CMMC Level 2 Playbook
Certification Is Three Years. The Work Is Every Day.
You passed the audit. Staying defensible is the harder part.
Your C3PAO assessment was a point-in-time evaluation, but your controls have to actually work every day of the three-year cycle. Environments drift: tools change, a new cloud tenant gets added, a subsidiary arrives with its own IT, and the SSP that was accurate at certification slowly stops matching reality. The question that keeps compliance officers up is simple: are our controls still holding, and does our documentation still describe what we actually run?
The thresholds that decide whether a certification holds
Free download
Get the playbook
What this playbook does
This 21-page, eight-chapter playbook walks a DIB contractor through the full CMMC Level 2 journey, from CUI scoping and evidence through SSP construction, POA&M rules, SPRS affirmation, and C3PAO selection. Its focus is the part most teams underestimate: maintaining certification across the three-year cycle so reassessment is a confirmation, not a scramble. Every rule, threshold, and figure is grounded in the primary sources an assessor will apply.
What is inside
What changes once you have read it
You can brief a senior official before they affirm
Walk into each annual affirmation with the SSP scope, assessed score, and open POA&M items in hand, so the signature is informed rather than a liability.
You catch scope-breaking changes before they go live
Know which mid-cycle triggers demand immediate SSP and boundary updates, and act before the new system touches CUI in production.
Your cloud and managed providers stop being a blind spot
Confirm FedRAMP equivalency, own the translation of vendor responsibility matrices, and document inheritance so claims survive assessor scrutiny.
Reassessment stops being a fire drill
Run continuous monitoring on a fixed rhythm so your evidence stays current and your next assessment confirms what you already know.
Grounded in the rules, not opinion
Frequently asked questions
Yes. The playbook covers the full journey, but its core is the three-year maintenance work: annual affirmations, architecture changes, continuous monitoring, and reassessment prep for teams who already hold certification.
Yes. Under 32 CFR Part 170 a senior company official must affirm annually, and that affirmation carries the same False Claims Act exposure as the original submission. The playbook explains the internal review the compliance officer or ISSO must complete before that signature.
Not necessarily. Any provider that processes, stores, or transmits CUI must meet FedRAMP Moderate equivalency, and commercial tiers of well-known platforms do not qualify even when a government tier of the same product does. The playbook details how to confirm and document equivalency.
At least nine months before your certification expiration date. C3PAOs have limited scheduling capacity, and some solicitations require a current certification in SPRS rather than an engagement letter. The playbook explains how to confirm which requirement applies before you schedule.
No. The playbook is provided for general informational and educational purposes and is not a substitute for qualified legal counsel, your contracting officer, or your C3PAO. Verify current requirements against the primary sources before you rely on them.