CMMC Level 2 Non-Negotiable Requirements Explained | Huntress

What it is

A vendor explainer on the scoring floor for a Conditional CMMC Level 2 (Self) status under 32 CFR 170.21. It adds clause-level context the summary leaves out: which DFARS clauses apply, and what is at stake when the status lapses.

How it works

• Contract clause: DFARS 252.204-7021 is the CMMC clause. Pairing it with the CMMC point values produces a minimum score that the clause text never states.
• Superseded clauses: the page says DFARS 252.204-7997 replaces both 252.204-7019 and 252.204-7020 under the DFARS overhaul. It also says 7997 points government DIBCAC assessments at the CMMC scoring methodology, so the DoDAM is no longer the yardstick.
• Consequences: a single missing non-negotiable requirement can void contract award eligibility. The page also says it can expose the organization to the False Claims Act.
• Expiry: a Level 2 self-assessment submitted with unmet items starts a 180-day closeout clock. If the items aren't closed and SPRS isn't updated, the Conditional status expires.

What to do

• Treat the 88 floor and the 3- and 5-point requirements as pass/fail gates, not trade-offs. Your only discretion is which 24 of the 46 remaining one-point requirements to implement.
• If you submit a less-than-perfect self-assessment, put the 180-day deadline on a calendar well before the annual affirmation date. The page warns the affirming official may log in and find the status silently expired, after bids were submitted in the gap.
• Where a solicitation requires Level 2 (Self), a current status and an SPRS affirmation are a condition of award. The page says a missing entry can cost an award or an option exercise, so submit the new assessment in SPRS early.

flowchart TD
    A[Submit L2 self-assessment] --> B{Score at least 88 and all 3/5-pt met?}
    B -- No --> X[No Conditional status]
    B -- Yes --> C{Any unmet items?}
    C -- No --> D[Final status]
    C -- Yes --> E[180-day POA&M clock]
    E --> F{Closed and SPRS updated?}
    F -- Yes --> D
    F -- No --> G[Status expires silently]

Caveats

• The page does not name the "short list" of mandatory one-point requirements, so you must pull it from 32 CFR 170.21 yourself.
• Two figures don't add up. 64 of 110 is about 58%, not the "85% of all possible points" stated. The Huntress matrix is said to cover "164 points", which is more than the 110 maximum. Verify both against the regulation before quoting them.
• The Huntress mapping (55 documented requirements, 32 of them non-negotiable) is vendor material. The page itself says customers must still configure the tools and maintain their own evidence.