Live Threats
[CVE-2026-1234]Windows CLFS Driver zero-day — privilege escalation to SYSTEM, CISA KEV confirmed, patch immediately|
[CVE-2026-0891]Fortinet FortiOS authentication bypass — unauthenticated admin access, active exploitation in the wild|
[CVE-2026-2201]Palo Alto PAN-OS command injection — remote code execution on firewall management plane, CISA KEV listed|
[PATCH]Microsoft April 2026 Patch Tuesday — 147 CVEs addressed including 3 zero-days, deploy immediately|
[BREACH]Healthcare sector breach — 2.3M patient records exposed, PHI including SSNs and medical histories compromised|
[CVE-2026-1887]Chrome V8 type confusion RCE — remote code execution via malicious web page, update Chrome immediately|
[COMPLIANCE]PCI DSS 4.0.1 MFA deadline — mandatory multi-factor authentication enforcement now in effect for all merchants|
[CVE-2026-3310]Cisco IOS XE privilege escalation — authenticated users gain root on affected switches and routers, patch now|
[RANSOMWARE]LockBit 4.0 SMB campaign — RDP brute-force targeting small businesses, double-extortion, 72-hour ransom window|
[ADVISORY]Adobe Acrobat PDF phishing wave — malicious PDFs bypassing email filters, credential harvesting at scale|
[CVE-2026-1234]Windows CLFS Driver zero-day — privilege escalation to SYSTEM, CISA KEV confirmed, patch immediately|
[CVE-2026-0891]Fortinet FortiOS authentication bypass — unauthenticated admin access, active exploitation in the wild|
[CVE-2026-2201]Palo Alto PAN-OS command injection — remote code execution on firewall management plane, CISA KEV listed|
[PATCH]Microsoft April 2026 Patch Tuesday — 147 CVEs addressed including 3 zero-days, deploy immediately|
[BREACH]Healthcare sector breach — 2.3M patient records exposed, PHI including SSNs and medical histories compromised|
[CVE-2026-1887]Chrome V8 type confusion RCE — remote code execution via malicious web page, update Chrome immediately|
[COMPLIANCE]PCI DSS 4.0.1 MFA deadline — mandatory multi-factor authentication enforcement now in effect for all merchants|
[CVE-2026-3310]Cisco IOS XE privilege escalation — authenticated users gain root on affected switches and routers, patch now|
[RANSOMWARE]LockBit 4.0 SMB campaign — RDP brute-force targeting small businesses, double-extortion, 72-hour ransom window|
[ADVISORY]Adobe Acrobat PDF phishing wave — malicious PDFs bypassing email filters, credential harvesting at scale|
View All
CMMC Level 2 — Advanced
DoD CUI Contractors

CMMC Level 2
Advanced Guide

The complete roadmap for achieving CMMC Level 2 certification — covering all 110 NIST SP 800-171 practices, the C3PAO assessment process, and a realistic stage-by-stage timeline for small businesses.

9–18 monthstypical timeline
110 practicesacross 14 domains
C3PAO requiredthird-party assessment

Compliance Timeline

01
GAP Assessment3–4 weeks
Weeks 1–4
02
System Security Plan (SSP)4–6 weeks
Weeks 4–10
03
POA&M / Corrective Action Plan2–3 weeks (to create)
Weeks 6–10
04
Remediation12–20 weeks
Weeks 8–28
05
Evidence Gathering3–4 weeks
Weeks 24–30
06
C3PAO Assessment2–3 weeks (on-site + review)
Weeks 30–36
Total timeline9–18 months
Triennial C3PAORequired
Know the Difference

Level 1 vs. Level 2 — What Changes

Level 2 is not just "more of Level 1." It introduces entirely new domains, a third-party assessment requirement, and significantly higher technical complexity.

Level 1 — Foundational

  • 17 practices across 6 domains
  • Protects Federal Contract Information (FCI)
  • Annual self-attestation to SPRS
  • No third-party assessment required
  • 10–12 weeks typical timeline
  • Custom pricing based on GAP assessment

Level 2 — Advanced

  • 110 practices across 14 domains
  • Protects Controlled Unclassified Information (CUI)
  • Triennial C3PAO third-party assessment
  • Annual self-assessments between C3PAO cycles
  • 9–18 months typical timeline
  • Custom pricing based on GAP assessment
Stage-by-Stage Roadmap

The 6-Stage Level 2 Journey

Every CMMC Level 2 engagement follows these six stages. Click each stage to see exactly what happens, what it costs, and how much of your team's time it requires.

A comprehensive evaluation of your current security posture against all 110 NIST SP 800-171 requirements. Unlike Level 1's 17-practice assessment, Level 2 requires deep technical analysis across 14 control families — including audit logging, configuration management, incident response, and risk assessment.

What Happens in This Stage

  • Kick-off with IT, security, HR, facilities, and leadership
  • CUI data flow mapping — where does CUI live, move, and get processed?
  • System boundary definition and scoping
  • Review of all existing policies, procedures, and technical controls
  • Technical interviews with system administrators and IT staff
  • Vulnerability scan of in-scope systems
  • Review of existing SSP (if any) and POA&M
  • Scoring of all 110 practices using NIST 800-171A methodology
  • Delivery of scored GAP report with prioritized findings

Stage Outputs

  • GAP Assessment Report (110-practice scoring)
  • CUI data flow diagram
  • System boundary definition
  • Prioritized remediation roadmap

Small Business Reality

For a business under 100 users, the GAP assessment takes 3–4 weeks. The CUI scoping exercise alone can take a week — identifying every system, cloud service, and process that touches CUI is critical and often reveals surprises. Expect 12–20 hours of your team's time.

Third-Party Assessment

Inside the C3PAO Assessment

What actually happens during a CMMC Level 2 third-party assessment — from pre-assessment prep through certification. No surprises.

01

Pre-Assessment Preparation

4–8 weeks before assessment

Before a C3PAO sets foot in your environment, you must have a complete, current SSP, a closed or credibly-planned POA&M, and an evidence package ready for review. The C3PAO will request documentation in advance.

  • Complete SSP covering all 110 practices
  • POA&M with realistic timelines for any open items
  • Network diagrams and system boundary documentation
  • Policy library (access control, incident response, etc.)
  • Evidence package organized by practice ID
  • Personnel training records
02

Assessment Kickoff

Day 1–2

The C3PAO team (typically 2–4 assessors) conducts an opening meeting to review scope, confirm the system boundary, and establish the assessment schedule. They review your SSP and documentation before any technical testing begins.

  • Scope confirmation and boundary review
  • SSP walkthrough with assessors
  • Assessment schedule established
  • Key personnel identified for interviews
  • Evidence submission portal set up
  • Rules of engagement confirmed
03

Documentation Review

Days 2–5

Assessors systematically review your policies, procedures, and SSP against each of the 110 practices. They identify gaps between documented controls and what they expect to see during technical testing.

  • Policy and procedure review for all 14 domains
  • SSP accuracy verification
  • POA&M review and credibility assessment
  • Training record review
  • Vendor and third-party documentation review
  • Preliminary findings documented
04

Technical Testing & Interviews

Days 3–8

The most intensive phase. Assessors conduct hands-on technical testing of your systems, interview key personnel, and observe security processes in action. Every practice must be demonstrated — not just documented.

  • Active Directory / IAM configuration review
  • MFA enrollment and enforcement verification
  • Network architecture and segmentation testing
  • Vulnerability scan review and patch status
  • Audit log configuration and retention verification
  • Encryption implementation testing
  • Incident response capability demonstration
  • Physical access control walkthrough
05

Findings & Deficiency Review

Days 8–10

Assessors compile their findings and present preliminary results. You have an opportunity to provide additional evidence or clarification for any practices marked as deficient before the final report is issued.

  • Preliminary findings presentation
  • Opportunity to provide additional evidence
  • Deficiency clarification discussions
  • POA&M updates for any new findings
  • Score calculation review
  • Final report preparation begins
06

Final Report & CMMC Portal Submission

Days 10–14

The C3PAO issues the final assessment report and submits results to the CMMC Portal (eMASS). If all 110 practices are met (or a credible POA&M exists for minor gaps), the C3PAO recommends certification to the CMMC Accreditation Body.

  • Final assessment report issued
  • Results submitted to CMMC Portal
  • Certification recommendation to CMMC AB
  • Certificate issued (if approved)
  • Ongoing monitoring requirements established
  • Triennial reassessment scheduled

Segler.Net Pre-Assessment Readiness Review

Before your C3PAO arrives, Segler.Net conducts a full mock assessment — reviewing your evidence package, testing your controls, and interviewing your staff using the same methodology C3PAO assessors use. We identify and close gaps before they become assessment findings. A failed C3PAO assessment means paying for a second one — our pre-assessment review is the best insurance against that outcome.

What We Find Most Often

Most Common Level 2 Gaps

These are the gaps Segler.Net finds most frequently when assessing small businesses for CMMC Level 2. Most are in domains that don't exist at Level 1.

Critical

No Audit Logging / SIEM

The #1 gap at Level 2. Most small businesses have no centralized audit logging. SIEM or equivalent is required to satisfy the AU domain.

3.3.1
High

No Configuration Baselines

Undocumented, inconsistent system configurations. Level 2 requires formal baselines and a change management process.

3.4.1
High

No Formal Vulnerability Management

Ad-hoc patching doesn't satisfy RA domain. Requires scheduled scanning, tracked findings, and documented remediation.

3.11.2
High

No Incident Response Plan

Most small businesses have no documented IR plan, no tested capability, and no designated incident response team.

3.6.1
Medium

Weak Password Policy

No enforced complexity, no prohibition on reuse, no cryptographic storage. Level 2 has specific password requirements.

3.5.7
High

Uncontrolled Cloud Services

CUI in non-FedRAMP cloud services (personal Dropbox, Google Drive, etc.) is a common and serious finding.

3.1.20
High

No Privileged Access Management

Shared admin accounts, no PAM solution, and excessive admin rights are common Level 2 failures.

3.1.5
Critical

CUI Not Encrypted at Rest

CUI stored on unencrypted drives, servers, or cloud storage without FIPS-validated encryption fails SC domain.

3.13.16
The Full Requirement Set

All 110 Level 2 Practices

Every NIST SP 800-171 requirement your business must satisfy for CMMC Level 2 certification. Filter by domain and expand to see individual practices.

Common Questions

CMMC Level 2 FAQ

Straight answers to what DoD contractors ask most about CMMC Level 2 compliance and C3PAO assessments.

Have a question about your specific CMMC Level 2 situation?

Our San Antonio compliance experts work with DoD contractors on Level 2 engagements daily — no obligation to ask.

Ask an Expert

Start Your CMMC Level 2 Journey

Get a comprehensive GAP assessment against all 110 NIST 800-171 practices. We'll give you a clear roadmap, realistic timeline, and honest cost estimate before you commit to anything.

Talk with Us