CMMC Level 2 Compliance Checklist: Everything Defense Contractors Need in 2026

Why CMMC Level 2 Matters Right Now

The Department of Defense's CMMC Phase 2 enforcement deadline was November 2026 (see the correction above). Defense contractors handling Controlled Unclassified Information (CUI) must achieve CMMC Level 2 certification — or lose their contracts.

CMMC Level 2 maps directly to all 110 security requirements in NIST SP 800-171 Rev 2. No exceptions. No partial credit.

The 17 CMMC Level 2 Domains

CMMC Level 2 spans 17 domains:

• AC — Access Control (22 practices): Who can touch CUI and when
• AT — Awareness and Training (3 practices): Every employee who touches CUI needs training
• AU — Audit and Accountability (9 practices): Tamper-evident logs of all CUI access
• CA — Assessment, Authorization, and Monitoring (9 practices): Continuous system assessment
• CM — Configuration Management (9 practices): Baseline configs, change control
• IA — Identification and Authentication (11 practices): MFA, password policies
• IR — Incident Response (3 practices): Detection, response, recovery plans
• MA — Maintenance (6 practices): Controlled maintenance of CUI systems
• MP — Media Protection (9 practices): How you handle, store, and destroy CUI media
• PE — Physical Protection (6 practices): Physical access to CUI systems
• PS — Personnel Security (2 practices): Background checks, termination procedures
• RA — Risk Assessment (3 practices): Periodic risk assessments
• CA — Security Assessment (4 practices): Annual assessments
• SC — System and Communications Protection (16 practices): Network segmentation, encryption
• SI — System and Information Integrity (7 practices): Malware protection, patch management
• SR — Supply Chain Risk Management (3 practices): Vendor vetting
• SA — Software and System Acquisition (3 practices): Secure development

The AI Blind Spot Every Auditor Will Check

Here's what most checklists miss: AI tools are a CMMC landmine.

When your employees use ChatGPT, Copilot, Claude, or any cloud-based AI with CUI in prompts, that data leaves your network and travels to a third-party server. That is a CMMC violation. Full stop.

NIST 800-171 3.13.1 requires you to "monitor, control, and protect communications at the external boundary." Sending CUI to an AI API is not monitored, not controlled, and not protected.

C3PAO assessors are specifically trained to look for AI usage in 2026 assessments. Don't hand them an easy deficiency.

How to Fix the AI Problem

You have two options: ban AI entirely (not realistic) or deploy a local-only AI proxy that scans prompts before they leave your network.

HoundShield is the only AI compliance firewall built specifically for CMMC. One URL change, sub-10ms scanning, tamper-evident PDF evidence your C3PAO assessor can review on-site.

The 30-Day Sprint to C3PAO-Ready

1. Days 1-5: System Security Plan (SSP) gap analysis against all 110 controls
2. Days 6-10: Remediate Critical/High gaps (access control, encryption, MFA)
3. Days 11-15: Deploy AI DLP proxy, document CUI data flows
4. Days 16-20: Evidence collection — screenshots, logs, config exports
5. Days 21-25: Internal mock assessment
6. Days 26-30: Final SSP review, C3PAO scheduling