CMMC readiness you can prove.
CMMC turns 800-171 from a self-attestation into a verified requirement for defense contracts. TruOps helps you know your score, close your gaps, and show your evidence.
CMMC Level 2 practices
The 110 NIST SP 800-171 requirements, by domain
The same work also counts toward
Mapped coverage, with partial overlaps shown
Each mapping is labeled exact, partial, or inferred, with a source.
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the U.S. Department of Defense program that verifies contractors protect Federal Contract Information and Controlled Unclassified Information. It has three levels: Level 1 (15 basic requirements, annual self-assessment), Level 2 (the 110 requirements of NIST SP 800-171 Rev. 2, self-assessed or certified by a C3PAO), and Level 3 (Level 2 plus selected SP 800-172 requirements, assessed by the government).
- Program owner
- U.S. Department of Defense
- Level 1
- 15 requirements, annual self-assessment
- Level 2
- 110 requirements (800-171 Rev. 2), self-assessment or C3PAO
- Level 3
- Level 2 plus SP 800-172, government assessment
The three levels
| Level | Protects | Requirements | Assessment |
|---|---|---|---|
| Level 1 | Federal Contract Information | 15, from FAR 52.204-21 | Annual self-assessment |
| Level 2 | Controlled Unclassified Information | 110, from NIST SP 800-171 Rev. 2 | Self-assessment or C3PAO certification, every 3 years |
| Level 3 | CUI in high-priority programs | Level 2 plus selected SP 800-172 requirements | Government assessment (DIBCAC) |
The challenge
CMMC turns 800-171 from a self-attestation into a verified contract requirement. Assessors will ask for objective evidence for every requirement.
- Level 2 has 110 requirements, and "we have a policy" doesn't count as evidence.
- Limited POA&Ms have to close within 180 days.
- The CUI boundary is unclear, so the assessment scope keeps shifting.
What you're probably using today
Almost nobody starts CMMC 2.0 from scratch. You already have a program somewhere, and TruOps picks up from there.
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
| SOC 2 automation tools | Great for getting certified, with automated tests, a big framework library, and often a trust center. Maturity scoring, custom frameworks, and deeper risk or vendor work can fall outside what they cover. | Keep your automated checks. Use any framework as your anchor, map the rest with partial overlaps clearly marked, and run vendor and risk work in the same place. Start with the policies and reports you already have. |
| Enterprise GRC suites | They can model almost anything, but that flexibility usually runs through implementation partners and admins, so every change turns into a project. | AI reads your existing documents and sets up the program. Your first assessment opens pre-filled with sources, and you make changes by asking in plain language. |
Timeline
The CMMC program rule (32 CFR Part 170) took effect in December 2024, and the DFARS rule that adds CMMC requirements to contracts began a phased rollout on 10 November 2025 (Phase 1: Level 1 and Level 2 self-assessments with annual SPRS affirmations). On 13 July 2026, the Department paused the move to Phase 2, which would have made C3PAO certification a standard Level 2 contract requirement from 10 November 2026, pending a program review. As of September 2026, third-party assessment requirements remain suspended and self-assessment is the primary path. The pause changed who verifies the work. The work itself hasn't changed: DFARS 252.204-7012 and the 110 requirements of NIST SP 800-171 still apply. Limited plans of action and milestones are allowed at Levels 2 and 3, with items closed within 180 days. Check each solicitation for the level it requires.
How TruOps helps with CMMC
Pick CMMC as your anchor, or map it to the framework you already run. TruOps keeps CMMC's own structure, down to the individual requirement, and shows coverage per requirement as satisfied, partial, or open, with the evidence behind each.
Upload what you have (prior reports, policies, spreadsheets) and TruOps pre-fills your CMMC assessment with cited answers. Connected tools keep technical controls current on the schedule you set, and failed checks become findings with a recommended fix.
TruOps runs Level 1 and Level 2 assessments in the same place as the rest of your program, so your CMMC evidence also counts toward NIST SP 800-171 and 800-53.
How TruOps helps
- Anchor or map
- Use CMMC as your anchor or map it to another framework, and your work counts once.
- Pre-filled assessment
- Your CMMC assessment opens with the answers your evidence supports already filled, each cited.
- Accurate coverage
- Partial coverage is clearly marked, with the remaining requirements listed.
- Continuous monitoring
- Technical controls checked against your tools, from hourly to quarterly.
- Findings with fixes
- Failed checks become grouped findings with a recommended action.
- Audit-ready snapshots
- Results saved as of their date, with the evidence trail attached.
Questions
What are the CMMC 2.0 levels?
Level 1 (Foundational, 15 requirements), Level 2 (Advanced, the 110 requirements of NIST SP 800-171 Rev. 2), and Level 3 (Expert, Level 2 plus selected NIST SP 800-172 requirements).
When does CMMC apply?
Phase 1 of the DFARS rollout began on 10 November 2025 with self-assessments and SPRS affirmations. The planned November 2026 move to Phase 2 (C3PAO certification) was paused on 13 July 2026 pending a program review. The underlying NIST SP 800-171 requirements still apply. Contracts state the level required, so check each solicitation.
Does the Phase 2 pause mean we can wait?
No. The pause changes who verifies the work, and the requirements stay the same. Self-assessments still have to hold up requirement by requirement, a senior official still affirms them, and a C3PAO requirement could return when the review ends. A program built on sourced evidence is ready either way.
Can TruOps certify me for CMMC?
No. Level 2 certification is performed by an authorized C3PAO, and Level 3 by the government. TruOps gets you ready and organizes your evidence.
Are POA&Ms allowed under CMMC?
Yes, limited POA&Ms are allowed at Levels 2 and 3 for certain requirements, and they have to be closed within 180 days.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Does TruOps replace our auditor, QSA, or certification body?
No. Only a licensed auditor, QSA, C3PAO, or accredited certification body can issue the opinion. TruOps keeps your evidence current, sourced, and dated so fieldwork goes quickly.
Related
Know your score, close your gaps, and show your evidence.
→FrameworksNIST SP 800-171Protecting Controlled Unclassified Information in nonfederal systems.
→LearnPOA&MPlans of action and milestones, explained.
→IndustriesGovernment contractorsCMMC, NIST SP 800-171, and SPRS, with the evidence assessors expect.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.