level 2: Advanced
Level 2 applies when you handle CUI. It aligns with the 110 security requirements in NIST SP 800-171 Revision 2. This is the level that creates the self-assessment versus third-party question, and it is where most small and mid-sized contractors need to focus.
Level 3: Expert
Level 3 applies to the most sensitive programs and adds a selected set of requirements from NIST SP 800-172. Assessments are performed by government assessors. Only a small share of contractors will ever see it.
Understanding What Level 2 Actually Requires
Whether you self-assess or hire a C3PAO, the bar is the same: the 110 requirements. The path changes who verifies your answers, not what you must do. Those requirements are grouped into 14 families.
- Access control
- Awareness and training
- Audit and accountability
- Configuration management
- Identification and authentication
- Incident response
- Maintenance
- Media protection
- Personnel security
- Physical protection
- Risk assessment
- Security assessment
- System and communications protection
- System and information integrity
In practical terms, that means things like multi-factor authentication, encrypted communications, controlled administrator access, centralized logging and review, tested incident response plans, hardened configurations, patching, and documented policies that employees actually follow.
Many of these controls overlap with the principles behind a zero trust approach, which assumes no user or device is trusted by default. If you are working toward Level 2, building on that foundation tends to satisfy several families at once.
The Self-Assessment Path in Detail
What it is
A Level 2 self-assessment is a structured review your organization performs against all 110 requirements. You score yourself, document how each requirement is met, and submit the results to the Supplier Performance Risk System (SPRS). A senior company official then affirms that the results are accurate and that you will maintain compliance.
Who it typically applies to
Self-assessment at Level 2 is intended for contracts involving CUI that the Department of Defense considers lower risk. According to the department’s own estimates reported during the rulemaking, this group is a small minority of CUI-handling companies. Most contractors who touch CUI have been expected to land on the third-party path. Your contract will say which applies.
What you must do
- Define your scope, meaning which people, systems, facilities, and vendors touch CUI
- Assess every requirement against your actual practices, with evidence
- Calculate your score and record it in SPRS
- Build a plan of action and milestones for any gaps that the rules allow you to close later
- Have a senior executive sign the affirmation
- Repeat the affirmation every year and whenever your environment changes materially
How the scoring and gaps work
Under the CMMC rule, you generally need to meet a minimum score threshold to be eligible for conditional status, and any open items must be closed within a limited window, commonly cited as 180 days. Certain high-impact requirements cannot be left open at all. Because the details are specific, confirm the exact thresholds and exclusions with a qualified advisor before you rely on a gap plan.
The advantages
- Lower direct cost, since you are not paying an outside assessor
- More flexibility on timing
- A useful dry run for a future third-party assessment
The risks people underestimate
Self-assessment is not self-certification in the casual sense. An executive is signing a statement that the government will rely on when making award decisions. If that statement is inaccurate, the company can face False Claims Act exposure. Federal enforcement actions tied to cybersecurity representations have continued, and defense contractors have settled cases over overstated NIST 800-171 compliance. A rushed, optimistic self-score is one of the most dangerous documents a small contractor can sign.
There is also a practical risk. Many companies that self-assess honestly discover they are far from the 110-requirement mark. That is not a failure, but it should drive a real remediation plan, not a quick paperwork exercise.
The Third-Party Certification Path in Detail
What it is
A C3PAO is a Certified Third-Party Assessment Organization authorized through the Cyber AB, the accreditation body for the program. A C3PAO sends a team of certified assessors to review your documentation, interview your staff, and test whether your controls are implemented and working. If you meet the requirements, you receive a Level 2 certification, and the result is recorded in the government’s system.
Who it typically applies to
Third-party certification is intended for contracts involving CUI that the department treats as higher priority, which, based on its own projections, covers the large majority of organizations handling CUI. If your work involves export-controlled technical data, controlled design files, or sensitive manufacturing specifications for major programs, plan for this path.
What the process looks like
- Readiness work. You close gaps and gather evidence long before the assessment.
- Engagement. You contract with a C3PAO and agree on scope and scheduling.
- Assessment. Assessors review policies, inspect configurations, observe processes, and interview employees.
- Findings. You receive results, including any requirements that were not met.
- Closeout. Limited deficiencies may be addressed within the allowed window.
- Certification. A passing result is recorded, and annual affirmations continue.
What drives the cost and timeline
- The size and complexity of your scope
- The number of locations and the amount of in-scope equipment
- How mature your documentation and evidence are
- How many gaps need to be closed before the assessment
- Scheduling availability, since assessor capacity has been tight
Costs vary widely, so get written quotes and be wary of any provider who promises a fixed price without understanding your environment.
The advantages
- Independent validation that carries weight with primes and contracting officers
- Stronger defense against questions about your claims
- A competitive edge in solicitations that reward early readiness
The drawbacks
- Higher direct cost
- More disruption during the assessment
- A hard pass or fail standard, with limited room for cosmetic fixes
How to Know Which Path Is Yours
This is the heart of the question, and the answer is almost always found in documents you already have or can request.
Step 1: Read the contract clauses
Look at the solicitation and contract for DFARS clauses related to CMMC, including 252.204-7021, and for language that states the required CMMC level and whether it is a self-assessment or a certification. The required level is part of the award conditions.
Step 2: Identify what information you actually handle
Ask whether your work involves FCI only, or CUI. Many firms assume they handle CUI when they only handle FCI, which means Level 1 would apply. Others handle CUI without realizing it, because marked drawings, specifications, or technical data have been flowing through email for years. Get this answered precisely, ideally with your contracting officer or prime.
Step 3: Check your prime contractor’s flow-down
Primes pass requirements to subcontractors, and some are stricter than the government. A prime can ask for evidence of Level 2 readiness, a specific score, or a third-party assessment even where the government has not yet mandated one. Review every subcontract and supplier questionnaire.
Step 4: Ask your contracting officer
If the contract is unclear, ask in writing. Get the answer documented. This protects you if requirements are interpreted differently later.
Step 5: Map the decision to your pipeline
Look beyond today’s contracts. If you plan to bid on recompetes, option years, or new programs, consider which path those will likely require. Preparing for the harder path now is often cheaper than scrambling later. Guidance on compliance starting points can help sequence this work for growing firms.
A simple decision checklist
- Do you handle CUI, or only FCI? If only FCI, Level 1 applies.
- Does your contract specify a self-assessment? Follow it, and document your evidence.
- Does your contract or prime require certification? Plan for a C3PAO.
- Is the language unclear? Ask in writing before spending money.
- Are you bidding on future work? Prepare for the stricter path.
Where Phase 2 Stands Now
CMMC was designed to roll out in four phases. Phase 1 began in November 2025 and relies on Level 1 and Level 2 self-assessments. Phase 2 was scheduled to begin on November 10, 2026, and would have made third-party Level 2 certification a condition of award for applicable CUI contracts.
In July 2026, the Department of War issued a memorandum suspending Phase 2 and creating a CMMC Reform Task Force to review the program. Public comments were collected, with reports indicating roughly 1,100 responses, and the later phases were placed on hold pending further notice. As of the most recent public reporting, no final decision on the future of Phase 2 had been announced.
What the suspension changes
- The November 10, 2026 start of mandatory third-party Level 2 certification no longer applies as originally planned.
- New solicitations are expected to require only Level 1 or Level 2 self-assessments while the pause continues.
- Later phases are on hold until further notice.
What the suspension does not change
- Level 1 and Level 2 self-assessment requirements remain in effect.
- You still need a current SPRS score and an annual affirmation signed by a senior official to be eligible for applicable awards.
- DFARS 252.204-7012 obligations, including NIST SP 800-171 safeguarding, cloud requirements, and cyber incident reporting, still apply.
- Primes can still flow down CMMC expectations and ask you to prove compliance.
- False Claims Act risk for inaccurate cybersecurity representations remains.
The honest summary is that the pause is a delay and a review, not a cancellation. Industry commentary broadly treats it as uncertain: the program could be reshaped, narrowed, or resumed later. If you wait for certainty before starting, you may find yourself with the same requirements and less time. The thinking behind CMMC pause guidance is simple: keep moving, because the underlying controls are not going away.
Scoping: The Decision That Shapes Everything
Whichever path you take, scoping has the biggest effect on cost and difficulty. Scope defines which assets, people, and services must meet all 110 requirements.
Why scope matters so much
A company that lets CUI flow through every laptop, server, and shared drive has to secure all of them to the Level 2 standard. A company that confines CUI to a controlled enclave may need to secure far fewer systems. Good scoping can reduce both remediation effort and the size of an assessment.
Common scoping approaches
- Whole-company scope. Everything is in scope. This is simple but expensive.
- Enclave approach. CUI lives in a separate, controlled environment, and the rest of the business stays out of scope.
- Cloud-hosted enclave. CUI is stored and processed in an approved cloud environment, with strict controls on how users connect.
External service providers
If a cloud provider, managed service provider, or other vendor stores, processes, transmits, or protects CUI for you, that relationship has to be accounted for. Cloud services that handle CUI generally need to meet specific security equivalency expectations, and providers that manage your security tools may themselves fall into scope. Weak oversight of vendors is a frequent finding, which is why a clear vendor risk assessment process matters. The same applies to the cloud security risks that often hide in misconfigured storage and sharing settings.
If your CUI lives in the cloud, well-governed cloud services built around access control, encryption, and logging are a core part of getting ready.
What Readiness Looks Like in Practice
You can prepare for either path with the same work. The differences come at the end, when someone else decides whether to believe your evidence.
Phase 1: Know where you stand
- Identify every contract that involves CUI or FCI
- Map where CUI enters, moves, and leaves your environment
- Run an honest gap assessment against all 110 requirements
- Document a realistic score, not an optimistic one
Phase 2: Fix the foundations
- Enforce multi-factor authentication for all in-scope access
- Encrypt CUI in transit and at rest
- Patch and harden systems on a documented schedule
- Remove or replace unsupported operating systems and applications
- Limit administrator privileges and review them regularly
Unsupported systems are a recurring problem in small defense suppliers, and the practical case for retiring unsupported Windows devices is straightforward. Planning refreshes through careful IT procurement ensures new equipment arrives configured to the standard from day one.
Phase 3: Secure the daily tools
Email, file sharing, messaging, and phone systems are where CUI most often leaks. Locked-down productivity applications with proper access policies, data loss controls, and logging reduce that risk. Voice and video platforms matter too, so secure unified communications belong in your scope discussion.
Phase 4: Protect the network
- Segment networks so CUI systems are isolated
- Control and log traffic at the boundary
- Secure wireless access
- Monitor for unauthorized devices
Strong network management is central to several Level 2 families, and manufacturers with production equipment face extra complexity. The challenges of plant floor security are worth understanding early, and planning manufacturing IT modernization around uptime prevents costly disruption.
Phase 5: Detect, respond, and recover
Level 2 expects you to log activity, review it, detect incidents, and respond in a documented way. Modern monitoring has moved well beyond traditional antivirus, as explained in this overview of managed detection response. Dedicated cybersecurity services can provide the monitoring, incident handling, and reporting that assessors look for.
Recovery matters as well. Reliable data backup protects CUI availability, and sound backup and recovery planning shortens downtime after an attack.
Phase 6: Document and prove it
Assessors, and signing executives, rely on evidence. Build and maintain:
- A system security plan describing your environment and controls
- Policies and procedures that match what people actually do
- Records of training, access reviews, and incident exercises
- Configuration baselines and change logs
- A plan of action and milestones for allowed open items
Evidence collection should be continuous rather than a scramble. The idea behind continuous compliance monitoring is to capture proof as you work, so audits and affirmations are routine. Dedicated compliance services can carry much of the documentation and tracking.
Choosing Between the Paths: Practical Scenarios
These examples show how the decision often plays out. They are illustrative, not legal advice.
A 30-person machine shop supporting a prime
The prime sends a supplier questionnaire asking for a Level 2 self-assessment score. The shop handles marked drawings. Likely path: self-assessment now, with preparation for certification if the prime or future contracts require it. A cloud enclave could limit scope.
A 120-person engineering firm with export-controlled design files
Technical data flows through email and shared drives. Contracts reference CUI categories tied to major programs. Likely path: plan for third-party certification, and tighten access controls first. The case for engineering zero trust is especially strong when intellectual property is the asset at risk.
A 15-person services firm with only FCI
The contract involves non-public information but no CUI. Likely path: Level 1 self-assessment with an annual affirmation. Confirm in writing that no CUI is involved.
A 250-person manufacturer bidding on recompetes
Current work only requires self-assessment, but upcoming bids may be stricter. Likely path: self-assess today, and build to certification standards so the company is ready if requirements tighten.
Common Mistakes to Avoid
- Treating the pause as a reason to stop. The underlying controls and legal obligations remain.
- Overstating your score. An inflated SPRS score creates legal and contractual risk.
- Scoping too broadly. Including every system multiplies the work.
- Ignoring vendors. Cloud and service providers can fall in scope.
- Relying on policies alone. Assessors look for implemented controls and evidence.
- Waiting for a perfect rule. Preparation takes months, not weeks.
- Overlooking small gaps. A single small security mistake can compromise CUI and your standing.
- Skipping executive involvement. The person who signs the affirmation must understand what they are attesting to.
Why Compliance Is Also a Business Decision
CMMC is not only about passing an assessment. It is increasingly part of how defense customers choose partners.
- Primes ask for proof of readiness during supplier selection
- Contracting officers use SPRS data when evaluating risk
- Cyber insurers look closely at controls, and cyber insurance expectations have risen alongside regulatory pressure
- Strong security reduces the chance of a breach that could cost contracts and reputation
Companies that treat readiness as a long-term investment often find that it opens doors, while those that treat it as a checkbox tend to struggle when requirements change.
The Role of Strategy and Guidance
CMMC decisions touch budgets, contracts, staffing, and technology at once. Many small firms do not have a security leader to coordinate it all. That is why interest in virtual CIO support has grown, giving growing companies senior guidance without a full-time hire. Ongoing IT guidance helps you decide when to self-assess, when to certify, and how to sequence spending. Good strategic IT planning ties all of it to the contracts you want to win.
Why a Managed Partner Helps
Meeting Level 2 requirements is not a one-time project. Systems change, staff turn over, and threats evolve. A managed partner can keep the controls running between assessments.
- Reliable managed IT services keep systems patched, standardized, and monitored
- A responsive IT support team helps employees follow secure practices and report problems quickly
- Predictable service packages make compliance spending easier to plan
Be careful when choosing a provider, though. If a managed provider touches your CUI environment, it may be part of your assessment scope, so ask how it handles its own security and what evidence it can supply.
A Practical Timeline to Plan Around
Every company’s pace differs, but a rough sequence looks like this.
- Weeks 1 to 4: Confirm contract requirements, identify CUI, and decide on scope
- Weeks 4 to 10: Run the gap assessment and build a remediation plan
- Months 3 to 9: Implement technical controls, update policies, and collect evidence
- Months 9 to 12: Perform an internal review or mock assessment
- Ongoing: Monitor continuously, update documentation, and renew affirmations
Companies with significant gaps or complex environments may need longer. Starting earlier gives you room to absorb surprises.
Conclusion: Choose Your Path With Evidence, Not Assumptions
CMMC Level 2 comes down to two paths that share the same 110 requirements. Self-assessment puts verification in your hands, along with the responsibility to be accurate. Third-party certification puts an independent assessor between you and the claim, which adds cost but also credibility. Which one is yours depends on your contract, the CUI you handle, and what your primes expect.
The recent suspension of Phase 2 changes the timeline, not the substance. The safeguarding rules, the SPRS reporting, and the risk of inaccurate claims all remain. The smartest move is to confirm your requirements, scope your environment carefully, fix the gaps honestly, and build evidence as you go, so you are ready whichever way the program turns.
If you want help figuring out where you stand, the team at CMIT Solutions of Greenville can walk through your contracts, assess your environment, and map a practical path that fits your budget. You can also explore the full range of support on the Greenville IT provider homepage, or schedule a consultation to start the conversation.
Frequently Asked Questions
