Terms / Assessment

NIST SP 800-171

The publication holding the 110 security requirements that make up CMMC Level 2. Revision 2 is the version the CMMC Program uses.

Also called 800-171, SP 800-171, NIST 800-171.

Official Source Material

CMMC Security Requirements means the 15 Level 1 requirements listed in the 48 CFR 52.204-21(b)(1), the 110 Level 2 requirements from NIST SP 800-171 R2 (incorporated by reference, see § 170.2), and the 24 Level 3 requirements selected from NIST SP 800-172 Feb2021 (incorporated by reference, see § 170.2).

Source: 32 CFR 170.4, eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

The 110 requirements in this publication are the whole of CMMC Level 2.

CMMC Level 2 adds no requirement of its own. It takes the 110 security requirements from NIST SP 800-171 and asks you to implement them and prove it. Read the publication itself rather than a vendor's summary of it. The requirements are short, and reading the original tells you what is actually asked.

Revision 2 is the version the program uses, and Revision 3 exists.

The rule names Revision 2 specifically. NIST has published a later revision with a different structure, and adopting it does not satisfy this program today. Be careful with tooling and templates that quietly assume the newer revision. Check which version a product covers before you buy it.

The requirements split into fourteen families, and your evidence follows them.

The families run from access control and awareness and training through to system and information integrity, and each one groups the requirements that belong together. Each requirement carries an identifier such as AC.L2-3.1.1. The letters name the family, and the number after them is the requirement in the publication.

Your obligation to implement this came from your contract, not from CMMC.

DFARS 252.204-7012 has required this publication since 2017. CMMC added verification, and it did not add the requirements. If a contract with that clause is in force, the 110 requirements apply to you now, whether or not anyone has assessed you.

What falls short

A gap assessment against a product's interpretation of the requirements. The publication is the authority, and the assessment objectives in NIST SP 800-171A are what an assessor tests.
Work done against Revision 3 for a program that names Revision 2. The structures differ enough that a mapping exercise becomes necessary.
Treating the requirements as a checklist of products. Each requirement describes an outcome, and several are satisfied by a written process.

Edge cases

A requirement genuinely does not apply to your environment. That is a finding of not applicable, and it is treated as met during an assessment.
You hold an adjudication from the DoD Chief Information Officer that a requirement is not applicable or that an alternative is equally effective. Include it in your system security plan so it counts during an assessment.
Your contract cites a version in effect when the solicitation was issued. Read the clause, because the version travels with the contract.

Over-engineering

Buying a platform that claims to deliver all 110 requirements. Several requirements are about what people do, and no product performs them for you.
Rewriting the requirements into your own control framework. Cite them by identifier and describe how you meet each one.

Connects to

AC.L2-3.1.1 Authorized Access Control Access Control (AC)
DFARS 252.204-7012 The contract clause that put NIST SP 800-171 on your systems and requires you to report a cyber incident to DoD within 72 hours. The contract
NIST SP 800-171A The companion publication holding the assessment objectives. It is the document an assessor actually works from, so it is the one to read. Assessment
Not applicable A finding that a requirement or objective does not apply to your environment. It counts the same as met, and it needs a written reason. Assessment
System Security Plan (SSP) The document describing your system and how it meets each requirement. It is itself a requirement, and it cannot go on a POA&M. Assessment

Referenced by

Cyber AB The Accreditation Body. It is the single organization DoD contracts with to authorize and accredit the assessors and other ecosystem members. Assessment
NIST SP 800-171A The companion publication holding the assessment objectives. It is the document an assessor actually works from, so it is the one to read. Assessment
CMMC The Cybersecurity Maturity Model Certification. It is the program that verifies a defense contractor meets the security requirements already in its contract. Certification
Level 2 The 110 requirements of NIST SP 800-171, assessed by you or by a C3PAO depending on what your contract says. This is where most CMMC work happens. Certification
AC.L2-3.1.2 Transaction & Function Control Access Control (AC)
AC.L2-3.1.11 Session Termination Access Control (AC)
PE.L2-3.10.2 Monitor Facility Physical Protection (PE)