32 CFR Part 170 / NIST SP 800-171 Rev. 2
CMMC Level 2 compliance and evidence software.
CMMC Level 2 assesses the 110 requirements of NIST SP 800-171 Rev. 2. PolicyCortex records the state of your cloud, every change to it, and every machine action against those requirements, hash chained inside your tenant, and hands your C3PAO a package built to be verified by recomputation rather than believed.
What a Level 2 assessment asks you to prove
CMMC Phase II is suspended. On July 13, 2026 the Department suspended the Phase II transition and pending and future implementation milestones pending a reform review; no replacement date has been announced. Phase I self-assessments and DFARS 252.204-7012 safeguarding obligations remain, and the Department has named NIST SP 800-171 Rev. 2 as the interim enforcement baseline: 110 requirements across 14 families, checked through self-assessment and selected government-led assessments.
The obligation is evidence, not narrative. For each requirement the assessor wants the technical state that satisfies it, the record of who or what changed that state and under what authority, and proof that the package handed over is the package that was assessed. The SPRS score you affirm rests on the same rows.
- cmmc.baseline
- NIST SP 800-171 Rev. 2: 110 requirements, 14 families. The interim baseline named by the Department.
- cmmc.phase-ii
- Suspended 2026-07-13 pending a reform review; no replacement date announced. Phase I self-assessment requirements remain in place.
- cmmc.levels
- Level 1 self-attestation, Level 2 C3PAO assessment, Level 3 DIBCAC assessment, under 32 CFR Part 170.
- cmmc.boundary
- The CUI enclave is a declared scope on every record. Azure Government, AWS GovCloud, and GCC High are observed clouds.
- cmmc.source
- Department of War release, July 13, 2026 (official release); the site's explainer: what changed and what to do.
- cmmc.handoff
- The eMASS and C3PAO handoff package: what the assessor receives and how they verify it by hash.
The evidence a C3PAO receives for the 110 requirements
One evidence base for the 110 requirements, handed to the assessor as generated evidence with the raw payload attached. The families below are where the three proofs file.
- AC · IA · SC
- Proof of state: point-in-time captures of access control, identification, and system protection settings, content hashed and regenerable to the date the assessor names.
- CM · AU
- Proof of change: who or what altered a CUI-scope resource, under what authority, with before and after hashes and a rollback identifier, on a chain that cannot be edited without detection.
- Machine actions
- Proof of agency: the envelope that permitted each autonomous action, the record of what it did, and the counterfactual that would have blocked it one notch different.
- SSP · POA&M · SAR
- Generated from the one implementation record, not written beside it. Exports as OSCAL 1.1.2 with an eMASS and C3PAO handoff package.
- SPRS
- SPRS-relevant evidence carried per requirement, so the score you affirm rests on rows you can recompute.
How the C3PAO verifies the record
For Level 2 the recomputation is the C3PAO's: the OSCAL 1.1.2 package and the eMASS handoff carry the digests, so the assessor can confirm that the package handed over is the package that was assessed.
Every record PolicyCortex writes for this obligation is content hashed with SHA3-256 in an append-only chain with declared gaps for any unobserved interval, so any second party can recompute the log independently without our API.
Access and onboarding inside a CUI enclave
During agreed read-only onboarding in Azure Government, AWS GovCloud, or GCC High, the CUI enclave boundary is declared on every record and captured evidence is mapped to the 110 requirements.
- eval.mode
- SHADOW. Watch only; nothing executes.
- eval.onboarding
- Access is reviewed. Scope and onboarding are agreed with your team.
- eval.location
- Your tenant. Azure, AWS, and GCP are observed clouds, including AWS GovCloud, Azure Government, and GCC High.
- eval.egress
- None. No telemetry pipeline to PolicyCortex servers; no evidence leaves the tenant.
- eval.after
- You keep the records. Licensing is annual and the tenant owns the evidence; a delivery engagement is optional.
Delivery, if you want the record stood up for you
If you want the record stood up for you, the delivery engagement is 30 days at a fixed fee agreed with the scope, one primary cloud environment. A cleared delivery team collects the evidence, writes the policies and assessment documents, coordinates approved technical remediation, prepares control owners, and stays through assessor review for in-scope follow-up at no additional cost. The independent assessor makes the certification decision. No certification is guaranteed.
- engagement.price
- Fixed fee, agreed with the scope before work begins. No hourly, no overages.
- engagement.scope
- 30 days. One primary cloud environment. NIST SP 800-171 Rev. 2, 110 requirements.
- engagement.package
- SSP, POA&M, OSCAL 1.1.2 bundle, and the evidence behind them, organized by control objective.
- engagement.review
- In-scope assessor follow-up is included. The C3PAO remains independent and makes the decision.
Questions assessors and buyers ask
Did the Department of War cancel CMMC?
No. On July 13, 2026, the Department suspended the Phase II transition and pending and future implementation milestones pending a reform review, and no replacement date has been announced. All Phase I self-assessment requirements remain in place.
What remains enforceable during the pause?
The Department says NIST SP 800-171 Rev. 2 will be enforced through self-assessments and selected government-led assessments. DFARS 252.204-7012 safeguarding obligations also remain contractually binding.
Does PolicyCortex make us compliant?
No. It produces the records compliance decisions rest on. The authorizing official, the C3PAO, or the accountable official makes the determination; PolicyCortex hands them evidence they can recompute instead of a narrative they have to believe.
Level 2 or Level 3, which do we need?
Most contractors handling CUI need Level 2, assessed by a C3PAO. Level 3 applies to organizations supporting high-priority programs and is assessed by DIBCAC. The evidence base is the same; the control selection differs.
What does the delivery engagement include?
Thirty days, one primary cloud environment, a fixed fee: the 110-requirement baseline, CUI boundary analysis, coordinated and approved technical remediation, an SSP, POA&M, and OSCAL bundle with the evidence behind them, and support through assessor review. The independent assessor decides; no certification is guaranteed.
Does PolicyCortex submit to CMMC eMASS?
No. Your C3PAO controls the official assessment package and eMASS submission. PolicyCortex prepares the control-mapped evidence, change history, SSP, POA&M, and OSCAL bundle so the assessor can review, select, and submit with less manual cleanup.
Can we use a different C3PAO?
Yes. The output is C3PAO-agnostic: the OSCAL package and evidence bundle work with any C3PAO. We do not lock you to an assessor.
What about CMMC 2.0 versus 3.0?
The current CMMC final rule (32 CFR Part 170) defines three maturity levels: Level 1 self-attestation, Level 2 C3PAO assessment, Level 3 DIBCAC assessment. The record is kept against the requirement text in force; a revision is a new mapping over the same rows, and existing evidence is not relabeled.
What happens when a collector is down?
The chain carries a declared gap: the stream, the interval, the reason, and when it was declared. Evidence never silently has fewer rows.
Hand the assessor a package built to be verified.