UTMStack

Articles, updated 11 min read

CMMC Compliance Checklist: 12 Steps for Level 2 in 2026

By UTMStack Team

If your company holds a defense contract or subcontract, the Cybersecurity Maturity Model Certification (CMMC) program decides whether you can keep winning that work. 2026 added a twist. The third-party certification step planned for November 10, 2026 has been suspended, but the security requirements underneath it have not changed, and you still have to assess yourself, post a score and have a senior official vouch for it every year.

This checklist turns the CMMC rule into twelve practical steps, with the facts checked against the regulation itself: 32 CFR Part 170 in the Code of Federal Regulations, and the related contract clauses.

The short answer: A CMMC compliance checklist comes down to six things. Find out whether you handle federal contract information (FCI) or controlled unclassified information (CUI). Identify your level: Level 1 is 15 requirements from Federal Acquisition Regulation (FAR) clause 52.204-21, Level 2 is the 110 requirements of National Institute of Standards and Technology (NIST) SP 800-171 Revision 2, and Level 3 adds 24 selected requirements from NIST SP 800-172. Define the systems in scope. Write a system security plan. Close your gaps, starting with the requirements worth the most points. Then score yourself with the Department of Defense (DoD) method, post the result in the Supplier Performance Risk System (SPRS) and affirm it every year. A conditional Level 2 status needs at least 80 percent (88 of 110), with only 1-point items left on a plan of action that must close within 180 days.

Where CMMC stands in October 2026

  • The program rule (32 CFR Part 170) took effect on December 16, 2024.
  • The contract rule in the Defense Federal Acquisition Regulation Supplement (DFARS) took effect on November 10, 2025. That started Phase 1: Level 1 or Level 2 self-assessments as a condition of award.
  • Phase 2 was due on November 10, 2026, making Level 2 certification by a third-party assessment organization (C3PAO) a condition of award on many contracts. On July 13, 2026, DoD, which now also uses the name Department of War, suspended Phase 2 and all later milestones and set up a CMMC Reform Task Force for a 60-day review.
  • On September 3, 2026, class deviation 2026-O0025, Revision 3, made the suspension binding on contracting officers. New requirements may only call for Level 1 (Self) or Level 2 (Self). Third-party and Level 3 requirements are being removed from solicitations, and from existing contracts before the next option or administrative change.

The CMMC rollout, as of October 2026

Phase 1 is in force; Phase 2 and later phases are on hold

  1. Dec 16, 2024Program rule in force32 CFR Part 170
  2. Nov 10, 2025Phase 1 startsLevel 1 or Level 2 self-assessments in contracts
  3. Jul 13, 2026Phase 2 suspendedReform task force begins a 60-day review
  4. Sep 3, 2026Class deviationContracts may require only Level 1 (Self) or Level 2 (Self)
  5. Nov 10, 2026Original Phase 2 dateOn hold, no new date announced
Sources: Federal Register, DFARS class deviation 2026-O0025 Revision 3, and the CMMC page of the DoD Chief Information Officer.

What did not change matters more. 32 CFR Part 170 is still in force. DFARS 252.204-7012 still requires you to protect CUI with the 110 requirements of NIST SP 800-171 Revision 2 and to report cyber incidents within 72 hours. Self-assessment scores and annual affirmations still go to the government, so an inaccurate one is a contract and legal risk. The accreditation body, the Cyber AB, has confirmed that voluntary C3PAO assessments continue, and a prime contractor can still ask its suppliers for certification. At the time of this update, no new Phase 2 date had been announced. The sensible plan is to build to the Level 2 standard now, so you are ready for whatever form third-party assessment takes if it returns.

The three CMMC levels at a glance

Level 1Level 2Level 3
ProtectsFCICUICUI in the highest-priority programs
Requirements15, from FAR 52.204-21(b)(1)(i) to (xv)110, from NIST SP 800-171 Rev 2Level 2 plus 24 selected from NIST SP 800-172
AssessmentSelf-assessmentSelf-assessment or C3PAO certification, as the contract saysGovernment assessment by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), after a Final Level 2 (C3PAO)
How oftenEvery yearEvery 3 yearsEvery 3 years
Affirmation in SPRSEvery yearAt each assessment and every yearAt each assessment and every year
Plan of action allowedNoYes, with limitsYes, with limits

During the suspension, contracts can require Level 1 (Self) or Level 2 (Self) only.

The CMMC compliance checklist

Twelve steps in four stages

The order most contractors follow from first contract review to staying compliant

  1. ScopeSteps 1 to 3
    1. Identify FCI and CUI2. Confirm your level3. Map the assets in scope
  2. BuildSteps 4 to 8
    4. Write the system security plan5. Run a gap assessment6. Close 5-point gaps first7. Turn on logging and monitoring8. Check cloud and service providers
  3. ProveSteps 9 to 11
    9. Score with the DoD method10. Post in SPRS and affirm11. Plan of action, if allowed
  4. KeepStep 12
    12. Reaffirm every yearReassess every 3 yearsKeep evidence 6 years
Step 11 applies only if you score at least 88 of 110 and every open item is one the rule allows you to defer.

Stage 1: Scope

1. Identify whether you handle FCI, CUI or both.

  • Read your contracts. FAR 52.204-21 means FCI. DFARS 252.204-7012 means covered defense information, which is CUI. DFARS 252.204-7021 states the CMMC level.
  • Find where CUI arrives and lives: drawings, specifications, test data, export-controlled files, and email.
  • If the contract is unclear, ask the contracting officer in writing. Do not guess.

2. Confirm the level that applies. FCI only means Level 1. Any CUI means at least Level 2. Level 3 applies only where the contract asks for it.

3. Map the assets in scope. 32 CFR 170.19 sorts assets into CUI Assets, Security Protection Assets (tools that protect the environment, such as firewalls and your security information and event management system, or SIEM), Contractor Risk Managed Assets, Specialized Assets (such as test equipment, operational technology and Internet of Things devices) and Out-of-Scope Assets. Draw a network diagram that shows the boundary. A common way to shrink scope is to move CUI into a separate enclave.

Stage 2: Build

4. Write the system security plan (SSP). Requirement 3.12.4 asks for it, and it is one of the requirements that can never go on a plan of action. Without a plan describing how each requirement is met, there is nothing to assess.

5. Run a gap assessment. Check every requirement against its assessment objectives in NIST SP 800-171A (June 2018), the version the CMMC rule uses. A requirement is met only when all of its objectives are met.

6. Close the 5-point gaps first. The DoD scoring method starts at 110 and subtracts 5, 3 or 1 point for each requirement not met. Only 1-point items can be deferred, with one encryption exception, so everything worth more must be done before you assess. Two requirements have a sliding value: multi-factor authentication (3.5.3) and encryption validated under the Federal Information Processing Standards, or FIPS (3.13.11).

What the 110 Level 2 requirements are worth

Number of requirements by the points subtracted when one is not met

Must be met on assessment dayCan go on a plan of action, with exceptions
Worth 5 points42
Worth 3 points14
Worth 3 or 5 points (3.5.3 and 3.13.11)2
Worth 1 point52
42 + 14 + 2 + 52 = 110. Multi-factor authentication for remote and privileged users only (3.5.3) costs 3 points instead of 5; encryption that is not FIPS-validated (3.13.11) costs 3 and is the only higher-value item allowed on a plan of action. Source: 32 CFR 170.21 and 170.24.

The 5-point list includes access control (3.1.1, 3.1.2), security training (3.2.1, 3.2.2), creating and keeping logs (3.3.1), correlating log review (3.3.5), identification and authentication (3.5.1, 3.5.2), incident handling (3.6.1, 3.6.2), malware protection (3.14.2) and monitoring for attacks (3.14.6).

7. Turn on logging and monitoring. The Audit and Accountability family (3.3.1 to 3.3.9), together with 3.14.6 and 3.14.7, needs logs from every in-scope system, tied to individual users, correlated across sources and reviewed. At any real scale that means a SIEM. Our guide to CMMC SIEM requirements covers what each requirement asks and how many points it carries.

8. Check your cloud and service providers. If a cloud service will store, process or transmit CUI, DFARS 252.204-7012 requires it to meet security requirements equivalent to the Moderate baseline of the Federal Risk and Authorization Management Program (FedRAMP). Managed service providers and security tools are in scope too. Record each one in your SSP with a customer responsibility matrix that says which requirements they cover.

Stage 3: Prove

9. Score yourself with the DoD method. Start at 110 and subtract the value of every requirement not met. The score can be negative.

10. Post the result in SPRS and affirm it. The entry includes the level, date, scope, your Commercial and Government Entity (CAGE) codes and the score. A senior official of your company must affirm compliance after every assessment and every year after that.

11. Use a plan of action and milestones (POA&M) only within the rules. For Conditional Level 2 status, all of these must be true:

  • Your score is at least 80 percent of the maximum: 88 of 110.
  • Every item on the plan is worth 1 point, except 3.13.11 when encryption is used but not FIPS-validated.
  • None of these are on the plan: 3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4 or 3.10.5.
  • Every item is closed and confirmed within 180 days, or the conditional status expires.

Level 1 allows no plan of action at all.

Stage 4: Keep

12. Stay compliant between assessments.

  • Reaffirm in SPRS every year. Repeat a Level 1 self-assessment every year and a Level 2 assessment every 3 years.
  • Keep the evidence used in each assessment for six years.
  • Report cyber incidents to DoD within 72 hours, and keep images and monitoring data for at least 90 days after the report (DFARS 252.204-7012).
  • Flow the right requirements down to subcontractors that handle FCI or CUI (32 CFR 170.23).
  • Update the SSP when systems, people or providers change.

Common mistakes

  • Reading the suspension as a pause on security. DFARS 252.204-7012 and your SPRS affirmation still apply today.
  • Leaving security tools out of scope. Your SIEM and remote management tools are Security Protection Assets, and a managed service provider that handles your CUI or security data is an external service provider you must document.
  • Posting a score you cannot support. An affirmation is a statement to the government. Base the score on evidence.
  • Planning to defer 5-point items. They cannot go on a plan of action.
  • Treating logging as a checkbox. Collecting logs without correlation and review misses 3.3.5, which alone is worth 5 points.

How UTMStack fits

We build UTMStack, so weigh our view accordingly. UTMStack collects logs from Windows and Linux systems, domain controllers, firewalls, Microsoft 365 and the main cloud platforms, correlates every event against more than 600 detection rules as it arrives, and turns alerts into incidents you can track to closure. That supports the collection, correlation, monitoring and incident-tracking work in steps 7 and 12.

The compliance module evaluates CMMC 2.0 controls from your own logs and keeps the evidence that decided each one. The CMMC 2.0 framework is included in the free Community edition. UTMStack can run on your own servers inside a CUI enclave, including networks with no internet access, so logs that may contain CUI never leave it. UTMStack Cloud is not FedRAMP authorized, so if your logs may contain CUI, run UTMStack yourself. Remember that the SIEM is a Security Protection Asset, so list it in your SSP.

Explore UTMStack on sample data in the live demo, or install the free edition. For the full requirement set, read our guide to CMMC compliance requirements.

Frequently asked questions

What should a CMMC compliance checklist include? Identifying FCI and CUI, confirming your level, scoping assets, writing the SSP, closing gaps against NIST SP 800-171 (5-point items first), scoring with the DoD method, posting in SPRS, affirming every year and keeping evidence for six years.

Is CMMC Phase 2 delayed? Yes. On July 13, 2026, the Department suspended Phase 2, which was due on November 10, 2026, along with later milestones. A September 3, 2026 class deviation limits new requirements to Level 1 (Self) and Level 2 (Self). No new date had been announced at the time of this update.

How many requirements are in CMMC Level 2? 110, identical to NIST SP 800-171 Revision 2. CMMC has not adopted Revision 3.

What score do I need for CMMC Level 2? 110 of 110 for a Final status. A Conditional status needs at least 88, with only 1-point items (plus one encryption exception) on a plan of action closed within 180 days.

Can I self-assess for CMMC Level 2? Yes, when the contract asks for Level 2 (Self). During the Phase 2 suspension that is the highest Level 2 requirement contracting officers can include.

How long does a CMMC status last? Level 2 and Level 3 statuses last three years, with an affirmation every year. Level 1 requires a new self-assessment and affirmation every year.

Sources

Keep reading