CMMC Level 2 Readiness
If your organization handles Controlled Unclassified Information (CUI), CMMC Level 2 certification is required to win and keep DoD contracts. KSG takes you from gap assessment all the way to a successful C3PAO certification.
Phase 2 begins Nov 10, 2026 Mandatory third-party (C3PAO) Level 2 assessments arrive in applicable DoD contracts in months - not years. Readiness now is the difference between bidding and sitting out.
Understanding CMMC Level 2
The Cybersecurity Maturity Model Certification (CMMC) Level 2 aligns to the 110 security requirements of NIST SP 800-171 and is verified by an accredited third-party assessor (C3PAO). It protects CUI across the Defense Industrial Base.
110 Controls
Level 2 maps directly to all 110 NIST SP 800-171 security requirements across 14 control families.
Protects CUI
Required for contractors that store, process, or transmit Controlled Unclassified Information.
C3PAO Verified
Independent assessment by a Certified Third-Party Assessment Organization, every three years.
The CMMC Clock Is Ticking
The CMMC acquisition rule (48 CFR / DFARS) took effect November 10, 2025. Requirements phase into DoD contracts over three years - and the jump to mandatory third-party certification is close.
Self-Assessments
Since Nov 10, 2025, applicable contracts require a Level 1 or Level 2 self-assessment - with DoD discretion to demand C3PAO certification on priority awards.
Mandatory C3PAO
Most CUI contracts will require a certified third-party Level 2 assessment as a condition of award. This is the deadline that matters for the ~8,350 entities in scope.
Level 3 Added
CMMC Level 3 assessment requirements begin appearing for the most sensitive programs handling CUI.
Full Implementation
CMMC requirements apply across all applicable DoD solicitations, contracts, and option years.
A typical readiness-to-certification effort runs 6–12 months. Starting now is what keeps you eligible when Phase 2 lands.
Your Path to CMMC Level 2
CMMC Level 2 is built on the 110 controls of NIST SP 800-171 and protects Controlled Unclassified Information (CUI).
Scope & Gap Assessment
Define the CUI boundary and assess against all 110 controls.
SSP & POA&M
Document your System Security Plan and remediation plan.
Remediate
Implement technical and policy controls to close gaps.
Pre-Assessment
Mock audit to validate readiness before the C3PAO.
Certification
Support through the C3PAO assessment and beyond.
110 Controls Across 14 Families
CMMC Level 2 mirrors NIST SP 800-171. We assess and remediate every control family - then translate your posture into the SPRS score DoD expects to see.
Access Control
22 controls
Awareness & Training
3 controls
Audit & Accountability
9 controls
Configuration Mgmt
9 controls
Identification & Auth
11 controls
Incident Response
3 controls
Maintenance
6 controls
Media Protection
9 controls
Personnel Security
2 controls
Physical Protection
6 controls
Risk Assessment
3 controls
Security Assessment
4 controls
System & Comms Protection
16 controls
System & Info Integrity
7 controls
We don't just hand you a spreadsheet of gaps. KSG implements the controls, writes the evidence, and prepares your team for the assessor's questions.
Check Your SPRS Score in Minutes
Score all 110 NIST SP 800-171 controls with the official DoD Assessment Methodology weights and get your SPRS baseline instantly. Enter your name and work email to unlock the free self-assessment calculator.
Launch the Free SPRS CalculatorWhy Choose KSG for CMMC
As an ISO 27001-certified firm with deep federal cybersecurity experience, we know what assessors look for - and how to get you ready efficiently.
- ✓Full scoping of your CUI environment to right-size the assessment boundary.
- ✓Gap assessment against all 110 NIST 800-171 controls with a clear scorecard.
- ✓System Security Plan (SSP) and POA&M development and management.
- ✓Hands-on remediation of technical, policy, and documentation gaps.
- ✓Mock pre-assessment and evidence preparation before your C3PAO audit.
Outcomes
- ✓Eligibility to win and retain DoD contracts requiring CMMC L2.
- ✓A defensible SSP and a realistic, prioritized remediation roadmap.
- ✓Confidence walking into your C3PAO assessment.
- ✓A sustainable program for continuous compliance.
The Same Controls, Proven on Federal Missions
CMMC Level 2 is NIST 800-171 by another name - and 800-171 assessment, A&A, and remediation is exactly what KSG has delivered for federal and state agencies since 2016.
Assessment & Authorization
Security & privacy controls assessment, IV&V, and continuous monitoring for DOI ONRR, PBGC, FDIC, and the AO of the U.S. Courts.
SSP & POA&M Discipline
POA&M management and trend analysis, enterprise common control management, and FISMA program maturity - the same artifacts a C3PAO will ask for.
Led by Certified Practitioners
A leadership bench holding CISSP, CISA, and CRISC, backed by ISO 27001-certified delivery processes.
Start your CMMC Level 2 journey
Book a readiness consultation and get a clear picture of where you stand.
Get in TouchMore on CMMC Level 2
Practical guidance from our CMMC Level 2 practice.
CMMCReaching CMMC Level 2: A Practical Assessment-Readiness Roadmap
Mandatory C3PAO assessments arrive November 10, 2026. Here is the six-step path from "we think we're close" to a certificate you can put in a proposal, without the costly missteps.
Read article →Self-Assessment vs. C3PAO: What Changes at CMMC Phase 2
The jump from a self-attestation to a certified third-party assessment is the moment CMMC gets real. Here is what changes, and how to be ready.
Read article →Your SSP Is the Spine of a CMMC Assessment - Write It Like One
The System Security Plan is the most scrutinized artifact in a CMMC assessment. A thin or inaccurate SSP can fail you on its own.
Read article →Insights from every practice
One highlight from each of our other capability areas.
The ISSO Playbook: Keeping Federal Systems Audit-Ready
The Information System Security Officer is the connective tissue of a security program. A repeatable playbook turns a reactive role into a proactive one.
Read article →
CybersecurityZero Trust in Practice: A Phased Rollout for Government Networks
Zero Trust is a journey, not a switch. A phased approach aligned to federal guidance turns a daunting mandate into achievable milestones.
Read article →C-SCRM: Managing the Risk You Inherit From Your Supply Chain
Your security posture includes the posture of everyone you depend on. Cybersecurity Supply Chain Risk Management makes inherited risk visible and governable.
Read article →DR and COOP in the Cloud: Designing for the Day Things Break
Disaster recovery and continuity planning are insurance you hope never to use. The cloud makes good plans cheaper, but only if you design and test them deliberately.
Read article →
AIGoverned AI: Putting Copilot to Work Securely in Government
Agencies want AI's speed; security teams fear the exposure. The way through isn't a better chatbot, it's refusing to treat AI as a standalone tool in the first place.
Read article →