What are the latest requirements for CMMC Level 2 certification assessments by a C3PAO in 2026?

The specific requirements for a CMMC Level 2 certification assessment by a C3PAO in 2026 are the 110 requirements of NIST SP 800-171 Revision 2. The CMMC Program rule, 32 CFR 170.4, details that Level 2 is either a self-assessment or a certification assessment by a C3PAO. Even though the Department suspended Phase II of CMMC implementation in July 2026, all Phase 1 self-assessment requirements remain in place. This means the underlying security practices for Level 2 are still in effect. A C3PAO would look for your firm's implementation of each of the 110 NIST SP 800-171 Revision 2 requirements during the assessment process. This includes examining policies, procedures, and technical controls to ensure they are in place and operating effectively to protect controlled unclassified information.