CMMC Level 2 readiness for small defense suppliers: where to start

Start with scope, not tools

Many small suppliers begin CMMC by shopping for software. That is backward. Your effort and cost depend almost entirely on where Controlled Unclassified Information (CUI) lives and who touches it, so map that first.

Answer these questions in writing:

1. Which of your contracts or purchase orders include DFARS 252.204-7012 or 252.204-7021?
2. What do you receive from your prime or the government: drawings, specifications, test data, schedules?
3. Is any of it marked CUI or labeled with a restrictive distribution statement?
4. Where does it land: email, file shares, laptops, CAD workstations, USB drives, shop-floor machines?
5. Which people need it to do their jobs, and which outside services store it?

Then sketch a simple data flow: how CUI arrives, where it is stored, who works on it and how it leaves. The CMMC scoping guidance sorts assets into categories such as CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets. The practical rule: anything that stores, processes or transmits CUI is in scope, and so is anything that protects it or can reach it without real separation.

If you only handle Federal Contract Information (FCI), you are looking at Level 1 and the 15 safeguarding requirements in FAR 52.204-21, not the full 110. Our FCI vs CUI guide explains the difference and what to ask your prime.

The enclave idea

An enclave is a separate, tightly controlled environment where all CUI work happens. Everything else in the business stays outside it. Instead of bringing every office laptop, the front-desk computer and the guest Wi-Fi up to Level 2, you protect a smaller set of accounts, devices and storage.

Common shapes for a small shop:

• Cloud enclave: a government-cloud edition of a productivity suite or a dedicated virtual desktop service, used only by the people who handle CUI.
• Local enclave: a few dedicated workstations on their own network segment, with no general web browsing or personal email.
• Hybrid: cloud storage and email for CUI, plus a small set of hardened engineering workstations.

The benefits are fewer systems to document, fewer users to train deeply, and a clearer boundary for a future assessor. The tradeoff is that staff must follow a second workflow, and CUI leaks out of enclaves through habits like forwarding a drawing to a personal account or saving it to an unmanaged laptop. A good enclave design makes the right path the easy one. Segmentation is part of that, and our network segmentation guide covers the network side.

The 110 requirements in 14 families

Level 2 maps to the 110 security requirements in NIST SP 800-171 Rev. 2, grouped into 14 families. Its companion, NIST SP 800-171A, breaks them into 320 assessment objectives, which is what an assessor actually checks. Both are free at csrc.nist.gov.

• Access Control: who can reach what, remote access, mobile devices.
• Awareness and Training: people know their security duties.
• Audit and Accountability: logs exist, are protected and get reviewed.
• Configuration Management: baselines, approved software, change control.
• Identification and Authentication: unique accounts, multifactor authentication.
• Incident Response: a plan, testing and reporting.
• Maintenance: controlled maintenance and remote maintenance sessions.
• Media Protection: USB drives, printouts, sanitizing before disposal.
• Personnel Security: screening and offboarding.
• Physical Protection: limiting and logging physical access.
• Risk Assessment: periodic risk and vulnerability assessment.
• Security Assessment: checking your controls and maintaining the SSP.
• System and Communications Protection: boundaries, encryption, separation.
• System and Information Integrity: patching, malware protection, security alerts.

Read each requirement and its assessment objectives together. Many gaps come from doing most of a requirement but missing one objective, such as defining who reviews logs and how often.

Write the SSP and POA&M

The System Security Plan (SSP) describes your in-scope environment and how each requirement is met. Having one is itself a requirement (NIST SP 800-171 3.12.4). Under the DoD Assessment Methodology, an assessment cannot be completed without one. A usable SSP for a small company includes:

• The system boundary and a network diagram
• An inventory of in-scope hardware, software and cloud services
• Roles: who owns security decisions and who administers systems
• For each of the 110 requirements: implemented, partially implemented or not implemented, and how
• References to policies, procedures and evidence

The Plan of Action and Milestones (POA&M) lists each gap, the fix, an owner and a target date. Under the CMMC rule, POA&M items are allowed only for certain lower-weighted requirements, the score must reach at least 88 of 110 for conditional status, and open items must be closed within 180 days. Most higher-weighted requirements, multifactor authentication among them, cannot sit on a POA&M.

Write the SSP to match reality. An honest "not implemented" with a dated plan is far better than a polished document describing controls that do not exist.

Score yourself, post to SPRS and keep evidence

Under DFARS 252.204-7019 and 252.204-7020, suppliers with 7012 obligations already need a current NIST SP 800-171 self-assessment score in the Supplier Performance Risk System. The DoD Assessment Methodology starts at 110 and subtracts 1, 3 or 5 points for each requirement not met, so scores can fall well below zero. Scores are entered in SPRS through the PIEE portal, and CMMC adds an annual affirmation by a senior company official.

That affirmation matters. The Department of Justice has used the False Claims Act against contractors that misrepresented their cybersecurity, so the number you post should be one you can defend.

Evidence checklist. Start a folder now and add to it monthly:

• Current SSP, POA&M and network diagram
• User list with roles, plus records of access reviews
• Multifactor authentication settings, exported or captured
• Training completion records
• Dated log reviews with the reviewer's name
• Patch and vulnerability scan reports
• Incident response plan and notes from your last tabletop exercise
• Visitor logs and media sanitization records

What drives the cost of a cloud enclave

Prices change and depend on your setup, so here are the drivers rather than numbers:

• Number of CUI users. Licensing is usually per user, so keeping the enclave small matters most.
• Licensing tier. Under DFARS 7012, cloud services that store CUI generally must meet FedRAMP Moderate or an equivalent baseline, and those editions typically cost more than commercial plans.
• Endpoint management. Devices that access CUI need consistent settings, encryption and patching.
• Logging and retention. Keeping and reviewing logs takes storage and staff time.
• Migration. Moving existing files and email, then cleaning up copies left behind.
• Engineering software. CAD and machine programming tools sometimes run poorly in virtual desktops, which can push you toward a hybrid.
• People time. Policies, training and the recurring reviews.
• A future third-party assessment, if your contracts eventually require one.

The Phase 2 suspension and why to keep preparing

On July 13, 2026, DoD announced that CMMC Phase 2, planned for November 10, 2026 and meant to begin mandatory Level 2 third-party assessments by C3PAOs, is suspended pending a review. No replacement date has been announced. Phase 1 continues: Level 1 and Level 2 self-assessments with annual affirmations in SPRS.

Reasons to keep going:

• DFARS 252.204-7012 and the 110 requirements of NIST SP 800-171 Rev. 2 still apply to contracts that include them.
• Your SPRS score and affirmations are still required and still carry legal weight.
• Primes may still ask subcontractors about readiness when choosing suppliers.
• Readiness takes months. If the suspension lifts on short notice, starting then is too late.

This is changing, so check your contract and the DoD CIO CMMC site for current status. If you supply work connected to the base, see CMMC for Vandenberg defense suppliers.

Keith Systems provides readiness help only. We are not a C3PAO or a CMMC assessor, and we do not certify anyone. We help you scope, close gaps and prepare documentation. See our CMMC and NIST 800-171 readiness service, book a free security consult, or call (805) 800-8163.