CMMC 2.0 Level 2 Compliance Checklist: What NWA Defense Contractors Must Do Now

If your Northwest Arkansas manufacturing operation handles contracts with the Department of Defense, you’ve likely heard the acronym CMMC thrown around in recent years. Now, with CMMC 2.0 fully in effect and contract awards increasingly contingent on demonstrated compliance, this is no longer a “someday” problem. It’s a right-now business requirement.

CMMC 2.0 Level 2 applies to any contractor or subcontractor that handles Controlled Unclassified Information (CUI). If your facility receives technical drawings, specifications, or other sensitive defense-related data from a prime contractor or directly from DoD, Level 2 almost certainly applies to you. This guide breaks down exactly what you need to do, and how to build a realistic compliance roadmap.

What Is CMMC 2.0 Level 2?

The Cybersecurity Maturity Model Certification (CMMC) framework was developed by the DoD to verify that defense contractors adequately protect sensitive information. CMMC 2.0 streamlined the original five-level model into three tiers:

• Level 1 (Foundational): 17 basic practices; annual self-assessment
• Level 2 (Advanced): 110 practices aligned with NIST SP 800-171; triennial third-party assessment (C3PAO) or annual self-assessment for lower-risk programs
• Level 3 (Expert): 110+ practices drawn from NIST SP 800-172; government-led assessments

Level 2 is where most NWA manufacturers in the defense supply chain land. It’s rigorous, but it’s achievable, especially with a clear plan.

The 14 Domains of NIST SP 800-171 (and Why They Matter)

CMMC Level 2 maps directly to NIST SP 800-171, which organizes 110 security requirements across 14 domains. Here’s a quick-reference overview:

Understanding which domains are already addressed and which have gaps is the foundation of every solid compliance plan.

Step-by-Step CMMC Level 2 Compliance Checklist

Step 1: Identify and Scope Your CUI Environment

Before you can protect CUI, you need to know exactly where it lives.

• Identify all systems, networks, and storage locations that process, store, or transmit CUI
• Document which employees have access to CUI
• Map data flows: how CUI enters your environment, how it’s used, and how it leaves
• Define your CUI enclave (the bounded environment where CUI lives). The smaller this is, the less expensive compliance becomes

Many NWA manufacturers discover that CUI only touches a handful of workstations and a shared network drive. Narrowing that scope before you start can cut compliance costs significantly.

Step 2: Conduct a Gap Assessment Against NIST SP 800-171

A gap assessment compares your current state against all 110 requirements. This produces a System Security Plan (SSP), a required document that describes your environment and how each requirement is (or will be) met.

• Document current controls for each of the 110 requirements
• Identify gaps where controls are missing or inadequate
• Create a Plan of Action & Milestones (POA&M) for any gaps you can’t remediate immediately

The SSP and POA&M are living documents. Assessors will review them, and having well-maintained versions shows maturity and good faith.

Step 3: Implement Access Controls

Access control is the largest domain, and for good reason: most breaches exploit unauthorized or over-privileged access.

• Apply least privilege: users should only access what they need for their job
• Enforce multi-factor authentication (MFA) for all CUI systems and remote access
• Separate user and administrative accounts; no one should browse the web with admin credentials
• Implement session lock after 15 minutes of inactivity
• Control and log external system connections

Step 4: Protect Your Network

• Segment the network so CUI systems are isolated from general business and OT/plant floor systems
• Deploy a next-generation firewall with application-layer inspection
• Encrypt all CUI in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent)
• Disable unused ports, protocols, and services
• Implement DNS filtering to block malicious domains

Step 5: Harden Endpoints and Manage Configurations

• Maintain a documented baseline configuration for all systems that touch CUI
• Deploy endpoint detection and response (EDR) on all CUI workstations
• Ensure anti-malware is deployed and auto-updating
• Apply the principle of deny by default for software installation
• Review and document any deviations from baseline configs

Step 6: Establish a Patch Management Program

Unpatched systems are among the top attack vectors for defense contractors.

• Patch operating systems within 30 days of a critical update release (14 days for actively exploited vulnerabilities)
• Patch third-party applications on the same schedule
• Maintain an inventory of all software in the CUI environment
• Test patches in a non-production environment when possible before deploying to CUI systems

Step 7: Build Your Audit and Logging Capability

• Enable audit logging on all CUI systems (logins, file access, privilege use, configuration changes)
• Aggregate logs into a centralized SIEM or log management platform
• Retain logs for at least 90 days (longer is better)
• Review audit logs regularly and alert on anomalies
• Protect logs from tampering; use append-only storage or forward to an immutable destination

Step 8: Train Your People

Security awareness isn’t optional under CMMC.

• Conduct security awareness training for all employees with CUI access, annually at minimum
• Train employees to recognize phishing, social engineering, and insider threat indicators
• Document training completion and maintain records
• Provide role-specific training for IT staff and system administrators

Step 9: Develop an Incident Response Plan

• Document a written incident response plan that covers detection, containment, eradication, recovery, and lessons learned
• Identify who is responsible for each step when an incident occurs
• Test the plan at least annually (tabletop exercise)
• Establish procedures for reporting incidents to DoD if CUI is compromised (required within 72 hours under DFARS 252.204-7012)

Step 10: Prepare for the Assessment

If your contracts require a third-party C3PAO assessment (vs. self-assessment):

• Ensure your SSP is current and comprehensive
• Close out as many POA&M items as possible before the assessment
• Conduct a pre-assessment with your IT partner to identify remaining gaps
• Prepare evidence packages: screenshots, configurations, policies, training records
• Designate a point of contact who can guide assessors through your environment

Common Pitfalls NWA Manufacturers Should Avoid

Treating CMMC as a one-time project. Compliance is an ongoing program. Systems change, people leave, new software gets installed, and all of it can affect your compliance posture. Build a continuous monitoring process into your operations.

Scoping too broadly. If CUI only touches 10 workstations, don’t drag your entire 200-seat network into scope. Proper scoping is one of the highest-value steps in the process.

Neglecting the supply chain. If you pass CUI to subcontractors, they need to meet CMMC requirements too. Flow-down obligations are real, and assessors will ask about them.

Skipping the SSP. Some smaller contractors try to “wing it” without a System Security Plan. This will not fly in a formal assessment and leaves you with no roadmap to remediate gaps.

Assuming your IT generalist has this covered. CMMC Level 2 requires specialized knowledge of NIST 800-171, federal contracting requirements, and cybersecurity best practices. If your IT team hasn’t worked with defense contractors before, bring in a qualified partner.

How Long Does CMMC Level 2 Compliance Take?

For a typical NWA manufacturer with a small CUI enclave, realistic timelines look like this:

Starting early is critical. DoD contracting officers are increasingly making compliance a contract eligibility requirement, not just a preference.

Ready to Start Your CMMC Compliance Journey?

Quantech IT takes on CMMC work for Northwest Arkansas contractors: initial gap assessments, remediation, and assessment readiness, scoped and priced before anything starts. We understand the NWA defense supply chain and the practical realities of securing manufacturing environments.

Ready to assess your current compliance posture? Our free Technology & Growth Review covers cybersecurity, technology, and AI readiness in 60 minutes and leaves you with a written action plan.