01
The policy
A written document describing the practice, owner, scope, and process. Not a template. A document that describes what your organization actually does.
110 NIST 800-171 PracticesC3PAO Assessment PrepSSP + POA&M DeliveredMSSP-Grade Stack
CMMC Level 2 Consulting in Minneapolis
C3PAO-ready Level 2 consulting for Minneapolis DoD contractors handling Controlled Unclassified Information. Gap analysis, SSP, POA&M, technical remediation, assessment prep, and post-assessment program operation.
CMMC Level 2 is the compliance tier that does the actual work in the Department of Defense supply chain. It applies to contractors and subcontractors handling Controlled Unclassified Information (CUI): engineering drawings, technical data, export-controlled specifications, and the kinds of detailed program information that primes flow down to their machine shops, fabricators, electronics suppliers, and engineering subs every day. For most Minneapolis manufacturers and engineering firms in the DoD supply chain, Level 2 is the certification that determines whether your business is in or out for the next contract cycle.
McNallan Technology Solutions delivers CMMC Level 2 consulting as an MSSP-grade firm, not a paperwork-only consultancy. We operate the layered security stack that NIST SP 800-171 Rev 2 assumes: endpoint detection with human analyst review, application allowlisting, immutable backup, MFA enforcement, conditional access, tenant hardening, security awareness training, and 24/7 monitoring. When we engage a Minneapolis contractor for CMMC Level 2, we're not learning the controls on your dime. We're mapping what we already run to the 110 practices, closing the gaps, building the documentation, and preparing you for the C3PAO assessment. This page is part of our broader CMMC compliance practice for Minnesota.
Who needs CMMC Level 2?
You need CMMC Level 2 if your DoD contract or flow-down subcontract requires it under DFARS 252.204-7021, and the data you handle includes Controlled Unclassified Information. CUI is information the U.S. government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that requires safeguarding or dissemination controls under law, regulation, or government-wide policy.
For Minneapolis defense subcontractors, the most common CUI categories are:
- Controlled Technical Information (CTI): engineering drawings, blueprints, models, specifications, test data with military or space application
- Export-Controlled: ITAR (International Traffic in Arms Regulations) and EAR (Export Administration Regulations) data
- Procurement and Acquisition Sensitive (SP-PROCURE): pre-award proposal information, source selection material
- Critical Infrastructure Security Information
If any of those types of information shows up in your environment (email, file servers, cloud file shares, engineering workstations, ERP systems, project shares), you handle CUI, and Level 2 is your target.
CUI can sit in your environment without anyone noticing. A prime emails a drawing, and six months later it's still in someone's mailbox archive.
If you don't handle CUI and only handle Federal Contract Information, CMMC Level 1 readiness is the right target instead. Your contracts and your prime's flow-down clauses tell you which path applies.
What CMMC Level 2 requires
CMMC Level 2 maps to the 110 security practices in NIST SP 800-171 Revision 2, the National Institute of Standards and Technology's standard for protecting CUI in nonfederal systems. The 110 practices break across 14 control families:
- Access Control (AC): 22 practices
- Awareness and Training (AT): 3 practices
- Audit and Accountability (AU): 9 practices
- Configuration Management (CM): 9 practices
- Identification and Authentication (IA): 11 practices
- Incident Response (IR): 3 practices
- Maintenance (MA): 6 practices
- Media Protection (MP): 9 practices
- Personnel Security (PS): 2 practices
- Physical Protection (PE): 6 practices
- Risk Assessment (RA): 3 practices
- Security Assessment (CA): 4 practices
- System and Communications Protection (SC): 16 practices
- System and Information Integrity (SI): 7 practices
Practically, CMMC Level 2 is not a "buy a tool, check a box" project. It's a coordinated program covering identity management, endpoint security, network segmentation, data flow control, logging and audit, incident response, security awareness, configuration management, vulnerability management, vendor risk, and physical security. All documented, all evidenced, all maintained.
The C3PAO assessment: what your evidence has to show
For most CUI-handling contracts, CMMC Level 2 requires a triennial third-party assessment by a C3PAO accredited under the Cyber AB. Assessors evaluate every practice against NIST SP 800-171A objectives.
02
The procedure
The operational steps that implement the policy. How the control runs day-to-day, who executes it, and what triggers exceptions.
03
The artifact
A screenshot, configuration export, log excerpt, training record, or other tangible evidence. Proof that the control ran on a specific date.
04
The demonstration
The people who own each control should be able to show it working. Each C3PAO runs its assessment its own way, so be ready to demonstrate any of the 110 requirements on request.
This is where contractors get caught out. They have a binder with a policy. They have a tool deployed. They do not have evidence binding the policy, the tool, and the operational reality together. That gap closes only with disciplined evidence collection over the months leading up to the assessment.
The McNallan Technology Solutions Level 2 engagement
- Phase 1: Scoping and gap analysis (4-8 weeks). CUI flow analysis to define the smallest defensible CMMC assessment scope. Gap analysis against the CMMC Level 2 requirements. Deliverable: the results of the review and prioritized remediation recommendations. Scope matters: a 20-user engineering enclave is a much smaller project than a 200-user enterprise.
- Phase 2: Technical remediation (8-24 weeks). Identity management (managed identities, conditional access, phishing-resistant MFA). Endpoint security (managed EDR, application allowlisting). Microsoft 365 tenant hardening. Immutable backup with restoration testing. Network segmentation for CUI enclave. Centralized logging and audit. Security awareness training with phishing simulation.
- Phase 3: Documentation and policy (8-16 weeks, parallel). Complete Level 2 documentation package: System Security Plan (SSP), policy set, procedures, POA&M, asset inventory, and evidence library. The SSP describes what's actually running, not a template. A templated SSP that doesn't match reality creates additional findings during assessment.
- Phase 4: Assessment preparation and support (4-8 weeks). A final review of your environment and documentation against the requirements. Practice owners rehearse walking through their controls and evidence. We stay available to answer questions during the C3PAO assessment. We're not the assessor (that's an independence requirement), but we're the readiness partner on your side of the table.
- Post-assessment maintenance. CMMC Level 2 is triennial, but the controls run daily. Patch management, EDR alert review, backup restoration testing, security awareness cadence, audit log review, and POA&M closure all have to keep happening. Our managed clients keep the program running. If the program stops running after the assessment, the gaps come back before the reassessment.
Why McNallan Technology Solutions vs. a generalist MSP claiming "CMMC capability"
A lot of Minneapolis MSPs added "CMMC" to their service page in the last 24 months. The honest test, when you're evaluating a provider, is two questions:
Show me the stack. Ask the MSP to walk through, by name, the security tools they operate today on their existing managed clients. A generalist running a single endpoint product cannot deliver a layered NIST SP 800-171 Rev 2 program. The MSP vs MSSP distinction matters more for CMMC than for any other engagement, because Level 2 requires evidence that the controls actually run.
Show me the documentation. Ask to see (with names redacted) a sample System Security Plan they've delivered, a sample POA&M, a sample evidence library. Most generalists who claim CMMC capability cannot produce these. They have not done the work yet. You will be paying for their learning curve, with your contract eligibility on the line.
McNallan Technology Solutions runs the layered stack today, and we'll walk you through it. That's the test you should be running on any CMMC consultant you talk to in the Twin Cities.
FAQ
Common questions about CMMC Level 2
How long does CMMC Level 2 readiness take?
Six to twelve months from kickoff to C3PAO assessment for a typical Minneapolis defense subcontractor.
For a typical contractor, six to twelve months. Smaller, tighter scopes go faster. Larger environments, multi-site operations, or significant remediation extend the timeline. We give a firm scoped-engagement timeline after the initial scoping phase.
Can I self-assess CMMC Level 2?
For most CUI-handling contracts, no. The final rule requires a triennial C3PAO third-party assessment.
A narrow subset of Level 2 contracts allow self-assessment. The contract language determines which applies. Most Minnesota defense subcontractors handling CUI will need a C3PAO.
What if I can’t fully implement all 110 practices by the assessment?
The POA&M allows a constrained number of practices to be temporarily deficient with documented remediation plans.
Not every practice is POA&M-eligible. Only certain lower-weighted requirements can be deferred; the highest-weighted ones must be met at assessment. The assessment must reach at least 88 of 110 points (80%), and POA&M items must be closed within 180 days for Conditional status to become Final.
How does CMMC Level 2 relate to NIST SP 800-171?
The 110 CMMC Level 2 practices map directly to the 110 requirements in NIST SP 800-171 Rev 2.
DFARS 252.204-7012 has required NIST SP 800-171 compliance for CUI handlers since 2017. What’s new in CMMC 2.0 is the assessment, evidence, and certification process layered on top. If you already have a self-assessment on file, our readiness review checks it against what's actually running and gives you results and remediation recommendations.
My prime contractor is asking about our SPRS submission. What is that?
SPRS is the DoD’s database for tracking contractor performance, including NIST SP 800-171 self-assessment results.
Under DFARS 252.204-7019 and -7020, contractors handling CUI have been required to post a self-assessment in SPRS since November 2020. Primes increasingly check SPRS before flowing CUI work down. The self-assessment and the submission are yours; our readiness work gives you results and remediation recommendations so you know where you stand.
We have ITAR data. Does CMMC apply to us too?
Yes. ITAR-controlled technical data is a CUI category and is in scope for CMMC Level 2.
ITAR compliance and CMMC compliance are related but separate. ITAR has its own registration, recordkeeping, and access-control requirements. We address CMMC obligations in our engagements; ITAR-specific export compliance counsel is generally a separate engagement with a specialty law firm or trade compliance consultancy.
Get started with CMMC Level 2 consulting
If you're a Minneapolis DoD contractor or subcontractor handling CUI and need to be CMMC Level 2 ready for an upcoming contract or recertification cycle, talk to us. A 45-minute scoping call covers the contract requirements, your current security posture, where CUI lives in your environment, and what a scoped Level 2 readiness engagement would look like.
This is right for you if:
- You're a DoD contractor or subcontractor handling Controlled Unclassified Information (CUI)
- Your contracts include DFARS 252.204-7012 and a CMMC Level 2 requirement
- A prime contractor needs a certified subcontractor for the next flow-down
- You handle CTI, ITAR/EAR-controlled data, or other CUI categories
- You need a C3PAO-ready SSP, POA&M, and evidence library
- Your current MSP can't credibly run a layered NIST SP 800-171 Rev 2 program
Start with the CMMC compliance hub if you want the broader picture.
Get in touch
Inquire About Our Services
McNallan Technology Solutions works best with growth-focused Minnesota businesses (25+ employees) that view technology as a productivity investment, not a cost to minimize.
Prefer a real conversation? Skip the form and call us directly during business hours.
+1 763-424-3388Working hours
Mon–Fri
Emergency
8:00 AM – 5:00 PM
24/7 on-call support
Tell us what you’re working on
Share a few details and we’ll follow up with next steps and a clear path forward.
"*" indicates required fields