Key points
- CMMC Level 2 self-assessments now require a minimum score of 88 out of 110 points.
- Contractors must implement all requirements worth three or five points, plus specific one-point controls.
- Unmet requirements trigger a 180-day clock to close gaps, after which Conditional status expires.
Defense contractors must now achieve a minimum score of 88 on CMMC Level 2 self-assessments to maintain contract eligibility, according to research published by Huntress. This new floor replaces older assessment methods that allowed lower scores, creating a stricter compliance environment for suppliers working with the Department of Defense. The change affects how organizations report their security posture in the Supplier Performance Risk System.
In plain English
Under previous rules, contractors could report any score on self-assessments, even negative values indicating no progress. The new CMMC Level 2 framework, governed by DFARS 252.204-7021, mandates a higher standard. Organizations must implement all security controls worth three or five points. Additionally, they must satisfy a specific list of one-point requirements. These non-negotiable items alone account for 64 points, or 85 percent of the total possible score.
The background
Legacy assessments under DFARS 252.204-7019 allowed contractors to defer requirements and report scores ranging from -203 to 110. The new methodology aligns with 32 CFR 170.21, which defines Conditional Level 2 status. This regulation sets the 88-point minimum and specifies which controls are mandatory. The shift removes the flexibility contractors previously had to choose which NIST 800-171 requirements to implement or skip during their initial compliance efforts.
What changes now
Contractors submitting a self-assessment with any unmet requirements start a 180-day clock to fix those gaps. If the organization fails to close out those items and update its status in SPRS within that period, the Conditional Level 2 status expires. This expiration can silently disqualify a company from bids submitted during that timeframe. Huntress notes that 32 of the 55 requirements it documents are now non-negotiable, requiring specialized capabilities like continuous monitoring and incident handling.
What to do and how to stay safe: CMMC
- Review your current self-assessment score against the new 88-point minimum requirement.
- Identify and implement all three-point and five-point controls immediately, as these are mandatory.
- Monitor the 180-day clock for any open Plan of Action and Milestones (POA&M) items.
- Update your status in the Supplier Performance Risk System before the conditional period expires.
Step-by-step guide: Smartphone Security Updates for Small Business Operations
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the minimum score required for CMMC Level 2?
The minimum score is 88 out of 110 points, representing 80% of the requirements.
Which controls are non-negotiable in CMMC Level 2?
All requirements worth three or five points, plus a specific list of one-point requirements, must be implemented.
What happens if a contractor fails to meet the score?
Submitting an assessment with unmet requirements starts a 180-day clock; failure to fix them causes status expiration.
