CMMC Level 2 and Your SPRS Score, Explained for Small Defense Subcontractors

Why a small subcontractor is in scope

Prime contractors pass defense requirements down the supply chain. If your company stores, processes or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) while working on a Department of Defense (DoD) contract, even as a sub of a sub, the CMMC rule in 32 CFR 170.3 applies to you. Machine shops, engineering firms, software vendors and IT providers get pulled in this way. The prime must flow the right level down to you based on the information you will handle.

Three terms matter. FCI is information the government gives you or you generate under a contract that is not meant for the public. CUI is a narrower category of sensitive information, such as export-controlled technical drawings, that the government marks for protection. SPRS, the Supplier Performance Risk System, is the DoD system where contractors post assessment scores and CMMC status, and where contracting officers look before awarding.

The three CMMC levels

• Level 1: 15 basic safeguarding requirements for FCI, a yearly self-assessment, and an annual affirmation. No plan of action is permitted.
• Level 2: the 110 requirements of NIST SP 800-171 Rev. 2 for CUI. Depending on the contract, it is a self-assessment (every three years) or a certification assessment by a C3PAO (also every three years), with annual affirmation either way.
• Level 3: a subset of NIST SP 800-172 requirements on top of Level 2, assessed by the government (DCMA DIBCAC). It applies to a small set of the most sensitive programs.

Most small subcontractors that handle CUI are looking at Level 2. The contract solicitation says which form applies: CMMC Level 2 (Self) or CMMC Level 2 (C3PAO). Do not guess. Ask the prime, and read the solicitation.

The source documents: NIST SP 800-171 and 800-171A

NIST SP 800-171 lists the security requirements for protecting CUI in nonfederal systems, grouped into 14 families such as access control, incident response and system and communications protection. NIST SP 800-171A breaks each requirement into assessment objectives, the specific things an assessor checks. A requirement is MET only when every applicable objective is satisfied by evidence in final form, not drafts.

NIST published Revision 3 of 800-171 in 2024 and withdrew Revision 2 on May 14, 2024. The CMMC rule, however, incorporates Revision 2 by reference in 32 CFR 170.2, so Revision 2 is still what you are assessed against. Do not rebuild your program around Revision 3 for CMMC purposes unless the DoD changes the rule.

How the SPRS score works

The scoring comes from the NIST SP 800-171 DoD Assessment Methodology, which DFARS 252.204-7019 and 252.204-7020 tie to contracts. You begin with 110 points. For each requirement not implemented you subtract a weight: 5 for requirements judged to have the largest effect on security, 3 for mid-level ones, 1 for the rest. Some requirements have partial credit, for example multi-factor authentication, which loses fewer points if applied to remote and privileged access but not to every user. If every requirement fails, the arithmetic reaches -203.

A system security plan (SSP) is a precondition. If you have no SSP covering the scope, an assessment cannot produce a score at all. The score you post covers a defined scope, the systems that handle CUI, together with your CAGE codes and the date the score was calculated.

Two cautions. First, a self-score is a statement to the government. Inflating it is the kind of thing that attracts False Claims Act attention, and the DoD can verify with a DIBCAC assessment. Second, the CMMC scoring in 32 CFR 170.24 follows the same idea for Level 2, but your CMMC status, not just the number, is what contracts will check.

Conditional status and the plan of action

You do not have to be perfect on day one, but the room is narrow. Under 32 CFR 170.21, a Conditional Level 2 status is possible only if all of these hold:

• Your score divided by 110 is at least 0.8, which means a score of 88 or higher.
• Every requirement on the plan of action and milestones (POA&M) is worth one point. The one exception is the CUI encryption requirement (SC.L2-3.13.11), which may be on the POA&M if you encrypt but the encryption is not FIPS-validated.
• None of six named requirements is on the POA&M: external connections (3.1.20), control of public information (3.1.22), the system security plan (3.12.4), and the three physical-access items on visitor escort, access logs and physical access (3.10.3, 3.10.4, 3.10.5).

Then the clock starts. You must close every POA&M item and have a closeout assessment within 180 days of the status date. For a self-assessment you do the closeout yourself and post the result in SPRS. For a C3PAO assessment the C3PAO must perform the closeout. Miss the 180 days and the conditional status expires, standard contract remedies apply, and you cannot receive new awards that need that level until you earn a new status.

Self-assessment or C3PAO

A self-assessment is done by your own staff or a consultant you hire, using the 800-171A objectives, and results go into SPRS. A certification assessment is done by a C3PAO that has been authorized through the Cyber AB, the accreditation body, and results are entered into the CMMC eMASS system and passed to SPRS. Both end in a status with a date: Final Level 2 (Self), Final Level 2 (C3PAO), or the Conditional version of each. Keep the evidence. 32 CFR 170 requires assessment artifacts to be retained for six years.

Hiring a consultant to help you prepare does not make a certification assessment. The C3PAO must be a different party from whoever helped you remediate, so plan the order of work early.

Annual affirmation

Under 32 CFR 170.22, an affirming official, the senior person with authority to commit the company, must affirm continuing compliance in SPRS after each assessment, after a POA&M closeout, and annually after that. Name that person now. They are making a statement on behalf of the company, so they need to see real evidence, not a summary slide.

Phased rollout in contracts

32 CFR 170.3(e) describes four phases. Phase 1 starts on the effective date of the DFARS rule, November 10, 2025: Level 1 or Level 2 self-assessment status as a condition of award where a solicitation requires it, with the option to ask for a C3PAO status instead. Phase 2 begins one calendar year later, which works out to November 10, 2026, and adds the C3PAO requirement as a condition of award. Phase 3 follows a year after that and extends requirements to option periods and Level 3. Phase 4 is full implementation. The DFARS rule also says that, until three years after its effective date, a program manager or requiring activity decides whether to apply CMMC to a contract. The dates and discretion are the DoD's, so confirm the current schedule with each prime and in each solicitation.

A practical order of work

• Decide your scope: which systems, people and locations touch CUI. A smaller, well-bounded enclave is cheaper to defend and to assess than the whole company.
• Write or update the system security plan, then score yourself honestly against 800-171A objectives.
• Fix the high-weight and no-POA&M items first: encryption of CUI, multi-factor authentication, physical access records, the SSP itself.
• Decide what can legitimately sit on a POA&M and close it inside 180 days.
• Post the score and status in SPRS, name the affirming official, and calendar the annual affirmation.
• Ask each prime which level your contract needs and whether any cloud service you use has to meet extra requirements for CUI.

If you want a readiness review done as scoped, authorized work, with an honest gap list and a remediation plan you can show a prime, ask about our Cybersecurity service. We assess and help you fix; we do not assess ourselves as a C3PAO or promise an outcome.

Sources

• 32 CFR Part 170, Cybersecurity Maturity Model Certification (CMMC) Program (eCFR)
• Cybersecurity Maturity Model Certification (CMMC) Program, final rule, 89 FR 83092 (Federal Register, October 15, 2024)
• DFARS: Assessing Contractor Implementation of Cybersecurity Requirements, 90 FR 43560 (Federal Register, September 10, 2025)
• DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
• DFARS 252.204-7020, NIST SP 800-171 DoD Assessment Requirements
• DFARS 252.204-7021, Contractor Compliance with the CMMC Level Requirements
• NIST SP 800-171 Rev. 2, Protecting CUI in Nonfederal Systems and Organizations (NIST CSRC)
• NIST SP 800-171A, Assessing Security Requirements for CUI (NIST CSRC)
• NIST SP 800-171 Rev. 3 (NIST CSRC)
• Safeguarding Covered Defense Information: NIST SP 800-171 DoD Assessment Methodology (Office of the Under Secretary of Defense for Acquisition and Sustainment)

This article is general information, not legal, contracting or technical advice for your environment. CMMC rules, dates and phase-in decisions are set by the Department of Defense and your contract; confirm them with your prime and contracting officer. Last reviewed November 9, 2026.

Next article

Next · InfrastructureHow to Run a Microsoft 365 Restore Test: What to Measure, What Retention Does Not CoverMost companies assume Microsoft 365 keeps their data safe. It protects the service, but not every way you can lose your data. A restore test shows the gap while it is still cheap to fix. Here is how to run one and what to write down.8 min read

Related reading

• RegulationK-12 Student Data Security: FERPA, COPPA and CIPA in Plain Words, and How to Vet an Edtech Vendor8 min
• RegulationWhat a CMMC Level 2 Assessor Examines, Asks and Tests: Evidence and Six-Year Retention9 min