A practical path to CMMC 2.0 for defense contractors handling FCI and CUI — and where self-hosting keeps that data inside your boundary.
The checklist
- Determine your required level — Level 1 (FCI, 15 practices), Level 2 (CUI, 110 practices from NIST SP 800-171), or Level 3.
- Define your scope — identify where FCI and CUI are stored, processed and transmitted, and draw the assessment boundary.
- Map to NIST SP 800-171 — the 110 security requirements across 14 control families (Level 2).
- Run a gap assessment against each requirement, scoring your current state.
- Write your System Security Plan (SSP) documenting how each requirement is met.
- Build a Plan of Action & Milestones (POA&M) for any gaps, with owners and dates.
- Implement the controls — access control, audit and accountability, configuration management, incident response, media protection, and the rest.
- Calculate and submit your SPRS score to the Supplier Performance Risk System.
- Assess — Level 1 is an annual self-assessment; Level 2 requires a C3PAO third-party assessment.
- Achieve certification at your required level.
- Submit an annual affirmation of continued compliance.
Why boundary matters hereCUI often can't sit in a multi-tenant commercial cloud. A self-hosted or sovereign deployment keeps controlled data — and the evidence proving you protect it — inside your enclave.
A practical starting checklist, not an assessment. Level 2 certification is issued by an authorised C3PAO.