CMMC Level 2 sets 88-point minimum score and strict implementation mandates for contractors

Huntress published first-hand research detailing the non-negotiable requirements for CMMC Level 2 compliance, revealing that defense contractors can no longer dictate which NIST SP 800-171 controls to defer. The new framework imposes a rigid scoring floor and mandatory implementation of high-value security controls, fundamentally changing how organizations approach their cybersecurity posture under the DFARS 252.204-7021 clause.

Contrary to legacy self-assessment methods that allowed contractors to report scores ranging from -203 to 110, the current CMMC Level 2 methodology mandates a minimum score of 88. According to Huntress, this score represents 80% of the 110 requirements in the model. Organizations must implement all requirements worth three or five points, as well as a specific list of one-point requirements, to achieve Conditional Level 2 status.

Scoring Mechanics and Compliance Floors

The non-negotiable requirements from NIST SP 800-171 yield a baseline score of 64, which accounts for 85% of all possible points in the scoring methodology. This leaves contractors with limited flexibility, requiring them to select and implement 24 of the remaining 46 one-point requirements to reach the mandatory 88-point threshold. These selections must be submitted to the Department of Defense Supplier Performance Risk System (SPRS) to validate eligibility for contract awards.

The difficulty in achieving compliance stems from the pairing of CMMC point values with the self-assessment requirements outlined in DFARS 252.204-7021. This clause replaces the previous DFARS 252.204-7019 and 252.204-7020 provisions. The new scoring methodology is also referenced by DFARS 252.204-7997, which directs government DIBCAC assessments to use the same point values, ensuring consistency between contractor self-assessments and official government evaluations.

Impact on Contract Eligibility and Timelines

Submitting a CMMC Level 2 self-assessment with any unmet requirements triggers a strict 180-day period to close out those items. According to Huntress, failing to complete these remaining items and update the CMMC Status in SPRS within this window causes the Conditional status to expire. This mechanism poses a significant risk for contractors who submit less-than-perfect assessments, as their eligibility may expire earlier than anticipated.

Contractors must be vigilant about this expiration timeline, as an expired self-assessment can silently disqualify a company from bids submitted during that timeframe. Huntress notes that organizations should not assume annual affirmations will override this requirement; if the 180-day clock expires before the assessment is updated, the contractor loses its standing in the system. This creates a scenario where a single missing requirement or delayed remediation can void contract award eligibility.

What should you do?

Organizations subject to CMMC Level 2 requirements should audit their current NIST SP 800-171 implementation against the new 88-point minimum score. Verify that all three-point and five-point controls are fully operational and documented. Monitor the SPRS portal regularly to ensure that any Plan of Action and Milestones (POA&M) items are closed within the 180-day window to maintain Conditional Level 2 status.

What to do and how to stay safe: CMMC

• Review your current NIST SP 800-171 implementation to ensure all three-point and five-point requirements are fully met, as these are non-negotiable for CMMC Level 2 compliance.
• Calculate your potential self-assessment score to confirm you can reach the minimum 88 points by selecting appropriate one-point controls from the remaining 46 available options.
• Monitor your Plan of Action and Milestones (POA&M) closely to ensure all unmet requirements are resolved and updated in the Supplier Performance Risk System within 180 days of submission.
• Verify that your affirming official checks the SPRS portal regularly to confirm that your Conditional Level 2 status has not expired due to unresolved assessment items.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the minimum score required for CMMC Level 2 self-assessment?

The minimum score required is 88 out of 110 points, which represents 80% of the total requirements in the NIST SP 800-171 model.

Which CMMC requirements are mandatory regardless of the score?

All requirements worth three or five points must be implemented, along with a specific list of one-point requirements, to achieve Conditional Level 2 status.

What happens if a contractor fails to close out unmet requirements within 180 days?

The Conditional Level 2 status expires, which can silently disqualify the contractor from bid eligibility until the assessment is updated in SPRS.