CMMC readiness · NIST SP 800-171 Rev 2
On 13 July 2026 the department suspended Phase 2, the point at which contracts would have started to require Level 2 (C3PAO) certification. Where your contract carries DFARS 252.204-7012 or -7021 and CUI sits on your systems, the 110 requirements, the SPRS score and your Affirming Official's annual affirmation still apply. We get you to a score you can defend and stop before certification.
Status as of 11 October 2026
The SPRS score scale for CMMC Level 2. The maximum is 110, Final status, with every requirement MET. 88 is the Conditional floor, 0.8 times 110, and counts only if every open item is eligible for a POA&M. Each requirement NOT MET subtracts 5, 3 or 1 points. The lowest possible score is minus 203, derived from the weights in 32 CFR 170.24. Without a current system security plan the assessment cannot be completed. A score of 88 or more is necessary, not sufficient.
Status · 11 October 2026
Since 16 July 2026, DFARS Class Deviation 2026-O0025 (now Revision 3, 3 September 2026) has directed contracting officers to remove or revise CMMC requirements in new and existing solicitations and contracts, so contracts ask for no more than Level 1 (Self) or Level 2 (Self).
CIO memo · 13 Jul 2026
Phase 2, the point at which contracts would have started to require Level 2 (C3PAO) certification. Pending and future CMMC milestones are held in abeyance until further notice, and no new Phase 2 date has been announced.
Deviation Rev 3 · 3 Sep 2026
Where DFARS 252.204-7012 or -7021 is in the contract and CUI sits on your systems: the 110 requirements of NIST SP 800-171 Rev 2, the SPRS score and the annual affirmation. DCMA can still run a Medium or High assessment under DFARS 252.240-7997, and its result takes precedence over yours in SPRS.
Cyber AB statement · 15 Jul 2026
Voluntary C3PAO certification. Level 2 certification assessments continue, and a Level 2 (C3PAO) result also satisfies Level 2 (Self).
When teams bring us in
Each one starts with a sentence we hear almost word for word. If one of them is yours, here is what we do about it.
A score with no working
Our SPRS score was posted years ago and nobody here can show how it was worked out.”
The person who scored it has moved on, the working was never kept, and your Affirming Official still affirms every year.
What we do
We assess the 110 requirements again from the evidence, score them with the working shown, and tell you plainly whether the posted score still holds.
A voluntary certification
We have booked a C3PAO assessment and we need to know we will pass.”
Certification is voluntary during the suspension, and you have chosen to go ahead. A Level 2 (C3PAO) result also satisfies Level 2 (Self), and a Conditional result starts 180 days to close out the POA&M.
What we do
We run a mock assessment the way an assessor would, close what it finds, and keep any POA&M inside the rules before the C3PAO arrives.
A government assessment
DCMA has scheduled a Medium assessment, and its score will replace ours in SPRS.”
A DCMA Medium or High assessment under DFARS 252.240-7997 posts its result to SPRS, and that result takes precedence over your self-assessment.
What we do
We check each requirement against its assessment objectives before DCMA does, so the evidence behind every MET is ready to hand over.
CUI in the wrong cloud
Our CUI sits in commercial Microsoft 365 and we are not sure that is allowed.”
Microsoft's own guidance points CUI to GCC High. Moving the whole company is a large change; moving only the CUI into an enclave is often a smaller one.
What we do
We make the enclave decision with you during scoping, GCC High included, and configure the tenant the CUI ends up in against the 110 requirements.
Microsoft 365 E5 securityFCI or CUI
The prime says we only handle FCI, and we need to know whether Level 1 is enough.”
Level 1 is 15 requirements with no POA&M. Level 2 is 110, with an SSP. The answer depends on the information the prime actually sends you.
What we do
We confirm whether what you hold is CUI or FCI before any other work starts, so you prepare for the level your contracts actually need.
Every engagement stops at assessor-ready.
The assessment that counts always belongs to someone else.
Scoping · 32 CFR 170.19
At Level 2 every asset falls into one of five categories, and each category is assessed differently. The boundary you draw sets how much of the company the assessment has to cover, which is why we decide it before any remediation.
Step zero
Confirm whether what the prime sends you is CUI or FCI.
CUI puts you at Level 2 and in the five categories here. FCI alone means Level 1, where only the assets that process, store or transmit FCI are in scope and Specialized Assets sit outside it.
Every in-scope category goes into the asset inventory, the SSP and the network diagram.
Assessment depth
Process, store or transmit CUI.
Assessed against all Level 2 security requirements.
Provide security functions or capabilities to the assessment scope.
Assessed against the Level 2 requirements relevant to the capabilities they provide.
Can, but are not intended to, handle CUI because of your policies, procedures and practices. They need not be separated from CUI Assets.
The assessor reviews the SSP. If they are documented well enough, they are not assessed against other requirements; questions can prompt a limited check that must not materially add time or cost.
Can process CUI but cannot be fully secured: IoT, IIoT, OT, government-furnished equipment, restricted information systems and test equipment.
The assessor reviews the SSP and does not assess them against other requirements. You show they are managed under your risk-based policies.
Cannot process, store or transmit CUI and give no security protection to CUI Assets, separated physically or logically. An asset in any in-scope category cannot be out of scope. A VDI client limited to keyboard, video and mouse is out of scope.
Outside the assessment. Be ready to justify the separation.
The method
Eight pieces of work, in order. Each one ends on a decision that stays yours: carry on with us, take it in-house, or stop where you are.
We read the contract clauses and what the prime sends you, and confirm whether you hold CUI or only FCI. That settles Level 2 or Level 1 before anything else starts.
Every asset sorted into the five categories in 32 CFR 170.19, and a decision with you on whether CUI moves into an enclave, GCC High included.
Each requirement of NIST SP 800-171 Rev 2 checked against its objectives in SP 800-171A: we examine the documents, interview the people who run the control, and test it.
Every MET and NOT MET carries its objectives and its evidence, so anyone can trace the SPRS score line by line.
We close the gaps with your team and write the system security plan inside the engagement, from the record the assessment built.
How we write the SSPOnly the items 32 CFR 170.21 allows go on it, the score stays at 88 or above, and each item carries a closing date inside 180 days.
A full pass over the SSP as written, using the same examine, interview and test methods, before the assessment that counts.
Evidence ready for the Affirming Official, and the closeout assessment held inside 180 days, before Conditional status expires.
The affirmation · 32 CFR 170.22
Your Affirming Official, a senior level representative of your organisation, affirms in SPRS after every assessment, after any POA&M closeout and every year.
We give the official the evidence behind every MET before they sign.
POA&M and scoring · 32 CFR 170.21 and 170.24
Conditional Level 2 status lets a contract award go ahead while a few items are still open on a POA&M. 32 CFR 170.21 decides which items can be open.
The score must reach 0.8 of the maximum, which is 88 of 110. Each requirement NOT MET subtracts 5, 3 or 1 points. Reaching 88 is necessary, not sufficient: every open item must also be eligible for a POA&M, and a POA&M is never a substitute for a completed requirement.
A POA&M item may be worth no more than one point. The single exception is SC.L2-3.13.11: where encryption is used but is not FIPS-validated it costs three points, and it can then sit on a POA&M. Multi-factor authentication, IA.L2-3.5.3, costs three or five points, so partial MFA cannot sit on a POA&M.
Whatever the score, these six must be MET for Conditional status.
AC.L2-3.1.20
Verify and limit connections to external systems
Where the work sits: Your boundary and its external connections
AC.L2-3.1.22
Control CUI on publicly accessible systems
Where the work sits: Public websites, portals and shared sites
CA.L2-3.12.4
Keep a current system security plan
Where the work sits: The SSP, kept current with the system
PE.L2-3.10.3
Escort visitors and monitor them
Where the work sits: The facility where CUI sits
PE.L2-3.10.4
Keep physical access logs
Where the work sits: The facility where CUI sits
PE.L2-3.10.5
Control physical access devices
Where the work sits: The facility where CUI sits
The three PE requirements are about the building. If CUI sits in a facility you run or rent, the work starts there.
Physical security where CUI sits in a facility you run or rentEach square is one requirement. Taking every point away gives the lowest possible score: 110 minus 313 is -203.
Counts derived from the lists in 32 CFR 170.24.
A closeout assessment must take place within 180 days of the Conditional status date, or the status expires. For Level 2 (Self) you run it; for Level 2 (C3PAO), a C3PAO does.
Under the deviation, Level 2 can sit at Conditional for up to 180 days and award can occur. Level 1 needs a Final status for award.
All 15 requirements must be MET, with an annual self-assessment and an annual affirmation in SPRS.
Who assesses
Only an authorised or accredited C3PAO performs a Level 2 certification assessment (32 CFR 170.17), and only DCMA DIBCAC performs Level 3 (170.18). Today the assessment that counts is usually your own Level 2 (Self), affirmed in SPRS, and DCMA may run a Medium or High assessment that takes precedence. We prepare you for all three and sit on the assessor's side of none.
Level 2 (Self)
You, affirmed in SPRS by your Affirming OfficialUsually the one that counts today
DCMA Medium or High
DCMA, under DFARS 252.240-7997Its result takes precedence in SPRS
Level 2 (C3PAO)
An authorised or accredited C3PAOVoluntary during the suspension
Conflict of interest
Section 170.8(b)(17)(ii)(G) requires the Cyber AB to bar any CMMC ecosystem member who served as a consultant to prepare an organisation for a CMMC assessment from taking part in that organisation's Level 2 certification assessment for three years.
So the firm that prepares you stays off your certification assessment.
Australia
CMMC follows the information. An Australian subcontractor that holds CUI under a US defence contract carries the same Level 2 duties as a US one: the 110 requirements, the SSP, the SPRS score and the annual affirmation. ISO 27001, the Essential Eight and an IRAP assessment do not substitute for CMMC, and C3PAOs can run assessments outside the United States.
We run the same readiness assessment for suppliers in Australia and the United States, and where you already hold ISO 27001 or work to the Essential Eight, we reuse that evidence wherever a CMMC requirement asks the same question.
FAQ
The questions a security lead or an Affirming Official brings to a first conversation about Level 2.
A CMMC readiness assessment checks your systems against the 110 requirements of NIST SP 800-171 Rev 2 before the assessment that counts, so you know your SPRS score and what stands between you and a Conditional or Final status. We confirm whether you hold CUI or FCI, scope the assets under 32 CFR 170.19, assess each requirement against its objectives in NIST SP 800-171A, score the result with the working shown and finish with a mock assessment. It prepares you for a Level 2 (Self) affirmation, a DCMA Medium or High assessment, or a voluntary C3PAO certification, and the assessment itself stays with you, DCMA or the C3PAO.
88 out of 110 for Conditional status, and 110 for Final. Conditional status needs a score of at least 0.8 of the maximum with every open item eligible for a POA&M, and those items must close within 180 days or the status expires. Each requirement NOT MET subtracts 5, 3 or 1 points, so the score can fall as low as -203. That makes 88 necessary but not sufficient: one open requirement that cannot go on a POA&M blocks Conditional status at any score.
Six: AC.L2-3.1.20 (connections to external systems), AC.L2-3.1.22 (CUI on publicly accessible systems), CA.L2-3.12.4 (the system security plan), PE.L2-3.10.3 (escorting and monitoring visitors), PE.L2-3.10.4 (physical access logs) and PE.L2-3.10.5 (physical access devices). Beyond those six, only requirements worth one point can sit on a POA&M, with one exception: SC.L2-3.13.11 at three points where encryption is used but not FIPS-validated. Multi-factor authentication costs three or five points, so it must be MET.
No. 32 CFR 170.8(b)(17)(ii)(G) requires the Cyber AB to bar any CMMC ecosystem member who served as a consultant to prepare an organisation for a CMMC assessment from taking part in that organisation's Level 2 certification assessment for three years. We prepare you and stay on that side of the line; an authorised C3PAO with no part in your preparation runs the certification assessment.
Your Affirming Official, a senior level representative of your organisation, affirms in SPRS after every assessment, after any POA&M closeout and every year (32 CFR 170.22). The affirmation stands behind the status your assessment produced, and it has to stay fresh: under the current deviation a Final Level 2 status counts as current for up to three years only with an affirmation no older than one year. We give the official the evidence behind every MET before they sign.
Yes, where your contracts carry DFARS 252.204-7012 or -7021 and CUI sits on your systems. The suspension paused Phase 2, the point at which contracts would have started to require Level 2 (C3PAO) certification, and left the 110 requirements of NIST SP 800-171 Rev 2, the SPRS score and the annual affirmation in place. The department's CIO said it keeps enforcing NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments, and a DCMA Medium or High result takes precedence over yours in SPRS. Preparing now also keeps a voluntary C3PAO certification open, and a Level 2 (C3PAO) result satisfies Level 2 (Self).
A gap assessment finds what is missing; a mock assessment tests whether what you have will hold up in front of an assessor. The gap assessment comes first: each of the 110 requirements checked against its objectives in NIST SP 800-171A, with an SPRS score and a list of what to fix. The mock assessment comes after remediation and runs the way an assessor would, examining documents, interviewing the people who run each control and testing the controls, against the SSP as written.
Microsoft's own guidance is to use GCC High "when you handle Controlled Unclassified Information" or have DFARS or ITAR contracts. Microsoft says commercial Microsoft 365 supports CMMC Level 1 and GCC High supports Level 2 and Level 3 "when configured appropriately", and that "CMMC compliance depends on customer configuration". The cloud sets what is possible and the configuration decides the score. We make the enclave decision with you during scoping, including whether only the CUI moves to GCC High.
Alvor Advisory prepares you for it. We confirm the level, scope the assessment, assess the 110 requirements, score them with the working shown, remediate with your team, write the SSP from the same record, keep any POA&M inside the rules and run a mock assessment before the real one. An authorised C3PAO runs the certification assessment, and 32 CFR 170.8 keeps any CMMC ecosystem member who prepared you off it for three years, so we take you to assessor-ready and stop.
The work behind this
That is about as hard as this work gets. The controls have to satisfy a federal auditor, on a machine where nobody will accept security that slows the science down. The same people do the work described on this page.
Named references on request.
We publish no anonymous or invented quotes.
Tell us which clauses are in your contracts and where the CUI sits. We scope the readiness assessment in writing before any work starts, and we stop at assessor-ready.
Status as of 11 October 2026