Seven Months to CMMC Phase 2: Why Most Defense Contractors Are Behind on CMMC Level 2

Most defense contractors that handle Controlled Unclassified Information were behind on CMMC Level 2 in March 2026, because the work takes longer than the calendar allowed. Closing gaps against NIST SP 800-171 means real infrastructure changes, and a third-party assessment has to be booked on top of that. The contractors in the best position were the ones who shrank what had to be assessed before they started fixing it.

What CMMC Level 2 actually asks for

The rule is short on this point. Under 32 CFR 170.14, the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 Revision 2. That is the same standard defense contractors already owe under DFARS clause 252.204-7012, which told contractors to implement NIST SP 800-171 no later than December 31, 2017, and to report cyber incidents to the Department within 72 hours of discovery.

So CMMC Level 2 did not invent new homework. It added a way to check it. Before CMMC, most contractors graded themselves. Phase 2 was the point where an outside assessor would start doing the grading for contracts that named it.

Why the self-score was never the finish line

A self-assessment score is a claim, and the government treats it as one. Washington Technology's coverage of the September deviation put it plainly: self-attestation is still required, and there are consequences when those self-assessments fall short. A contractor that posts a strong score it cannot show evidence for is in a worse spot than one that posts an honest middling score with a plan.

The self-assessment also does not end once it is filed. Under 32 CFR 170.16, a contractor holding CMMC Level 2 (Self) status must repeat the self-assessment every three years and affirm continuing compliance at the time of each assessment and annually after that.

CMMC Level 2 terms worth knowing

The rule uses a handful of terms that decide how much work you have. These are the regulation's own definitions, in plain words.

CUI

Controlled Unclassified Information: under 32 CFR 2002.4, information the government creates or possesses, or that a contractor creates or possesses on its behalf, that law or policy says must be safeguarded. In practice it is often the drawings and technical data a customer sends you.

System Security Plan (SSP)

The document that describes your system, its boundary and how each requirement is met. 32 CFR 170.4 defines it as the formal overview of the security requirements and the controls in place or planned.

POA&M

Plan of Action and Milestones: a document listing the tasks still to be done, the resources they need and the dates they will be finished. It is how open gaps are carried after an assessment.

C3PAO

A CMMC Third-Party Assessment Organization, authorized or accredited by the Accreditation Body to conduct Level 2 certification assessments.

Out-of-scope assets

Systems that cannot process, store or transmit CUI because they are physically or logically separated from the systems that do. This is the definition that makes an enclave worth building.

Why the timeline math failed for most contractors

Three things stacked up in early 2026.

• Remediation is infrastructure work. Access control, audit logging, encryption of CUI, media protection and system integrity monitoring each change how systems are built and run. None of them is a policy you sign.
• Assessment capacity was thin. DefenseScoop reported that officials cited far more companies needing assessments than there were approved assessors to do them, and that Phase 2 was suspended after government research suggested it would push many businesses out of the defense industrial base.
• Conditional status has hard edges. Under 32 CFR 170.21, a company can only carry open items on a Plan of Action and Milestones if its assessment score is at least 80 percent of the total Level 2 requirements, and those items must be closed and confirmed within 180 days. Some requirements, including the System Security Plan, can never be on that plan at all.

Put together, a contractor starting from a weak score in March could not count on finishing remediation and getting an assessment slot by November. The suspension removed the date. It did not remove the work.

Scope reduction: the CMMC Level 2 strategy that still works

Trying to bring an entire corporate network up to NIST SP 800-171 at once is the slow road. The faster road is to decide where CUI lives and make that area small.

The scoping rule in 32 CFR 170.19 spells out the logic. CUI assets are the assets that process, store or transmit CUI, and they are assessed against every Level 2 requirement. Assets that are physically or logically separated from CUI assets, cannot handle CUI and do not protect CUI assets can be out of scope. Every system you keep away from CUI is a system you do not have to bring up to the full standard.

What a CMMC Level 2 enclave looks like in practice

• A dedicated environment for CUI work, separate from the marketing file server and the shop floor guest Wi-Fi.
• Encrypted storage, enforced multi-factor sign-in and audit logging built in from the start, not bolted on later.
• A System Security Plan and network diagram that describe that environment, because the rule requires both.
• Patching and monitoring that run on a schedule someone owns, with evidence kept for the assessor.

A worked example

Picture a machine shop where drawings from a prime arrive by email, get saved to a shared drive and are opened on the same office computers people use for invoicing. Today every one of those systems touches CUI, so every one is in scope. Now move the drawings into one dedicated environment that only the engineers and machinists who need them can reach, with its own sign-in, its own storage and its own logs. The invoicing computers and the shared drive can be separated out, and the CMMC Level 2 assessment shrinks to the enclave, the people who use it and the tools that protect it. The requirements did not get easier. There are just far fewer places they have to be met.

If CUI sits on shared systems with everything else, everything else joins the assessment. Kief Studio runs LTFI the same way for the rest of the business: each company gets its own server, kept locked down as the Harden layer describes, and patched and watched by us as the Watch layer describes.

What changed since this note was written

The program is under review, not gone. On October 27, 2026, Federal News Network reported on a summary of the reform task force's findings: over a 90-day period, the department could restart Phase 2 with a narrower population while longer-term changes go through rulemaking, and the move to NIST SP 800-171 Revision 3 is one of the options on the table. The summary it quoted describes them as options that still need approval, and as of November 4, 2026 the September deviation was still the version in force on the acquisition policy office's deviation list. The requirements stay the same and the date is open, so CMMC Level 2 work done now still counts.

What to do now that the date has moved

Use the pause as time, not as permission to stop.

1. Get an honest gap assessment. Score yourself against NIST SP 800-171 Revision 2 with evidence for each requirement. An outside check catches the claims your own team is too close to see. For your public website, the free site check on our Assess layer gives a quick first look at security basics; it is not a CMMC review.
2. Draw the CUI boundary first. Decide which people, systems and workflows touch CUI and move them into one environment before you remediate anything else.
3. Write the System Security Plan. It cannot be deferred under the conditional rules, and an assessor will start there.
4. Build to the newer standard where it costs little extra. NIST published SP 800-171 Revision 3 in May 2024. The September 2026 class deviation still names Revision 2 as the baseline, but a new build that already meets the newer text will not need rework later.
5. Talk to your primes. Their supplier requirements can move faster than the regulation does.

For a plain-language walk through what this means for a small shop, Brian Gagne's piece on CMMC requirements for small manufacturers covers the floor-level view.

The infrastructure is the strategy

There is no shortcut through the requirements. There is a difference between retrofitting controls onto systems that were never designed for them and putting CUI work into an environment that was built to meet them. The second path shortens remediation, shrinks the assessment and leaves you with evidence an assessor can read. If you process CUI and have not drawn that boundary yet, start there. To see how Kief Studio runs a company's own server and keeps the record of every action, book a walkthrough.

Frequently asked questions