A CMMC Level 2 vulnerability management program succeeds when you run risk-based scanning on a defined cadence and on new advisories, correct flaws within set timeframes, protect systems from malicious code, and keep evidence tied to the in-scope asset inventory.
CMMC Level 2 expects you to protect backup CUI and prove that you can restore systems, so design backup and recovery with FIPS-validated protection, tested restores, and clear scope across primary and backup locations.
Contractors should verify Cyber AB authorization, independence, ISO/IEC 17020 status, and alignment to the CAP and NIST SP 800-171 when choosing a C3PAO for future CMMC Level 2 assessments, while using Microsoft resources as implementation references, not as assessment criteria.
NIST published SP 800-171 Revision 3 in May 2024, but DoD contracts and CMMC assessments still point to Revision 2; use Rev 2 for assessments now and prepare your program to absorb Rev 3’s structure, alignment with SP 800-53 Rev 5, and organization-defined parameters.
On July 13, 2026 the Department of War suspended the November 2026 CMMC Phase 2 transition, restricted new procurements to Level 1 and Level 2 self-assessments, and launched a 60-day review of the certification program. DFARS 252.204-7012 remains in effect.
Contractors that place CUI in a cloud must require FedRAMP Moderate authorization or documented equivalency, and the provider must prove it with a FedRAMP-recognized 3PAO assessment, a complete Moderate baseline implementation, and a body of evidence that clarifies shared responsibility.