Building Stronger Cyber Hygiene with Online Tools

Cyber hygiene is the difference between a defense contractor that passes a CMMC 2.0 assessment and one that spends eighteen months remediating findings. The framework itself is public, finite and testable: 15 requirements at Level 1, 110 at Level 2, and a further 24 enhanced requirements at Level 3. What separates compliant organizations from struggling ones is not knowledge of the control list. It is whether the daily habits of the people handling Controlled Unclassified Information (CUI) actually match what the System Security Plan claims.

Most gaps found during assessments are mundane. A shared password in a spreadsheet. A contract deliverable emailed unencrypted because the secure channel was inconvenient. A file whose integrity nobody can prove because no hash was ever recorded. None of these require a sophisticated adversary to exploit, and none of them are fixed by buying another platform.

This guide covers what CMMC 2.0 actually requires at each level, where the program stands after the July 2026 suspension of Phase 2, and which everyday practices — supported by free browser-based utilities — close the gap between a written policy and a defensible security posture.

What CMMC 2.0 Requires at Each Level

The Cybersecurity Maturity Model Certification program is codified in 32 CFR Part 170, which took effect on December 16, 2024. The companion acquisition rule that puts the CMMC clause (DFARS 252.204-7021) into contracts was published on September 10, 2025 and became effective on November 10, 2025. The three levels are not marketing tiers; each maps to a specific published control set and a specific assessment method.

Level	Information protected	Security requirements	Source standard	Assessment method
Level 1 (Foundational)	Federal Contract Information (FCI)	15	FAR 52.204-21(b)(1)	Annual self-assessment with annual affirmation
Level 2 (Advanced)	Controlled Unclassified Information (CUI)	110	NIST SP 800-171 Revision 2	Self-assessment every three years, or a certification assessment by an accredited C3PAO
Level 3 (Expert)	CUI on the highest-priority programs	24 selected requirements on top of Level 2	NIST SP 800-172 (February 2021), with DoD-assigned parameters	Assessment conducted by DCMA DIBCAC

Plans of Action and the 180-Day Clock

Level 1 permits no Plan of Action and Milestones at all — every one of the 15 requirements must be met. Levels 2 and 3 allow a limited POA&M, which produces a Conditional CMMC status. You then have 180 days from the date that conditional status is awarded to close every requirement scored NOT MET and pass a follow-up assessment. Miss the window and the conditional status lapses rather than converting to Final.

That 180-day limit is why daily habits matter more than a pre-assessment sprint. Controls that depend on people behaving consistently — access reviews, credential rotation, integrity checks on deliverables — cannot be retrofitted in a hurry.

Where the Program Stands Right Now

Phase 1 of the phased rollout began on the November 10, 2025 effective date, requiring Level 1 (Self) or Level 2 (Self) status as a condition of award on applicable solicitations. Phase 2, which would have made Level 2 C3PAO certification assessments mandatory, was scheduled for November 10, 2026.

On July 13, 2026, the Department of Defense suspended those Phase 2 requirements and stood up a reform task force to review the program, with an accompanying Request for Information. The suspension does not repeal anything already in force. Contractors are still obligated to perform Level 1 and Level 2 self-assessments, post scores to the Supplier Performance Risk System, submit annual affirmations, implement NIST SP 800-171 Revision 2, and comply with the safeguarding and 72-hour incident reporting duties of DFARS 252.204-7012. DoD has said it will continue enforcing NIST SP 800-171 compliance through self-assessments and select government-led assessments.

Read the pause as a change in the certification timeline, not in the underlying security obligation. Organizations that treat it as a reprieve will face the same 110 requirements later with less runway.

Why CUI Handling Is the Hard Part

Controlled Unclassified Information is government-created or government-owned information that requires safeguarding or dissemination controls under law, regulation or government-wide policy, but is not classified. The categories are published in the National Archives CUI Registry and cover things like export-controlled technical data, critical infrastructure details, procurement-sensitive material and controlled technical information.

The practical difficulty is that CUI rarely arrives labeled in a way your workflows respect. A drawing package attached to an email, a spreadsheet of specifications pasted into a chat thread, a subcontractor quote saved to a personal drive — each of these can pull CUI outside the boundary you scoped for assessment. A CUI enclave, a segmented environment that isolates the systems handling that data, narrows the assessment boundary considerably. But an enclave only works if people route work through it, every time, without exception.

That is the definition of cyber hygiene: the small, repeated, unglamorous behaviors that keep your actual data flows inside the boundary you documented.

Daily Practices That Map to NIST SP 800-171 Controls

The following habits align with control families in NIST SP 800-171 Revision 2 — Access Control, Identification and Authentication, System and Information Integrity, and Media Protection. Free browser-based utilities can make several of them fast enough that people actually do them.

Authentication and Access Control

Weak and reused credentials remain the most common route into a contractor network. Before you set a policy, find out what your current passwords are worth: run representative examples through a password strength test to see how entropy and character variety change the result, then generate replacements with a password generator rather than letting staff invent their own patterns.

Length beats complexity theater. A long randomly generated passphrase resists brute force far better than a short string decorated with substituted characters, and it is easier to store in a manager than to remember badly.

Reuse is the second problem. Credentials exposed in unrelated third-party breaches get replayed against contractor accounts constantly. Checking whether a candidate password has appeared in a known breach corpus with a pwned password checker takes seconds and catches a failure mode no strength meter can detect. Pair that with multi-factor authentication; if you are testing whether an authenticator app is provisioning codes correctly for a new service, a TOTP generator lets you validate the shared secret before rolling it out to users.

File and Data Integrity

NIST SP 800-171 expects you to be able to detect unauthorized changes to information. A cryptographic hash is the cheapest way to do it: run the file through a hash function, record the digest, and compare it later. If a single byte changed, the digest changes completely.

Record a SHA-256 digest for every contract deliverable, baseline configuration file and archived compliance document using a hash generator, and store the digests separately from the files themselves. When a subcontractor sends a package back, recompute and compare before you accept it. Prefer SHA-2 family algorithms; MD5 and SHA-1 have known collision weaknesses and should not be used to make security decisions, even though they still appear in legacy tooling.

Where you need to prove not just that a file is unchanged but that it came from a party holding a shared secret, a keyed digest is the right primitive. An HMAC generator is useful for validating webhook signatures and API callbacks between your systems and a partner's, which is exactly the boundary where integrity assumptions tend to go unchecked.

Encryption in Transit and at Rest

CUI must be protected in transit and at rest, and DoD expects FIPS-validated cryptography where it applies. This is a platform decision, not a browser-utility decision: full-disk encryption on endpoints, TLS on every service, and an approved file transfer or email encryption mechanism for anything leaving the enclave.

Do not paste CUI into any online utility, including the ones referenced here. Browser-based tools are appropriate for test data, sample values and verification tasks — never for live controlled information. Make that rule explicit in training, because "I was just checking something" is how sensitive strings end up in third-party logs.

Secrets, Tokens and Machine Identities

Service accounts and API integrations are frequently the weakest identities in a contractor environment because nobody rotates them. Generate unpredictable identifiers for correlation keys, test fixtures and non-secret record IDs with a UUIDv4 generator instead of sequential or guessable values, and keep an inventory of which system holds which credential so rotation is a task rather than an archaeology project.

Treat every machine identity as in-scope for access control review. If a token can reach a system that touches CUI, it belongs in your System Security Plan.

Documentation and Audit Evidence

Assessors evaluate evidence, not intentions. Your System Security Plan, policies, screenshots, logs and assessment artifacts need to be organized, dated and tamper-evident. Compile evidence into a single indexed package rather than a folder of loose files, and apply a password to any exported PDF that leaves your control using a tool such as PDF protection for sanitized, non-CUI material. Keep a hash of each final artifact so you can demonstrate the version an assessor reviewed is the version you retained.

A Practical Readiness Sequence

Work through these steps in order. Skipping ahead to tooling before you have scoped the boundary is the most common and most expensive mistake.

Determine your required level. Handle only FCI and you are at Level 1. Receive, store or transmit CUI and you are at Level 2. Level 3 applies only where DoD designates it on the highest-priority programs.
Scope the boundary. Map every system, person and process that touches CUI, then decide what stays in scope and what a CUI enclave can carve out. Scope drives cost more than any other decision.
Run a gap analysis against all 110 requirements. Score each as MET or NOT MET honestly. An inflated self-assessment score in SPRS is a false statement, not an optimization.
Write the System Security Plan first, then the POA&M. The SSP describes what is actually implemented. The POA&M lists what is not, with owners and dates.
Remediate the highest-weighted gaps first. The NIST SP 800-171 DoD Assessment Methodology weights some requirements more heavily than others; fixing those moves your score furthest.
Operationalize the daily habits. Credential standards, integrity checks, access reviews and evidence capture become recurring calendar items with named owners, not annual projects.
Post your score and affirm. Submit the self-assessment to SPRS and complete the required affirmation in the CMMC ecosystem system of record.
Reassess on a cycle. Level 1 self-assessments are annual; Level 2 self-assessments run on a three-year cycle with annual affirmations in between.

Budgeting for Certification

Preparing for CMMC certification carries real cost, and pretending otherwise leads to stalled projects. Expect line items for scoping and gap analysis, system and endpoint upgrades, FIPS-validated cryptographic components, enclave licensing or hosting, staff training, consulting support, internal labor for evidence collection and remediation, and — when third-party certification resumes — C3PAO assessment fees.

Cost varies enormously with scope. A ten-person shop that isolates all CUI in a managed enclave faces a very different bill from a mid-sized manufacturer trying to bring an entire production network into scope. Build the estimate from your own boundary decision rather than from an industry average, and revisit it after the gap analysis, when you know how many of the 110 requirements are genuinely unmet.

Organizations looking for structured guidance on budgeting and compliance planning can review resources from Cuick Trac. Understanding potential expenses early lets you sequence spending across fiscal years instead of absorbing it all at once.

Frequently Asked Questions

Does the July 2026 Phase 2 suspension mean I can stop working on CMMC?

No. DoD suspended the Phase 2 requirement for mandatory C3PAO certification assessments and opened a program review. Level 1 and Level 2 self-assessments, SPRS score posting, annual affirmations, NIST SP 800-171 Revision 2 implementation and DFARS 252.204-7012 obligations all remain in force.

How many security requirements does CMMC Level 2 involve?

110, drawn directly from NIST SP 800-171 Revision 2. Level 1 involves 15 requirements from FAR 52.204-21. Level 3 adds 24 selected requirements from NIST SP 800-172 on top of the Level 2 set.

What is the difference between FCI and CUI?

Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release. Controlled Unclassified Information is information the government requires to be safeguarded or disseminated under specific law, regulation or government-wide policy, catalogued in the National Archives CUI Registry. FCI triggers Level 1; CUI triggers Level 2.

Can I use a Plan of Action and Milestones to pass an assessment?

Only at Levels 2 and 3, and only for a limited subset of requirements. A POA&M yields Conditional CMMC status, and you have 180 days to close every NOT MET requirement and pass a follow-up assessment. Level 1 permits no POA&M.

Is it safe to use free online tools while handling CUI?

Use them for test data, sample values and verification exercises only. Never paste Controlled Unclassified Information, live credentials or production keys into any third-party web utility. Anything touching real CUI belongs inside your assessed boundary using approved, FIPS-validated mechanisms.

Which hash algorithm should I use for integrity checks?

Use a SHA-2 family algorithm such as SHA-256. MD5 and SHA-1 have documented collision weaknesses and should not be relied on for security decisions, though you may still encounter them when verifying legacy downloads.

Make Hygiene the Default, Not the Deadline

CMMC 2.0 sets the standard, but the standard only describes an outcome. The outcome is produced by what your team does on an ordinary Tuesday: generating a credential instead of reusing one, hashing a deliverable before it ships, checking whether a password has already leaked, keeping CUI inside the enclave when a shortcut would be faster.

The current pause in third-party certification is the best window you will get to build those habits without assessment pressure. Use it to scope your boundary honestly, close the highest-weighted gaps and turn evidence collection into routine practice. Organizations that do this protect more than sensitive data — they build the credibility that keeps them eligible for work across the federal supply chain.