31 October 2026 · 11 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
CMMC 2.0 Penetration Testing: Where a Pentest Produces Objective Evidence for Your Level 2 or Level 3 Assessment
The CMMC programme rule (32 CFR Part 170) has been in force since 16 December 2024, and the acquisition rule that puts CMMC in DoD contracts started phasing in on 10 November 2025. From this point on, a defense contractor's cyber posture is assessed, not declared. Here is where penetration testing fits, which NIST SP 800-171 practices it evidences, and how to scope one around a CUI enclave.
What CMMC 2.0 is and who it applies to
The Cybersecurity Maturity Model Certification (CMMC) is the US Department of Defense's mechanism for verifying that contractors and subcontractors in the Defense Industrial Base (DIB) actually implement the safeguarding requirements they have been contractually bound to since 2017. Under DFARS 252.204-7012, any contractor that stores, processes or transmits Controlled Unclassified Information (CUI) must implement the 110 security requirements of NIST SP 800-171, report incidents to DoD within 72 hours, and flow those obligations down to subcontractors. For years, compliance was self-attested. CMMC replaces self-attestation with assessment.
Two rules make the programme real. The programme rule, 32 CFR Part 170, was published in October 2024 and took effect on 16 December 2024; it defines the levels, the assessment types, the assessor ecosystem and the scoring. The acquisition rule, the DFARS amendment that introduces clause 252.204-7021 into solicitations and contracts, was published in September 2025 and took effect on 10 November 2025. From that date CMMC requirements appear in new DoD solicitations in four phases: Phase 1 (from November 2025) relies on self-assessments; Phase 2 (from November 2026) requires Level 2 certification by a C3PAO where the contract calls for it; Phase 3 (from November 2027) adds Level 3; Phase 4 (from November 2028) applies CMMC to all applicable solicitations and contracts.
The population is large. Roughly 220,000 organisations are estimated to be in the DIB, from prime contractors to machine shops, software houses and engineering consultancies, and a meaningful share of them sit outside the United States. If your company handles CUI on behalf of a US prime, or on behalf of a subcontractor of a US prime, you are in scope regardless of where you are incorporated. The clause flows down to the level at which CUI stops flowing.
The three CMMC levels and what each demands
CMMC 2.0 collapsed the original five levels into three. The level a contract requires is set by the information involved, not by the size of the contractor.
Level 1 (Foundational): 15 practices, annual self-assessment
Applies to contractors that handle Federal Contract Information (FCI) but not CUI. The 15 practices come from FAR 52.204-21 and cover basic hygiene: access control, identification and authentication, media sanitisation, physical protection, boundary protection and flaw remediation. The contractor self-assesses every year and a senior company official affirms the result in the Supplier Performance Risk System (SPRS). Penetration testing is not required at Level 1, though a short external test is an inexpensive way to validate that the perimeter controls you have affirmed actually hold.
Level 2 (Advanced): 110 practices, C3PAO certification every three years
Applies to any contractor that handles CUI. The 110 practices are the requirements of NIST SP 800-171 Revision 2, grouped into 14 families and scored on the DoD assessment methodology. For most CUI contracts, certification must come from a CMMC Third-Party Assessment Organization (C3PAO) accredited by the Cyber AB, renewed every three years with an annual affirmation in between. A smaller set of programmes allows a Level 2 self-assessment. A contractor can receive a conditional certification with a minimum score of 88 out of 110 and a Plan of Action and Milestones (POA&M), which must be closed within 180 days or the certification lapses.
Level 3 (Expert): 110 practices plus 24 from NIST SP 800-172, assessed by DIBCAC
Applies to contractors supporting the most sensitive programmes, where the threat model includes advanced persistent threats. Level 3 requires a final Level 2 certification first, then adds 24 enhanced requirements selected from NIST SP 800-172, assessed by the DoD's own Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). This is the level where penetration testing becomes an explicit requirement: the enhanced requirement in the Security Assessment family calls for penetration testing at an organisation-defined frequency, using automated scanning tools and ad hoc tests by subject-matter experts, and CMMC assesses it as practice the NIST SP 800-172 enhanced Security Assessment requirement.
Where a penetration test produces objective evidence at Level 2
NIST SP 800-171 Rev. 2 does not use the words 'penetration test' at Level 2. Assessors nevertheless need objective evidence that controls are effective, and a well-scoped pentest is the most direct evidence available for these practices.
| CMMC practice | What the requirement says, in short | What a penetration test evidences |
|---|---|---|
| CA.L2-3.12.1 (Security assessment) | Periodically assess the security controls in organisational systems to determine whether they are effective in their application | An independent, adversarial test of the controls that protect the CUI boundary; the report is the assessment artefact, dated and signed by named testers |
| RA.L2-3.11.2 (Vulnerability scanning) | Scan for vulnerabilities periodically and when new vulnerabilities are identified | Authenticated and unauthenticated scanning of the in-scope assets, with manual verification that removes false positives and finds what scanners miss |
| RA.L2-3.11.3 (Vulnerability remediation) | Remediate vulnerabilities in accordance with risk assessments | A severity-rated findings list with remediation guidance and a retest that confirms closure, which is the evidence trail the POA&M process needs |
| SI.L2-3.14.1 (Flaw remediation) | Identify, report and correct system flaws in a timely manner | Exploitable missing patches and misconfigurations on CUI assets and Security Protection Assets, demonstrated rather than inferred |
| IR.L2-3.6.3 (Incident response testing) | Test the organisational incident response capability | A test window during which your SOC or MDR provider should detect and respond; the timeline of what was seen and what was not is direct evidence for this practice |
| SC.L2-3.13.1 and 3.13.5 (Boundary protection, DMZ) | Monitor, control and protect communications at external and key internal boundaries; separate publicly accessible components | Attempts to pivot from internet-facing systems or the corporate network into the enclave, which either fail (evidence) or succeed (a finding you want before the C3PAO does) |
| NIST SP 800-172 enhanced penetration testing requirement (Level 3 only) | Conduct penetration testing at an organisation-defined frequency with automated tools and subject-matter experts | The engagement itself, scoped to the CUI environment and documented against the frequency your System Security Plan (SSP) defines |
Scoping the test: the CUI boundary, enclaves and FIPS
CMMC is assessed against a defined boundary, and so should the penetration test be. The CMMC Level 2 Scoping Guide sorts assets into five categories: CUI Assets (process, store or transmit CUI), Security Protection Assets (provide security functions for the enclave, such as the firewall, the identity provider, the SIEM and the EDR console), Contractor Risk Managed Assets (could handle CUI but are policed not to), Specialized Assets (OT, IoT, test equipment, government-furnished equipment) and Out-of-Scope Assets. The first two categories are fully assessed; the test should cover them in the same way, because a weakness in a Security Protection Asset is a weakness in every control it supports.
Most mid-sized contractors reduce the boundary by building an enclave: a segregated environment, often a virtual desktop or a dedicated cloud tenant, where CUI lives and the rest of the business does not. The enclave is only as good as its edges. The questions a tester asks are the questions a C3PAO will ask: can an attacker who compromises a workstation on the corporate network reach the enclave? Can CUI leave the enclave by clipboard, print, email or an unmanaged cloud sync? Are the administrative paths into the enclave protected by multi-factor authentication that resists phishing? Does the enclave's remote access terminate on a hardened gateway or on a jump host that doubles as a file server?
Two further scoping points trip up assessments. First, practice SC.L2-3.13.11 requires FIPS-validated cryptography wherever cryptography protects the confidentiality of CUI, which means modules validated under FIPS 140-2 or 140-3 by the Cryptographic Module Validation Program, not merely 'AES'. A tester verifies what is actually negotiated on the wire and at rest. Second, external service providers that process CUI, including cloud providers, must meet FedRAMP Moderate or an equivalent level per the DoD's December 2023 memorandum on equivalency, and the shared-responsibility split must be written down. The penetration test covers your side of that split; the provider's attestation covers theirs.
What to have ready before the C3PAO arrives
A C3PAO assessment is an evidence exercise. The penetration test is one artefact among many, and it is most valuable when it is clearly tied to the others.
- A System Security Plan (SSP) that names the boundary, the asset categories and, for each of the 110 practices, how it is implemented; the pentest scope should quote the SSP boundary verbatim
- A network diagram and data-flow diagram showing where CUI enters, is processed, is stored and leaves, including every external service provider
- Your current SPRS score with the assessment date and methodology version, and the POA&M for any open items
- The penetration test report from the last 12 months, with scope, dates, named testers and credentials, methodology (NIST SP 800-115, PTES or equivalent), findings mapped to CMMC practices, and retest evidence
- Vulnerability scan results at the frequency your SSP commits to, with evidence that criticals were remediated within the timeline your policy states
- Incident response test records: either a tabletop or, better, the detection timeline from the penetration test window
- FIPS 140 validation certificates for the cryptographic modules protecting CUI at rest and in transit
- Shared-responsibility matrices and FedRAMP (or equivalency) evidence from every external service provider in the boundary
NIST SP 800-171 Rev. 2 versus Rev. 3, SPRS scores and the subcontractor flow-down
NIST published Revision 3 of SP 800-171 in May 2024. It restructures the requirements to track NIST SP 800-53 Rev. 5, consolidates them into 97 requirements, introduces organisation-defined parameters, and tightens the Security Assessment and Monitoring family so that effectiveness assessment, plans of action and continuous monitoring are defined more precisely. CMMC does not yet assess against it. A DFARS class deviation issued in May 2024 holds DFARS 252.204-7012 and therefore CMMC at Revision 2 until DoD decides otherwise. Build your programme against Rev. 2, track Rev. 3, and ask your tester to map findings to both so the report does not go stale when the switch comes.
SPRS, the Supplier Performance Risk System, holds the score that primes and contracting officers check before award. The DoD assessment methodology weights each unimplemented practice at 5, 3 or 1 point, producing a scale from minus 203 to 110. A penetration test does not change the score directly, but it is the fastest way to find out whether the practices you scored as implemented are implemented in a way that resists an attacker. Contractors who discover that gap during a C3PAO assessment rather than before it pay for the discovery in time and in contract eligibility.
Finally, flow-down. DFARS 252.204-7021 obliges a prime to require CMMC at the appropriate level from every subcontractor that will handle FCI or CUI, before award. European subcontractors in aerospace, defence electronics, shipbuilding and software increasingly receive these clauses from US primes and from Dutch or German integrators that hold DoD work. The practical consequence is that a Dutch engineering firm may need a Level 2 certification from a C3PAO, assessed to US rules, with evidence produced by testers who understand both the NIST language and the European infrastructure the firm actually runs.
How HackersHub supports CMMC programmes
We scope the test to your SSP boundary: the CUI enclave, its Security Protection Assets and the paths into it from the corporate network and the internet. The engagement typically combines an external test of the enclave's exposed services, an assumed-breach test from a standard corporate workstation to measure whether the enclave boundary holds, and a review of identity, remote access and cryptographic configuration against the Rev. 2 practices listed above. Where you run Level 3 programmes we deliver the recurring penetration testing the enhanced requirement calls for, at the frequency your SSP defines.
The report maps every finding to a CMMC practice identifier and to the NIST SP 800-171 requirement text, so your compliance lead can file it as evidence without translation, and it includes a retest so the POA&M can be closed with proof. Testers are OSCP-certified and named in the report, which is the independence and qualification evidence a C3PAO expects for practice CA.L2-3.12.1. HackersHub is based in Amsterdam, Netherlands and works with contractors across the EU and the United States; US-based client systems are tested remotely within agreed windows and US business hours.
Frequently asked questions
Preparing for a C3PAO assessment?
We test the CUI boundary the way an assessor reads it and the way an attacker approaches it, and report every finding against the CMMC practice it evidences. Talk to an expert about scoping before your assessment window.