CMMC and NIST SP 800-171
CMMC Level 2 and NIST SP 800-171 Overview
What a Level 2 assessment expects, how the 110 requirements are organized and how to build a program that holds up
Short course · 3 hours · Certificate does not expire
CMMC Level 2 is the level DoD sets for most contracts in which a supplier handles controlled unclassified information. It verifies the 110 requirements of NIST SP 800-171 Rev 2 that DFARS 252.204-7012 has required since 2017, through a self-assessment or a certification assessment by a C3PAO, valid for 3 years with annual affirmation. The programme rule is 32 CFR Part 170, effective 16 December 2024, and the contract clause, DFARS 252.204-7021, began phasing into solicitations on 10 November 2025. In July 2026 DoD suspended Phase 2, due on 10 November 2026, which would have made C3PAO certification a condition of award for most CUI contracts. While the suspension lasts, new solicitations call for Level 1 or Level 2 self-assessments. The Level 2 requirements themselves have not changed.
This short course is for the people who have to make Level 2 happen in a small or mid-sized supplier. It starts with the landscape: the DFARS clauses, the three levels, phased implementation and its 2026 suspension, conditional versus final status and the plan of action rules. It then covers scoping, including the 5 asset categories, enclaves, cloud services and external providers. Two modules walk through all 14 requirement families in plain language with the evidence an assessor expects. The fifth module explains the system security plan, the plan of action and milestones, SPRS scoring from 110 down to -203, the NIST SP 800-171A objectives, the three evidence types and what happens during a C3PAO assessment week. The last module shows how to build the program: roles, policies, employee responsibilities, the failures that most often produce no status, a 12-month roadmap and the path to Level 3.
The course is an overview at awareness and practitioner level. It is anchored on 32 CFR Part 170, the DFARS clauses, NIST SP 800-171 Rev 2 and NIST SP 800-171A and the CMMC Assessment and Scoping Guides published by the DoD CIO. It does not give legal advice, does not qualify anyone as a CMMC assessor or professional, and does not replace your company's procedures or the official guides.
The course closes with a 20-question examination drawn from a bank of 30. On passing you receive a PlanetISO Certificate of Completion with lifetime access to the course content and your certificate. The certificate does not expire.
What people learn
- Explain the roles of DFARS 252.204-7012, 252.204-7021 and 252.204-7025, the DoD assessment clauses formerly numbered 7019 and 7020, and 32 CFR Part 170, and describe the three CMMC levels and the phased implementation.
- Distinguish Level 2 self-assessment from C3PAO certification and state the rules for conditional and final status, the 88-point threshold, plan of action eligibility and the 180-day close-out.
- Classify assets into the 5 CMMC scoping categories, explain how an enclave limits scope and state what cloud services and external providers must demonstrate.
- Summarize what each of the 14 NIST SP 800-171 Rev 2 families requires and name the evidence an assessor expects for each.
- Describe the content of a system security plan and a plan of action and milestones, and calculate a DoD Assessment Methodology score including the multi-factor authentication and FIPS partial cases.
- Outline how a C3PAO assessment is planned and conducted using NIST SP 800-171A objectives and the examine, interview and test methods.
- Identify the common failures that leave a company with no status and lay out a 12-month program with roles, policies and employee responsibilities.