achieving-cmmc-level-2-compliance

1# Achieving CMMC Level 2 Compliance
2 
3## When to Use
4 
5- When an organization in the **Defense Industrial Base (DIB)** stores, processes, or transmits **Controlled Unclassified Information (CUI)** under a DoD contract.
6- When a contract includes **DFARS 252.204-7012** (safeguarding/incident reporting), **-7019/-7020** (NIST 800-171 self-assessment + SPRS), or the new **-7021** (CMMC requirement).
7- When preparing for a **C3PAO** third-party assessment or a DoD-led assessment.
8- When you must **compute, post, or improve an SPRS score** based on the NIST SP 800-171 DoD Assessment Methodology.
9- When authoring or remediating a **System Security Plan (SSP)** and **POA&M** for the 110 requirements.
10- When **scoping** which assets fall inside the CUI/FCI boundary (CUI assets, security-protection assets, contractor risk-managed assets, out-of-scope).
11 
12## Prerequisites
13 
14- Knowledge of **which contracts carry CUI** and the CUI categories involved (check the contract and the DoD CUI Registry).
15- An asset inventory and network diagram so you can define the **CMMC assessment scope** before assessing controls.
16- The **NIST SP 800-171 Rev 2** requirements and the **DoD Assessment Methodology** scoring weights.
17- A documented **SSP** (its absence is itself a failed requirement — 3.12.4).
18- Identification of any **External Service Providers (ESPs)** / cloud services touching CUI, and whether they meet **FedRAMP Moderate (or equivalency)**.
19 
20## Workflow
21…