Insights · Field note · Security assurance and compliance
CMMC Level 2: the controls that catch contractors out
Most contractors fail assessment on a small set of requirements they believed they met. The pattern is consistent enough to prepare for.
CMMC Level 2 assesses the NIST SP 800-171 requirements against evidence, and the findings that catch contractors out are consistent: multi-factor authentication not enforced for every account and access path; CUI spread beyond the documented boundary; a System Security Plan that describes intent rather than the environment; audit logs not retained, reviewed or protected; vulnerability remediation without timelines or evidence; media and mobile device controls undocumented; and cloud services in scope without the required authorizations. Each is a requirement the contractor marked implemented in self-assessment. The assessor marks what the evidence shows.
In detail
What the evidence shows.
Identity and access
Multi-factor authentication for all local and network access to privileged and non-privileged accounts is required. Contractors enforce it for email and remote access and forget local administrator logins, service accounts and legacy applications. Session controls, least privilege and account management records are examined, and the exceptions are where findings live.
Scope and the System Security Plan
If CUI is found outside the documented boundary, the boundary is wrong and the assessment scope expands. If the System Security Plan describes controls as implemented that the environment does not show, the plan is evidence against the contractor. Both are prevented by a CUI flow analysis and a plan written to the real environment, which is why enclave design precedes documentation.
Logging, vulnerabilities and media
Audit records must be created, retained, protected and reviewed, with the review evidenced. Vulnerabilities must be identified and remediated with timelines and records. Media containing CUI must be marked, controlled and sanitized, and mobile devices governed. These are operational disciplines that produce evidence only if they run, and contractors often mark them implemented because a tool exists.
Cloud services
Cloud services that store, process or transmit CUI must meet the contract’s requirements, and the shared responsibility boundary must be documented. A contractor relying on a service without the required authorization has a finding it cannot remediate quickly. See CMMC readiness, the self-assessment worksheet and CMMC Level 1 versus Level 2.
Sources
Primary references.
- Cybersecurity Maturity Model Certification program (U.S. Department of Defense, Office of the CIO)
- NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (the revision CMMC Level 2 assesses)
- Performance Data engagement observations (first-hand: David Selakovic); method described under Cyber Assurance.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days