Florida companies that hold or pursue Department contracts should determine whether a solicitation or contract involves Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), then confirm the required CMMC status. This guide explains what CMMC Level 2 means today, what to prioritize, and how to prepare without relying on outdated timelines.
What CMMC Means Today
The Cybersecurity Maturity Model Certification (CMMC) program is the Department’s framework for assessing how defense contractors safeguard FCI and CUI. Its requirements are tied to the information a contractor handles and the CMMC status stated in the applicable solicitation or contract. The governing CMMC rule incorporates the security requirements in NIST SP 800-171 Revision 2 for Level 2.
Current program status matters. Phase I began on November 10, 2025. The Department’s current guidance says implementation remains paused in Phase I following the July 13, 2026 suspension of Phase II requirements. Phase I self-assessment and annual affirmation obligations remain in place, and contractors should always follow the precise language in their solicitations and contracts.
What Is CMMC Level 2?
CMMC uses a tiered model. Level 1 addresses basic safeguarding of FCI. Level 2 is intended for organizations that process, store, or transmit CUI. Level 3 is reserved for selected higher-priority programs.
- Level 1 (Self): 15 safeguarding requirements under FAR 52.204-21, an annual self-assessment, and annual affirmation.
- Level 2 (Self): 110 security requirements from NIST SP 800-171 Revision 2, a self-assessment every three years, and annual affirmation.
- Level 2 (C3PAO): Third-party assessment requirements were scheduled for Phase II. Because Phase II is currently suspended, verify the applicable contract and current Department guidance before planning an assessment.
For a Florida defense contractor, the practical question is not simply “Do we need CMMC?” It is: what information is in scope, where does it flow, what does the contract require, and can we produce objective evidence that the required controls operate as intended?
The 110 Level 2 Requirements: What They Cover
Level 2 aligns to 110 NIST SP 800-171 Revision 2 requirements across 14 domains. A successful program combines technical controls, operating procedures, documentation, and evidence.
| Domain | Examples of What to Validate |
|---|---|
| Access Control (AC) | Authorized access, least privilege, remote-access rules, and account reviews |
| Audit & Accountability (AU) | Logging, retention, review procedures, and investigation evidence |
| Configuration Management (CM) | Secure baselines, approved changes, and asset configuration records |
| Identification & Authentication (IA) | Strong authentication, credential management, and multi-factor authentication where required |
| Incident Response (IR) | Documented response process, exercises, and applicable DFARS reporting procedures |
| Maintenance (MA) | Controlled maintenance activity, including remote maintenance |
| Media Protection (MP) | CUI handling, storage, transport, sanitization, and destruction controls |
| Personnel Security (PS) | Access changes for onboarding, transfers, and terminations |
| Physical Protection (PE) | Physical access safeguards for in-scope systems and locations |
| Risk Assessment (RA) | Risk and vulnerability assessment processes with documented remediation |
| Security Assessment (CA) | System Security Plan (SSP), assessment evidence, and POA&M governance |
| System & Communications Protection (SC) | Encryption, segmentation, boundary protections, and secure communications |
| System & Information Integrity (SI) | Malware protections, patching, monitoring, and corrective action |
| Awareness & Training (AT) | Role-appropriate security awareness and training records |
What Florida Defense Contractors Should Do First
- Read the contract and identify the required CMMC status. Requirements are contract-specific. Review the solicitation, contract clauses, and CUI flow-down language rather than relying on a generic deadline.
- Map the CUI boundary. Identify where CUI enters, is stored, processed, transmitted, backed up, printed, and shared with subcontractors or external service providers.
- Build and maintain an evidence-backed SSP. A concise, accurate System Security Plan should describe the scoped environment, each requirement, responsible roles, and supporting evidence.
- Govern POA&Ms carefully. Level 2 self-assessment POA&Ms are limited by the CMMC program and must be closed within the applicable time frame. Track owners, dates, evidence, and residual risk.
- Validate incident reporting readiness. Where DFARS 252.204-7012 applies, contractors must be prepared to rapidly report covered cyber incidents through the required process. Confirm legal, contract, technical, and communications roles before an event occurs.
Common CMMC Readiness Gaps
Many small and mid-sized DIB organizations have capable IT teams but lack a defined CUI boundary and defensible evidence. The following gaps frequently delay readiness:
- No CUI inventory or data-flow map. Organizations cannot reliably protect or scope information they have not identified.
- Uncontrolled devices and accounts. Personal or unmanaged endpoints and accounts should not access in-scope CUI unless they are brought into the authorized, managed environment.
- Weak logging and evidence retention. Controls may exist, but assessment evidence, log-review records, and change documentation are missing.
- Cloud assumptions. Review cloud services against contractual requirements and the scoped CUI architecture. Microsoft 365 GCC or GCC High decisions should follow a documented scope and service review.
- Untested incident response. A written plan alone is not enough. Teams need a tested process, current contacts, and a clear decision path for contractual reporting obligations.
- Unmanaged subcontractor flow-down. When CUI is shared downstream, review contract requirements, scope, and evidence expectations with each relevant subcontractor.
How Invincia Supports CMMC Readiness
Invincia Technologies helps Florida DIB organizations build practical, supportable compliance programs. Our Defense Industrial Base IT services combine CMMC readiness planning with managed cybersecurity, Microsoft 365 and cloud architecture, documentation, and ongoing operational support.
- CMMC readiness assessment: Gap analysis against the Level 2 requirements, prioritized by risk and operational impact
- CUI scoping and system documentation: Support for data-flow mapping, CUI boundary definition, and SSP development
- Security operations: Managed endpoint protection, monitoring, vulnerability management, backup, and incident-response readiness
- Microsoft 365 and cloud planning: Architecture and migration guidance aligned to your contractual CUI requirements
- Evidence and compliance management: Help establishing repeatable evidence collection, POA&M tracking, and control ownership
Current CMMC Timeline and Next Steps
Do not base a compliance plan on an old Phase II date. The current official guidance says CMMC implementation remains in Phase I, while Phase II requirements have been suspended. That does not remove the requirement to safeguard covered information or to meet contract-specific obligations. Review the current CMMC guidance, the CMMC program rule, and the applicable DFARS 252.204-7012 clause with your contracts and legal/compliance advisors.
If your organization holds or pursues Department contracts, Invincia can help you establish a practical CMMC readiness plan that fits your environment. Call 727-674-1455 or contact Invincia Technologies to begin a CMMC readiness discussion.