CMMC 2.0 Level 2 Requirements for Ohio Defense Contractors

NIST 800-171 obligations apply now for Department of Defense contractors handling Controlled Unclassified Information (CUI); CMMC Level 2 certification timing is under review. As of July 2026, third-party CMMC Level 2 certification (CMMC Phase 2) is suspended pending review, while NIST 800-171 and DFARS 252.204-7012 obligations remain in force. For Ohio manufacturers and defense contractors in the DoD supply chain, the practical path is to get NIST 800-171 right now and stay ready for certification. This guide explains what Level 2 requires, how assessments work, and how Ohio contractors should prepare.

What CMMC 2.0 Level 2 Requires

CMMC 2.0 Level 2 aligns to the 110 security practices in NIST SP 800-171. These practices span 14 domains: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Every one of the 110 practices must be implemented and documented. Unlike Level 1 (which allows self-assessment), Level 2 contracts handling sensitive CUI require a third-party C3PAO assessment — you cannot self-certify.

The System Security Plan (SSP)

The cornerstone of CMMC Level 2 compliance is the System Security Plan — a written document describing your organization's information systems, the security requirements applicable to each, and how those requirements are implemented. The SSP must cover every system that stores, processes, or transmits CUI. Without a complete SSP, C3PAO assessors cannot evaluate your environment.

Plan of Action & Milestones (POA&M)

If any of the 110 NIST 800-171 practices are not yet fully implemented, they must be documented in a Plan of Action & Milestones (POA&M). The POA&M identifies each open finding, the remediation action, the responsible party, and the target completion date. CMMC regulations allow POA&Ms for some deficiencies, but certain high-priority practices cannot have open POA&Ms at the time of assessment.

How Securafy Supports CMMC Level 2

Securafy's Comply-CARE tier includes all 110 NIST 800-171 practices implemented and documented, SSP development and maintenance, POA&M management, quarterly automated penetration testing, and C3PAO assessment preparation support. We have supported Ohio defense contractors through the full CMMC readiness process — from initial gap assessment through final assessment preparation.

Frequently Asked Questions

When is CMMC 2.0 Level 2 required for Ohio defense contractors?

CMMC 2.0 requirements began appearing in select DoD contracts, but as of July 2026 third-party CMMC Level 2 certification (CMMC Phase 2) is suspended pending review. NIST 800-171 and DFARS 252.204-7012 obligations apply now; CMMC Level 2 certification timing is under review. Ohio defense contractors should get NIST 800-171 in place now — readiness takes 6–18 months — so they are prepared whenever certification is required.

What is the difference between CMMC Level 1 and Level 2?

CMMC Level 1 requires 17 basic cybersecurity practices and allows annual self-assessment. Level 2 requires all 110 NIST SP 800-171 practices and requires triennial third-party assessment by a certified C3PAO for contracts involving sensitive CUI. Level 2 is significantly more rigorous than Level 1.

What is a C3PAO and how do I find one?

A C3PAO (Certified Third-Party Assessment Organization) is an organization authorized by the CMMC Accreditation Body (CyberAB) to conduct official CMMC Level 2 assessments. You can find authorized C3PAOs through the CyberAB marketplace. Securafy can help you prepare your environment for assessment and coordinate with your chosen C3PAO.

How long does CMMC Level 2 assessment take?

The assessment process typically takes 3–6 months from engagement with a C3PAO, depending on the scope of your CUI environment. Preparation — getting your SSP documented, all 110 practices implemented, and your POA&M addressed — typically takes 6–18 months before you are ready for assessment. Starting early is critical.