CMMC Level 2 Assessment: What to Expect and How to Prepare in Oklahoma
A CMMC Level 2 assessment checks whether a defense contractor meets the 110 security requirements in NIST SP 800-171 Revision 2. It can be a self-assessment or a certification assessment by an outside assessor, depending on what your contract requires. This guide explains how the CMMC Level 2 assessment works, how scoring and POA&Ms work, what the 2026 Phase 2 pause means and how Oklahoma suppliers around Tinker Air Force Base can prepare.
Get Protected
Endpoint Detectives runs 24/7 managed detection and response (MDR) on CrowdStrike for $150 per workstation per year, billed annually up front. No hidden fees.
What Is a CMMC Level 2 Assessment?
A CMMC Level 2 assessment is a scored review of your controls for protecting Controlled Unclassified Information (CUI). CMMC Level 2 covers the 110 security requirements in NIST SP 800-171 Revision 2, so the assessment is really a test of how well you meet that standard.
The assessor looks at each requirement and marks it MET or NOT MET. To be MET, every assessment objective behind the requirement has to be satisfied, and you need evidence to show it. Policies alone are not enough. The assessor wants to see the control working.
DFARS 252.204-7012 remains in effect, and contractors that handle Controlled Unclassified Information (CUI) must still implement NIST SP 800-171. The assessment is how CMMC verifies that work.
What Is the Difference Between a Self-Assessment and a C3PAO Assessment?
The difference is who does the scoring. Under a self-assessment your own team scores the controls, and under a certification assessment an outside, accredited organization does it.
Under CMMC Level 2 (Self), contractors complete a self-assessment every three years with an annual affirmation, and POA&Ms must be closed within 180 days. A POA&M is a plan of action and milestones for each unmet requirement.
Under 32 CFR 170.17, a CMMC Level 2 certification assessment must be performed by an authorized or accredited CMMC Third-Party Assessment Organization (C3PAO) following NIST SP 800-171A. Under 32 CFR 170.17, a Level 2 certification assessment must be completed every three years, and the contractor must submit an affirmation every year.
| Level 2 (Self) | Level 2 (C3PAO) | |
|---|---|---|
| Who scores it | Your company | An accredited C3PAO |
| How often | Every three years | Every three years |
| Affirmation | Every year | Every year |
| Where results go | SPRS | eMASS, then SPRS |
Your contract or solicitation tells you which one applies. Many prime contractors around Tinker will ask subcontractors which type they hold, so know your answer before the question comes.
How Is a CMMC Level 2 Assessment Scored?
Scoring starts at 110 points, and points come off for each requirement that is NOT MET. The NIST SP 800-171 DoD Assessment Methodology summary score starts at a maximum of 110, and points are subtracted for each requirement not met. Some requirements are worth 1 point, and others are worth 3 or 5.
Under 32 CFR 170.21, Conditional Level 2 status requires an assessment score of at least 80% of the 110 CMMC Level 2 requirements, which is 88 points, and only certain 1-point requirements may be placed on a POA&M. A missing control like multi-factor authentication costs more points, and it cannot be deferred to a POA&M.
Under 32 CFR 170.21, the system security plan (SSP) requirement can never be placed on a POA&M. If you do not have a written SSP, you are not ready for an assessment.
What Happens After a Conditional Result?
A conditional result gives you a short window to fix the remaining gaps. Under 32 CFR 170.21, a POA&M closeout assessment must confirm that every NOT MET requirement is fixed within 180 days of the Conditional CMMC Status Date, or the conditional status expires.
Under 32 CFR 170.17, the C3PAO enters Level 2 certification results into the CMMC instantiation of eMASS, which sends them to SPRS. Your contracting officers and primes can then see your status. Treat the 180 days as a project with a named owner and weekly check-ins, not a someday task.
Where Does CMMC Stand in 2026?
CMMC is in effect, but the second phase is on hold. CMMC Phase 1 implementation began November 10, 2025. Under the CMMC phased rollout in 32 CFR 170.3, Phase 2 is when DoD begins including Level 2 (C3PAO) certification requirements in applicable solicitations.
On July 13, 2026, the DoW CIO announced that CMMC Phase 2, scheduled for November 10, 2026, was suspended and a reform task force was established, according to the DoW CIO CMMC page. That means fewer contracts will demand a C3PAO certificate on that date, but it does not remove the underlying security work.
DFARS 252.204-7021 requires prime contractors to flow CMMC requirements down to subcontractors that handle FCI or CUI. Primes can still ask for proof of your security posture, and the NIST 800-171 obligation has not paused. Our CMMC compliance page tracks what changes next.
Get Protected
Several Level 2 requirements call for logging, monitoring and incident response. Endpoint Detectives covers those in one plan.
Which Level 2 Requirements Can MDR Help You Meet?
Managed detection and response helps with the technical requirements that need attention every day, such as audit logging, system monitoring and incident handling. It does not write your policies or your SSP.
| Requirement family | How MDR helps |
|---|---|
| Audit and Accountability | Security information and event management (SIEM) log aggregation keeps an audit trail |
| System and Information Integrity | Endpoint detection and response (EDR) watches every workstation for malicious activity |
| Incident Response | Analysts investigate, contain and document incidents |
| Risk Assessment | Vulnerability scanning finds weaknesses before an assessor does |
Every Endpoint Detectives subscription includes the CrowdStrike EDR license, endpoint monitoring, network monitoring, cloud monitoring, vulnerability scanning, SIEM log aggregation, a 24/7 SOC and remote incident response. The SOC is a security operations center staffed around the clock. Endpoint Detectives analysts can respond to a confirmed threat in as little as 15 minutes.
Scanning matters because the Verizon 2026 DBIR found exploitation of vulnerabilities was the top initial access vector at 31% of breaches, and credential abuse accounted for 13%. See our vulnerability scanning services page for how scans support an assessment.
How Should an Oklahoma Contractor Prepare for a CMMC Level 2 Assessment?
Start with scope, then prove each control with evidence. A small machine shop in Oklahoma City or an engineering firm in Tulsa can follow the same six steps.
- Scope your CUI. List every system, user and location that stores, processes or sends it.
- Write the SSP. Describe how each of the 110 requirements is met.
- Score yourself honestly. Use the DoD Assessment Methodology and fix the 3 and 5 point gaps first.
- Turn on logging and monitoring. Auditors will ask to see alerts and how you handled them.
- Collect evidence. Keep screenshots, logs, training records and dated reviews in one place.
- Run a mock assessment. Walk through each requirement as an assessor would before the real one.
Endpoint Detectives customers deploy the CrowdStrike agent themselves with an easy-to-follow guide. Endpoint Detectives is a CrowdStrike partner headquartered at 720 NE 63rd St in Oklahoma City and serves businesses nationwide. For more detail on the standard itself, read our NIST 800-171 guide, and see our Oklahoma City cybersecurity page for local coverage.
FAQ
What is a CMMC Level 2 assessment?
It is a scored review of whether your company meets the 110 NIST SP 800-171 Revision 2 requirements for protecting CUI, done by your own team or by an accredited C3PAO.
What score do you need to pass CMMC Level 2?
A full pass means every requirement is MET. A conditional result needs at least 88 of 110 points, with only certain 1-point items on a POA&M.
Is a CMMC Level 2 self-assessment enough?
It depends on your contract. Some contracts accept Level 2 (Self), and others require a C3PAO certification assessment.
Did the Phase 2 suspension cancel CMMC?
No. Phase 1 is in effect, and DFARS 7012 still requires NIST 800-171. The suspension paused the date when C3PAO certification was due to appear in more solicitations.
Conclusion
A CMMC Level 2 assessment rewards preparation. Know whether you need a self-assessment or a C3PAO, write your SSP, score yourself honestly and keep evidence for every control. The Phase 2 pause gives Oklahoma contractors more time, not a pass.
This article is general information, not legal advice. Consult your contracting officer or attorney about your specific obligations.
Get Protected
Endpoint Detectives delivers 24/7 MDR on CrowdStrike for $150 per workstation per year, billed annually up front. No hidden fees. Talk to us about your Level 2 gaps.
Born in Oklahoma. Hunting threats everywhere. Real humans. Real response. No corporate runaround. No hidden fees. No mercy for threats.
Last updated: October 28, 2026