Defense contractors preparing for CMMC Level 2 certification face 110 controls mapped from NIST SP 800-171 Rev 2. Most teams focus on the obvious ones — encryption, multi-factor authentication, antivirus. Those matter, but they're rarely where assessments stall.

After supporting multiple organizations through C3PAO assessments, we've identified the 10 controls that fail most often. They share a pattern: each one sounds straightforward on paper but requires evidence that most organizations haven't documented.

Want the one-page version? We turned this list into a printable pass/fail Quick-Check you can score in 10 minutes. Download it free.

The 10 Controls

AC.L2-3.1.3 Control CUI Flow

This control asks: can you show exactly where Controlled Unclassified Information moves across your network? Not just where it's stored, but every hop — email, file shares, backups, printers, cloud services. Most organizations have a network diagram but not a CUI data-flow diagram. The assessor will ask for one.

Fix: Trace one piece of CUI from creation to disposal. Document every system and person it touches. That's your data-flow diagram.

AC.L2-3.1.5 Least Privilege

The principle is simple: users get only the access they need. In practice, most organizations have admin accounts shared between IT staff, service accounts with domain admin rights, and users with access to file shares they don't need. Assessors look for a privilege review process, not just a policy statement.

Fix: Export your AD group memberships. Identify users with admin rights who don't need them. Document the review and your remediation timeline.

AU.L2-3.3.1 System Auditing

CMMC requires that you create and retain audit logs for events that could affect CUI — logins, file access, privilege changes, failed auth attempts. The control itself is usually met (most systems log by default), but the retention and review requirements trip teams up. Logs must be retained long enough to support investigation and reviewed regularly enough to detect anomalies.

Fix: Verify your log retention period meets your SSP's stated timeframe. Set up a weekly log review cadence and document it.

AU.L2-3.3.2 User Accountability

Every action on a CUI system must be traceable to an individual user. Shared accounts, generic "admin" logins, and service accounts without clear ownership all violate this. The assessor will ask who used an account at a specific time — if you can't answer, this control fails.

Fix: Eliminate shared accounts. Assign a named owner to every service account. Enable individual user attribution in every system that handles CUI.

CM.L2-3.4.1 System Baselines

This control requires documented, maintained baselines for all CUI systems — hardware, software, firmware, and configuration. Most organizations have an inventory but not a baseline configuration that defines the approved state. Without a baseline, you can't detect unauthorized changes.

Fix: For each CUI system, document the approved OS version, installed software, enabled services, and key configuration settings. Date the baseline and assign an owner.

CM.L2-3.4.2 Security Configuration Enforcement

Beyond having baselines, you must enforce security configuration settings. STIGs (Security Technical Implementation Guides) or CIS Benchmarks are the standard reference. The gap is usually not that settings are wrong but that enforcement isn't automated or monitored. Manual configuration checks don't scale and drift between audits.

Fix: Pick a benchmark (DISA STIG or CIS). Apply it with Group Policy, Intune, or Ansible. Run a compliance scan and keep the report.

IA.L2-3.5.3 Multi-Factor Authentication

MFA itself is well understood, but the scope requirement catches teams. CMMC Level 2 requires MFA for all network access to privileged and non-privileged accounts on CUI systems — not just VPN and email. On-premises applications, RDP sessions, and database access are often left out.

Fix: List every authentication point on CUI systems. Verify MFA is enforced on each, including on-prem and RDP, not just cloud services.

SC.L2-3.13.1 Boundary Protection

CUI must be monitored and controlled at system boundaries — everywhere data enters or leaves your network. The gap is usually in outbound monitoring. Most organizations have firewalls for inbound traffic but limited visibility on what data leaves the network, especially through encrypted channels, cloud sync, or USB devices.

Fix: Document every boundary where CUI enters or exits. Verify you have controls (DLP, proxy, firewall rules) at each point. Pay special attention to outbound.

IR.L2-3.6.1 Incident Handling

You need an incident response plan that covers preparation, detection, analysis, containment, recovery, and post-incident activity. The plan must be tested. Most organizations have a plan document, but it hasn't been exercised, and it doesn't include CUI-specific response procedures. The assessor will ask when you last tested it.

Fix: Run a tabletop exercise. Document the scenario, participants, findings, and corrective actions. Date it.

RA.L2-3.11.1 Risk Assessments

A periodic risk assessment is required — not just at initial certification but on an ongoing basis. The assessment must cover the operation of CUI systems and consider threats, vulnerabilities, likelihood, and impact. A risk register with generic entries ("malware: high risk") won't pass. Assessors want to see threat-specific analysis tied to your environment.

Fix: Conduct a risk assessment specific to your CUI environment. Identify real threats (insider, ransomware, supply chain), map them to your systems, score likelihood and impact, and document remediation priorities.

The Pattern

All 10 share a theme: the technical control is often in place, but the evidence is missing. A firewall exists but there's no boundary documentation. Logs are collected but there's no review cadence. MFA is deployed but doesn't cover every access point.

CMMC assessments are evidence-driven. The assessor doesn't ask "do you have a firewall?" — they ask "show me the documentation, the configuration, and the last review." The organizations that pass build the evidence habit before the assessment, not during.

What to Do Next

Start with a self-assessment: score each of the 110 Level 2 controls as Met, Not Met, or Partially Met. The gaps will cluster around the 10 areas above. From there, build a POA&M with realistic timelines and evidence milestones — not just completion dates.

Get the CMMC Quick-Check (Free)

One page. 10 controls. Pass/fail checkboxes. Score your readiness in 10 minutes.

Download the Quick-Check

If you want the full self-assessment covering all 110 controls with a built-in scoring sheet, our CMMC Level 2 Self-Assessment Template ($40) does the work for you. And if you want a second set of eyes, we're here.