CMMC Level 2 Is Not Optional Anymore: What DoD Contractors Need to Do Now
For the better part of four years, defense contractors have been watching CMMC deadlines move. The framework was announced, revised, revised again, and then revised once more. Enforcement timelines shifted. Requirements changed. A lot of organizations in the Defense Industrial Base made the reasonable decision to wait and see before investing in compliance.
That window is closing. CMMC Level 2 requirements are appearing in active solicitations now, and the enforcement posture from the Department of Defense has shifted from guidance to requirement. If your organization holds DoD contracts or is bidding on new ones, the time for waiting and watching is over.
What CMMC Level 2 Actually Requires
CMMC Level 2 is built on the 110 security practices defined in NIST SP 800-171. These practices cover fourteen domains including access control, incident response, configuration management, risk assessment, and system and communications protection. For most small and mid-size defense contractors, achieving full compliance with all 110 practices represents a significant program of work.
The assessment requirement for Level 2 depends on the sensitivity of the contract. Contracts involving controlled unclassified information that is critical to national security require a third-party assessment by a CMMC Third Party Assessment Organization, known as a C3PAO. Contracts at a lower sensitivity threshold may allow for self-attestation by a senior company official, but that self-attestation carries legal weight under the False Claims Act. Signing a false attestation is not a paperwork issue — it is a federal legal exposure.
The Self-Attestation Risk Most Contractors Are Not Thinking About
One of the less-discussed aspects of CMMC implementation is the liability shift that comes with self-attestation. When a senior official signs the attestation affirming that their organization meets CMMC Level 2 requirements, they are making a legal representation to the federal government.
The Department of Justice has been active in pursuing False Claims Act cases related to cybersecurity misrepresentations in federal contracting. The framework exists, the enforcement mechanism exists, and the government has demonstrated willingness to use it. Organizations that attest to compliance without actually achieving it are carrying a risk that goes beyond losing a contract.
Where Most Small Contractors Actually Stand
The honest assessment of where most small DoD contractors stand relative to CMMC Level 2 is that they have meaningful gaps. Not because they have been negligent, but because the 110 practices in NIST 800-171 represent a mature security program that most small businesses have not had the resources or the external pressure to build.
Common gaps that show up consistently in assessments include multi-factor authentication not fully implemented across all users and systems, system security plans that are incomplete or out of date, incident response plans that exist on paper but have never been tested, audit logging that is not comprehensive or is not being reviewed, and configuration management practices that do not meet the specificity the standard requires.
None of these are insurmountable. But they take time and structured effort to close, and the gap between current state and compliant state is almost always larger than organizations expect when they first look at it seriously.
What a CMMC Readiness Assessment Does
A CMMC Assessment Readiness engagement — which is distinct from the formal C3PAO assessment — gives you an honest picture of where you stand before you go into the formal process. The output is a gap analysis mapped to specific NIST 800-171 practice requirements, a remediation roadmap with prioritized action items, and the documentation foundation you will need for the formal assessment.
The value of doing this before the formal assessment is straightforward. C3PAO assessments cost money and finding significant gaps during a formal assessment means you have paid for an assessment you cannot pass and still have the remediation work ahead of you. A readiness assessment finds those gaps first, in an environment where they are learning opportunities rather than assessment findings.
The Timeline Reality
CMMC compliance is not a short program for most small contractors. Working through the gap analysis, completing remediation, building the system security plan, and preparing for a formal assessment typically takes six to eighteen months depending on the size of the organization and the depth of the gaps.
Organizations that start that process now are in a materially better position than organizations that wait until a contract solicitation requires it. At that point the timeline is set by the contract, not by your readiness.
If your organization's revenue depends on DoD contracts, the question is not whether you need to achieve CMMC Level 2. The question is whether you start the process on your terms or on the government's.