CMMC Level 2 and NIST SP 800-171: Protecting CUI the Right Way
by NOXMON Risk Team, Cybersecurity & Risk Management Experts
For defense contractors that handle Controlled Unclassified Information (CUI), CMMC Level 2 is the threshold that matters. Where Level 1 covers 17 basic practices for Federal Contract Information, Level 2 aligns to all 110 security requirements of NIST SP 800-171 and, for most contracts, requires a third-party assessment by a C3PAO. The jump in rigor is substantial—and so is the business at stake.
NOXMON helps contractors clear that bar with the RISKMON platform.
The Scale of Level 2
| Dimension | CMMC Level 1 | CMMC Level 2 |
|---|---|---|
| Protects | FCI | CUI |
| Control source | 17 FAR practices | 110 NIST SP 800-171 controls |
| Assessment | Annual self-assessment | C3PAO third-party (every 3 years) |
| Scoring | Pass/fail | SPRS score, max 110 |
Risk-Prioritized Implementation
Trying to implement 110 controls evenly is how programs stall. NOXMON uses RISKMON to map your CUI data flows, model the threats against them, and prioritize the controls that remove the most risk first. That sequencing keeps momentum and gets your SPRS score climbing quickly.
Top tip
Not all 110 controls carry equal weight in the SPRS scoring model—some deduct 5 points if unmet. RISKMON aligns risk-based prioritization with SPRS impact, so your roadmap improves both your security and your score at the same time.
Scoping CUI Precisely
Level 2 assessments hinge on correctly identifying where CUI lives and how it moves. Over-scope and you'll secure systems that never touch CUI; under-scope and you'll fail. NOXMON's RISKMON-driven asset categorization separates CUI assets, security protection assets, and out-of-scope systems with documented justification.
- NIST SP 800-171 controls assessed at Level 2
- 110
- C3PAO assessment cycle
- 3yr
- Maximum SPRS score
- 110
The Bottom Line
CMMC Level 2 is demanding, but it's achievable with the right sequencing and evidence. NOXMON combines defense-sector experience with the RISKMON platform to protect CUI, maximize your SPRS score, and walk into a C3PAO assessment ready.
Prepare for CMMC Level 2 with NOXMON and RISKMON.