03 / WHAT TO DO
The procedure. Five steps, this order.
This is the sequence every small supplier that has got through CMMC Level 2 followed. Each step produces one thing you can hold. Do not start at step three because a vendor sent a quote.
STEP 1. Find your CUI and draw the line.
Write down every place controlled information is stored, sent or handled: the workstations that open drawings, the email accounts that receive them, the file server or cloud share, the quality system, the people who use them, and any outside service that touches them. That list is your scope. The rule sorts every asset into one of five categories, and the one that matters most is the first: assets that process, store or transmit CUI are assessed against all 110 requirements. Everything that cannot touch CUI and does not protect it is out of scope and is not assessed.
The smaller the line, the smaller the job. A shop that opens drawings on two workstations and one email account has a far shorter path than one that lets CUI sit on every machine on the floor. Four documents come out of this step and an assessor will ask for all four: a diagram of how CUI flows in and out, a network boundary diagram, a physical site diagram, and the list of people authorized to handle it.
WHAT YOU HOLDAn asset list, four diagrams, and a line you can defend.
STEP 2. Get a gap assessment.
Every one of the 110 requirements, checked against your real scope and marked met or not met, with the evidence seen for each. This is the first honest number: the score you would post in SPRS today, from 110 down to minus 203. It is also the budget, because what is not met is the work.
Have it done against NIST SP 800-171A, the 320 assessment objectives, not against a checklist of the 110 titles. A requirement is met only when every objective under it is met, and an assessor checks the objectives.
WHAT YOU HOLDA scored report, requirement by requirement, with evidence noted.
STEP 3. Write the System Security Plan and the plan of action.
The SSP describes your scope and states, for each requirement, how it is met: the setting, the procedure, the person. Requirement CA.L2-3.12.4 makes it mandatory, and it is the document an assessor opens first. The Plan of Action and Milestones lists the requirements not yet met, who closes each one, and the date. A Level 2 plan of action closes within 180 days.
Policies say what should happen. Procedures say how. Evidence proves it happened: a setting screenshot with a date, a training record, a log. An assessor checks that the three agree. A policy dated five years ago that nobody follows is a finding, not a control.
WHAT YOU HOLDAn SSP, a POA&M with owners and dates, and a folder of evidence that grows every week.
STEP 4. Post your score in SPRS and sign it.
The score from your assessment goes into the Supplier Performance Risk System with the date of the assessment, the scope, and the date the plan of action will be complete. A senior official at your company affirms that it is true, at each assessment and every year after. Primes and contracting officers read SPRS before award.
The affirmation is a statement to the government. Post the real score with a real plan. An inflated score invites a False Claims Act action, and the person who signed is the one named.
WHAT YOU HOLDA posted score, an affirmation on file, and a calendar entry for next year.
STEP 5. Self-assessment or a certified assessor: which one you need.
Your contract names one of two Level 2 statuses. Level 2 (Self) is your own assessment, posted and affirmed. Level 2 (C3PAO) is an assessment by an accredited third-party organization, with the result also posted. The requirements are the same 110 either way. The difference is who checks.
Since July 13, 2026 the Department has suspended the Phase 2 transition that would have made the third-party status common, and requiring activities may only designate the self-assessment statuses during the review. If your contract already names Level 2 (C3PAO), ask your contracting officer how the class deviation applies to it. If it names Level 2 (Self), steps one to four are the whole job, and they are due now.
WHAT YOU HOLDThe status your contract names, and a plan that matches it.
Need the first step done with you? Book a 30-minute call, or if you are a small supplier without a budget line for this, start with an in-kind grant.