CMMC Level 2 Certification: 110 NIST SP 800-171 Requirements

Core Facts

• 110 NIST SP 800-171 Rev 2 requirements
• 14 domains (AC–SI families)
• SPRS max score 110; assessment every 3 years; annual affirmation
• Conditional status (where allowed): minimum 88 of 110 (80%) plus critical requirements MET per §170.21; POA&M closeout within 180 days
• DFARS 252.204-7012 cyber incident reporting remains 72 hours from discovery

Self vs C3PAO

How CyberSilo Helps

• CSA tracks all 110 requirement states and SSP evidence
• ThreatHawk supports AU/SI sampling
• Readiness coaching — we are not your C3PAO

Frequently Asked Questions

How many requirements are in CMMC Level 2?

110 NIST SP 800-171 Rev 2 requirements.

What score is needed for Conditional Level 2?

Minimum 88 of 110 (80% of max) plus critical requirements MET per §170.21, with POA&M closeout in 180 days.

Is C3PAO required for every Level 2 contract today?

No. During Phase II suspension, new designations are limited to Level 1 (Self) or Level 2 (Self). Follow your specific contract.

Related CMMC Resources

CMMC hub · Level 1 · Level 3 · Assessment process · CSA