Department of Defense Issues Guidance on CMMC Level 2 Self-Assessments

Filed under

Government Contracting

The Department of Defense (DoD) released a new set of Frequently Asked Questions (FAQs) addressing Cybersecurity Maturity Model Certification (CMMC) Level 2 self-assessments. While the document was developed in response to questions from the transportation community, many of the clarifications apply broadly to organizations handling Controlled Unclassified Information (CUI) as part of the Defense Industrial Base (DIB).

The guidance reinforces several important expectations for organizations pursuing or maintaining CMMC Level 2 compliance. Among the most notable reminders:

Level 2 self-assessments must evaluate all 110 NIST SP 800-171 Rev. 2 requirements using the corresponding NIST SP 800-171A assessment procedures.
Assessment results must be submitted to the Supplier Performance Risk System (SPRS) and affirmed by an authorized official.
Organizations relying on cloud services to process, store or transmit CUI must ensure those environments are FedRAMP Moderate authorized or can demonstrate equivalent security controls.
The DoD clarified that AI tools become part of the CMMC assessment scope when users input CUI, requiring organizations to evaluate both the AI platform and its underlying cloud environment.
CUI must be protected with FIPS-validated cryptography, and standard SMS or MMS messaging should not be used to transmit CUI.
Prime contractors should verify subcontractors’ applicable CMMC status before flowing down CUI.
The FAQ also provides additional perspective on Microsoft 365 environments, shared enclaves, virtual desktop infrastructure (VDI), and Plan of Action and Milestones (POA&M) requirements.

Although the FAQ does not change existing CMMC regulations or requirements under 32 CFR Part 170, it provides valuable insight into how the DoD expects contractors to implement and assess current requirements. The clarifications surrounding cloud environments, AI usage, encryption requirements and subcontractor oversight are particularly relevant for organizations evaluating their CMMC readiness.

Steps to Take Following the New CMMC Level 2 Guidance

Organizations preparing for a Level 2 self-assessment should consider reviewing their current compliance program against the FAQ’s guidance, including:

Evaluating cloud and AI services that may process CUI
Confirming FedRAMP authorization or documented equivalency where required
Reviewing encryption controls for CUI data protection
Validating SPRS submission and affirmation procedures
Assessing subcontractor compliance validation processes

How FD Supports CMMC Readiness

As CMMC requirements continue to evolve, understanding how regulators interpret and apply the rules is becoming just as important as understanding the regulations themselves. Frazier & Deeter helps organizations assess their current readiness, address compliance gaps and prepare for CMMC Level 2 self-assessments.

If you have questions about the new FAQ guidance, CMMC Level 2 self-assessments or your organization’s compliance strategy, contact our team to start the conversation.

Talk to a specialist