Most CMMC Level 2 projects go wrong at the very first step: scope. If you don't know which systems handle Controlled Unclassified Information (CUI), you can't know which systems need the 110 NIST SP 800-171 requirements. Start with the contract CUI reaches you through a contract. Look for DFARS 7012, flow-down clauses from your prime, and CUI markings on the documents you receive. Those tell you what data you're protecting. Follow the data Once you know what the C...