Share on LinkedInShare on LinkedIn

ARTICLE · 14 OCTOBER 2025

Recapping CMMC Level 2: Considerations For Government Contractors

Greenberg Traurig
Greenberg Traurig
Contributor
Greenberg Traurig

Greenberg Traurig

Greenberg Traurig, LLP has approximately 3,200 lawyers across 51 locations in the United States,...

View firm profile
Explore more from Greenberg Traurig

On Sept. 10, 2025, the Department Defense (DoD) issued a final rule amending the Defense Acquisition Regulation Supplement (DFARS) to implement the Cybersecurity...

United StatesGovernment, Public Sector
Go-To Guide:
  • Starting Nov. 10, 2025, contractors and subcontractors handling controlled unclassified information (CUI) may be required to have a current CMMC Level 2 self-assessment for new contracts and option exercises involving CUI.
  • Some contractors and subcontractors may even be required to have a certified third-party Level 2 assessment during the first year.
  • CMMC Level 2 is bifurcated between self- and third-party assessments against the controls in NIST SP 800-171 rev. 2. Of the contractors that will need to obtain Level 2 status, very few will be able to rely on a self-assessment.
  • To meet the Level 2 requirements, a company must implement certain baseline security controls, have a minimum assessment score of 80%, and annually affirm compliance with the Level 2 security controls.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See more popular content from