Update, September 30, 2026: The Department of War suspended CMMC Phase II, the mandate that would have required third-party (C3PAO) Level 2 certification starting November 10, 2026. The 60-day Reform Task Force has now submitted its recommendations on the future of the program, which have not been made public. Self-assessment requirements, SPRS scoring, annual affirmations, and DFARS 252.204-7012 remain fully in force and are still enforced under the False Claims Act.
If your prime contractor requires a Level 2 certificate on its own terms, that requirement has not changed. For everyone else, an accurate, advisor-reviewed self-assessment is now the main compliance requirement. Read what actually changed and what to do next, or talk to a Carbide advisor.
For defense contractors handling Controlled Unclassified Information (CUI), meeting CMMC Level 2 requirements means addressing the 110 security requirements in NIST SP 800-171 Rev. 2 and maintaining evidence to demonstrate how each one is met. As evidence, documentation, and technical configurations change, keeping that information current can create a substantial workload for internal teams.
The right compliance software can reduce that burden considerably, but there are important parts of the CMMC process that still depend on human judgment.
What Can CMMC Compliance Software Automate?
The strongest automation capabilities are tied to technical evidence. Direct integrations can pull configuration and security data from cloud infrastructure, identity providers, endpoint security products, and other connected systems. Continuous monitoring then tracks configuration changes, user access activity, patching schedules, and connected security tools across environments that handle CUI. Together, these processes reduce reliance on manually collected screenshots and surface drift as it happens.
Automation can also keep evidence connected to the requirements it supports rather than treating evidence collection as a separate exercise. Depending on the platform and integrations involved, useful capabilities include:
- Tracking implementation progress against individual requirements
- Mapping evidence to applicable NIST SP 800-171 Rev. 2 requirements
- Flagging changes that may affect the evidence supporting a control
- Supporting documentation such as the System Security Plan (SSP) as the environment changes
When technical telemetry stays mapped to specific requirements, it can help keep the SSP aligned with the environment as it changes rather than allowing the documentation to go stale between reviews. That connection is particularly useful for requirements where implementation can be demonstrated through system configuration, access records, security settings, or other technical evidence. NIST’s assessment methodology also relies on interviews and testing, so automated evidence should support assessment work rather than substitute for it.
Operational Requirements That Necessitate Human Oversight
Some CMMC Level 2 requirements depend on decisions about the organization itself, not simply the state of its technology. CUI scoping and boundary definition are examples. Determining which people, systems, facilities, services, and information flows belong within the assessment scope requires an understanding of how the organization operates and how CUI is handled.
Human oversight is also necessary when requirements depend on how an organization develops and enforces its own processes. This includes:
- Writing policies and procedures that reflect organizational practices
- Conducting incident response exercises and reviewing how personnel react
- Training teams to recognize and report potential signs of insider threat
- Addressing physical security measures that cannot be validated through technical telemetry
A CMMC compliance platform can provide templates, prompts, tasks, or generated documentation, but the resulting policies still need to reflect how the organization works. The organization must also be able to demonstrate that its defined processes are being followed in practice.
Filling Automation Gaps With Embedded Advisory Expertise
Evidence can show what a technical system is doing without answering every question about why that configuration is appropriate or whether the organization’s documented process matches its actual practices. Integrating credentialed security guidance into the software workflow helps ensure that nontechnical governance controls receive the human validation necessary for compliance.
With Carbide, for example, a combined approach divides the work according to what software is equipped to handle and what requires professional judgment. Within that model, advisors directly review policy narrative accuracy and verify custom procedure implementations. They also resolve ambiguous control mappings that software telemetry cannot evaluate, challenge unsupported control interpretations, examine scope decisions, and help determine what additional evidence is needed. Together, automation and human oversight help defense contractors address all 110 NIST SP 800-171 Rev. 2 requirements.
Meet Your CMMC Level 2 Requirements With Carbide’s Platform and Advisors
Software can make the technical side of CMMC easier to manage, but a platform alone doesn’t decide how an organization should define its CUI environment or whether its policies describe how controls are actually implemented. Left to run on its own, a software-only workflow can leave a significant portion of the 110 NIST SP 800-171 Rev. 2 requirements unaddressed.
Carbide closes this gap by combining automated evidence tracking with credentialed advisors who work alongside your team on complex policy development, CUI scoping, and more. Request a tailored demo to see how our platform and advisors work together, and take the first step toward gauging your alignment with CMMC Level 2 requirements.
FAQs
Can adherence to CMMC Level 2 requirements be fully automated?
No. Software can automate evidence collection, technical monitoring, control mapping, and compliance tracking, but organizations still need people to make scope decisions, validate policies, and assess whether documented procedures reflect actual practices.
What should organizations look for in CMMC compliance software?
Look for integrations that collect relevant technical evidence directly from the environment, along with tools for tracking requirements and maintaining documentation. Advisory support is important when the program involves complex scoping decisions or controls that cannot be validated through technical evidence alone.
Share
