CMMC 2.0 Level 2 Supply Chain Practice Evidence Requirements

CMMC 2.0 Level 2 supply chain compliance depends on specific, verifiable evidence. Contractors must have artifacts an assessor can check to back up their risk decisions, technical controls, software records, and subcontractor oversight. Contractors should build that evidence into normal operations before the next contract award so it is ready when an assessment begins.

What CMMC 2.0 Level 2 actually requires contractors to prove

Level 2 requires contractors to satisfy three conditions together. They must implement all 110 NIST SP 800-171 Rev. 2 requirements, subject to tightly limited POA&M allowances. Their System Security Plan and POA&M must describe how they work now. Their assessment artifacts must also map to the objectives in NIST SP 800-171A. Implementing a control without producing verifiable evidence scores the same as not implementing it, which makes proof part of the compliance obligation.

32 CFR §170.21 limits POA&M eligibility to 1-point requirements, with one narrow exception. SC.L2-3.13.11, CUI Encryption, may appear on a POA&M when encryption is employed but is not yet validated under federal cryptographic standards. Every other 3-point and 5-point requirement must be fully met at assessment. Conditional Level 2 status also requires a minimum SPRS score of at least 88, so contractors must have much of the work done even if they have a remediation plan.

As of August 2026, contractors still need Phase 1 self-assessments and SPRS submissions to be awarded a contract. The July 13, 2026 Phase 2 suspension paused third-party C3PAO assessments pending a DoD reform review, but did not suspend the controls or evidence obligations. DFARS 252.204-7012 obligations remain contractually binding wherever that clause exists.

Where supply chain risk management sits inside the 110-requirement structure

NIST SP 800-171 Rev. 2 has no control family set aside for Supply Chain Risk Management. Supply chain evidence therefore runs through the families that assessors already examine, primarily Risk Assessment, Configuration Management, Access Control, and Security Assessment. The CMMC Assessment Guide Level 2 v2.13 organizes the requirements across 14 control families. For practitioners, the important distinction is that supply chain risk is not a separate compliance track with a single document that settles it.

RA.L2-3.11.1, Risk Assessment, provides the starting point because it establishes whether third-party and vendor risks have been evaluated. Configuration Management then supplies evidence about the systems and dependencies through which those risks can enter operations. Access Control and Audit and Accountability address third-party access and the records needed to examine it. Security Assessment connects implementation to the SSP, assessment results, and remediation evidence.

That map also has a boundary beyond the contractor’s systems. Flow-down obligations require contractual and procedural proof that the necessary certification requirements reach the subcontractor chain and are enforced. NIST SP 800-171r3 has a dedicated SCRM family that covers acquisition strategies, vendor controls, and disposal procedures, while NIST SP 800-172 provides guidance for the higher tiers. Those distinctions matter because the 110-requirement Rev. 2 evidence map does not require a separate SCRM plan that covers all of those areas.

What assessors examine in Risk Assessment and why a draft SSP fails

A risk assessment anchors the evidence that an organization has identified, evaluated, and prioritized supply chain threats. The CMMC Assessment Guide Level 2 v2.13 excludes draft policies and documentation because they are not official and remain subject to change. A detailed draft risk assessment therefore does not establish that the organization has an adopted assessment. The same problem applies to a draft SSP, regardless of how much work has gone into it.

An official SSP must also match the operating environment. Assessors compare its system boundary, data flows, and control descriptions with interviews and configuration reviews. A mismatch is a finding. The Cabrillo Club engagement had a control-by-control assessment and evidence register in place before remediation began.

Currency matters after the assessment as well. Annual affirmation in SPRS requires the risk assessment to remain current across the assessment period. The POA&M must likewise identify allowable shortfalls, assign owners, set realistic remediation dates, and record actual progress rather than give every item the same future date and an “in progress” label. A passing risk assessment artifact is signed, dated, in final form, scoped to the actual CUI boundary, and explicit about third-party and vendor risk.

Configuration Management evidence and the drift problem assessors catch most often

Configuration drift makes a documented security baseline unreliable as evidence of actual system state. Baselines may be undefined, exceptions untracked, or endpoint configurations different across departments and vendors. An assessor who finds those differences has evidence of a Configuration Management failure even if the policy describes a consistent environment. For Conditional Level 2 status, contractors must have a baseline document and proof that they enforce baselines and track deviations.

The Cabrillo Club engagement identified precisely this gap. Baselines were not defined, exceptions were not tracked, and endpoint configurations varied by department. Remediation required formalizing change control and configuration management before the pre-assessment review. The necessary artifacts include a baseline for each system type in scope, a change log identifying who approved deviations and when, and configuration exports or scan output showing that current state matches the baseline.

Declarative, version-controlled configuration management makes those records outputs of implementation. The declared state supplies the baseline, commit history supplies the change log, and deployment records show what ran where and when. A reproducible environment built from a pinned, human-readable manifest can also carry an input-derived identity attached to deployments. That allows manifest history to establish what ran on a particular date without reconstructing it from memory. A pipeline without traceability, however, can lead to findings in Configuration Management, Audit and Accountability, and System and Information Integrity.

Audit and Accountability evidence and what log collection without review produces

Configuration history establishes what changed, but audit evidence must also establish that recorded activity receives regular scrutiny. Logs collected in several places, without correlation or formal retention and review procedures, do not demonstrate an effective audit process. The CMMC Assessment Guide Level 2 v2.13 requires evidence that logs are reviewed, that reviews are documented, and that the process is repeatable.

For supply chain risk, that process must also cover what third parties and vendors do. When a managed service provider or subcontractor accesses systems that process CUI, its access events must appear in logs. Those logs must be retained under policy, and reviews must cover both internal users and non-employee accounts. Otherwise, the contractor’s audit evidence leaves a gap in the very activity its vendor risk claims are supposed to address.

The Cabrillo Club engagement found that log infrastructure was in place, but the required review process and retention policy were missing. Centralized logging, alerting, and an incident response tabletop were addressed in remediation sprint 2, during weeks 11–14. A pipeline that creates timestamped, tamper-evident records of commits, dependency scans, policy checks, and artifact promotions can supply audit evidence during ordinary work.

Software provenance and SBOM evidence for supply chain visibility

CISA, NSA, FBI, and international partners released the 2026 Minimum Elements for a Software Bill of Materials (SBOM), updating and replacing the NTIA’s 2021 minimum elements. The joint guidance establishes the current artifact expectations for an SBOM, including 10 new required data fields. Among them are Component Hash Value, Component Hash Algorithm, Component License, SBOM Author Signature, and SBOM Generation Context. The additions make the record more specific about component identity and how the SBOM was produced.

For assessment purposes, the SBOM is an ingredients list tied to software running on systems that process CUI. It supplies evidence that the contractor knows what that software contains. The 2026 joint guidance describes how a code commit can trigger vulnerability scans, predefined policy checks, and an updated SBOM, all in a complete pipeline record that can be audited. Producing that artifact during the build makes it sustainable as software changes, rather than a separate inventory exercise after release.

Pinned dependencies and reproducible builds from declared manifests support this approach because component data follows from the build inputs. An input-derived environment hash linked to those records helps show which deployments are affected when a new CVE appears. The joint guidance also says that AI software and SaaS in cloud environments may need more than the minimum elements. Organizations using AI-assisted development workflows should plan for that expanded SBOM scope.

Flow-down evidence and what primes must produce to cover their subcontractor chain

A prime contractor’s technical controls do not establish that its subcontractors meet their obligations. Flow-down evidence must show that subcontractors handling CUI are contractually required to meet the necessary standard and that the prime has procedures to verify compliance. This is a distinct evidence category, built from contracts and vendor oversight records. It extends through every tier of the relevant supply chain.

Prime contractors may flow Level 2 requirements to subcontractors before mandatory contractual inclusion. A subcontractor can therefore face evidence demands before formal program deadlines because of the prime’s risk management decisions. Under the CMMC Assessment Guide Level 2 v2.13, supply chain governance is part of what assessors check. The prime still needs records of its vendor oversight even when its own technical controls pass.

The consequences depend on the unmet requirement. Apart from the narrow encryption exception, high-weight deficiencies cannot be deferred through a POA&M and can require remediation and a new assessment. A contractor must pass before it can win contracts that require that CMMC level. The subcontractor register and contractual flow-down clauses are therefore foundational artifacts for reviewing supply chain risk posture.

Building an evidence register before the assessment rather than during it

An evidence register turns these separate obligations into an organized collection plan. It maps each of the 110 requirements to the artifact that satisfies it, the artifact’s location, and the owner responsible for keeping it current. That mapping exposes missing proof while there is still time to build it into remediation. It also distinguishes an implemented control from one whose effectiveness can actually be demonstrated.

The Cabrillo Club engagement set up its evidence register during weeks three through five, before remediation began. Its control-by-control assessment identified what proof was needed, where it would live, and who would own it. For SCRM, that register should connect the risk assessment to RA and the SSP and POA&M to Security Assessment and governance. It should also map configuration baselines and change logs to CM, review records and retention evidence to AU, and deployment-linked SBOMs to System and Information Integrity and provenance. Vendor registers and flow-down clauses complete the supply chain governance record.

The register is most useful when the evidence it points to is generated continuously. A manifest commit is a dated, attributed configuration record, while a pipeline run log is an audit trail and a deployment hash is a provenance artifact. Evidence readiness is therefore an engineering and operational design decision made before implementation is declared complete.

What the Phase 2 suspension means for evidence preparation right now

The Phase 2 suspension changed the assessment schedule. Effective July 13, 2026, it paused new Level 2 C3PAO and Level 3 DIBCAC status designations while a CMMC Reform Task Force conducts its review. It did not suspend the 110 NIST SP 800-171 Rev. 2 requirements, SPRS scoring, or the DFARS 252.204-7012 safeguarding clause.

Phase 1 self-assessments and SPRS submissions remain active conditions of contract award as of August 2026. Contracting officers are inserting CMMC clauses into new solicitations, and contractors must hold a valid assessment status before award. With hundreds of thousands of contractors affected, evidence readiness is also a potential systemic bottleneck. Building the evidence infrastructure now positions a contractor for eligibility rather than leaving its preparation dependent on the assessment calendar.

The immediate task is to maintain a current, mapped record across risk assessment, configuration, audit, software provenance, and subcontractor oversight. Supply chain evidence is the output of operations designed for traceability, reproducibility, and continuous verification.