CMMC Level 2 Compliance: The Evidence Package San Diego Subcontractors Need Before a Prime Asks

CMMC Level 2 compliance is no longer a question a San Diego subcontractor gets to answer on its own schedule. Primes are asking now, in supplier questionnaires, in flow-down clauses, and in pre-award reviews. They do not want a promise that you will be ready. They want an evidence package: your System Security Plan, your SPRS score, your POA&M, and proof the controls in those documents actually run.

If you handle Controlled Unclassified Information for a prime, that package is your ticket to stay on the work. Build it before the prime asks, and CMMC assessment preparation becomes a review. Build it after, and it becomes a scramble that puts the contract at risk.

What primes are actually checking

A prime has its own compliance exposure. If a subcontractor in its supply chain cannot protect CUI, the prime carries that risk into its own assessment and its customer relationship. That is why the questions have changed.

Primes used to ask, are you working on it? Now they ask for specifics. What is your current SPRS score, and when was it posted? Where does CUI live in your environment, and what is outside that boundary? Which external service providers touch CUI, and what is your shared responsibility with each one? Can you show, not just state, that access is limited, audited, and reviewed?

Those are not trick questions. They map directly to NIST 800-171 compliance, the foundation Level 2 is built on. A subcontractor that answers in one organized package looks like a low-risk partner. One that answers in fragments looks like work the prime does not need.

Start with scope, or the package will not hold together

Every credible package starts with a clear scope statement. Name the systems, people, facilities, and services that store, process, or transmit CUI. Name what is out of scope and how you keep it separate.

Keep the scope as small as you can defend. Many San Diego shops do not need their entire network in scope. A defined enclave for CUI work — separate accounts, separate storage, controlled endpoints — reduces the number of systems you must prove, patch, and monitor. It does not reduce the standard. It makes the standard achievable.

Document the boundary in a diagram and in plain language. An assessor and a prime reviewer should be able to follow where CUI enters, where it moves, who can reach it, and where it leaves. If that story changes when systems change, update the diagram the same week, not at the next annual review.

That scoping discipline is core CMMC and government-contractor IT support work, not paperwork added at the end.

The five pieces of the evidence package

First, the System Security Plan. Your SSP describes, control by control, how you meet the NIST SP 800-171 requirements that apply in your scope, who is responsible, and what evidence proves it. Write it for a reader who does not know your shop. If a practice is met through a provider, say which provider, what they do, and what remains yours under the shared responsibility matrix.

Second, the SPRS score and its basis. Post an honest score. A low honest score with a real plan is defensible. An inflated score is not — it creates False Claims Act exposure and it falls apart the moment a reviewer asks for the evidence behind a control you claimed was met. Keep the scoring worksheet that produced the number you posted.

Third, the POA&M, used correctly. A POA&M is for specific, eligible gaps with an owner, a milestone, and a closeout date. It is not a place to park foundational gaps like multi-factor authentication or audit logging and call them planned. Sort gaps honestly: what blocks assessment, what is eligible for a POA&M, and what you will close first. Then close items on schedule and keep the closeout evidence.

Fourth, the evidence itself, organized by control. Policies alone are not evidence. Pair each policy with proof it runs: MFA reports, access reviews with dates and reviewers, patch and vulnerability scan results, backup test records, incident response test notes, training completion records, and visitor and media logs where they apply. Date everything. Undated screenshots convince no one.

Fifth, the provider list. List every external service provider in scope — email, cloud storage, managed IT, security monitoring — what CUI or security function they touch, and how you verified their responsibilities. If a provider will be in your assessment boundary, you need that relationship in writing before the assessment, not during it.

Keep evidence current between reviews

The most common failure is not a missing control. It is stale evidence. Access was reviewed, but nobody kept the record. Backups ran, but the test restore was never documented. A former employee was removed, but the offboarding checklist is blank.

Fix that by running compliance as operations. Access reviews, patching, log review, and backup tests should happen on a schedule owned by your regular IT operation through disciplined managed IT services. Continuous monitoring helps in a practical way: 24/7 monitoring from a Security Operations Center in California generates detection and review records that double as assessment evidence, while catching credential abuse between assessments.

FIT Solutions provides that kind of managed cybersecurity services support from San Diego, with 24/7 monitoring and a California-based Security Operations Center. For defense contractor cybersecurity, the point is not a binder you build once. The point is an environment that stays in scope and produces evidence as a byproduct of normal work.

Review the whole package quarterly. Update the SSP when systems or providers change. Rescore SPRS when you close material gaps. A package that is three months current is a different conversation with a prime than one that is fourteen months old.

What to do this month if a prime has not asked yet

Do not wait for the questionnaire. This month, confirm your scope and write it down in one page. Score yourself honestly against NIST SP 800-171 and post or prepare your SPRS score from that worksheet. Build the five-piece folder above, even if some pieces show gaps. Then close the foundational gaps first: MFA on email and remote access, unique accounts with least privilege, audit logging turned on and reviewed, tested backups, and an incident response plan your team has walked through once.

That sequence gives you straight answers when the prime does ask. It also gives you time to fix problems while they are still private, schedulable work instead of a deadline attached to an award.

FIT Solutions is a San Diego managed IT and cybersecurity provider. Our services include Managed IT, Enterprise IT, Cybersecurity, Cloud Services, and Healthcare IT, backed by 300+ 5-star Google reviews. Our vision is helping 6,000 businesses. For subcontractors, that starts with a package a prime and an assessor can both trust.

If you do not know what your prime will ask for, or your SSP and SPRS score do not match the environment you run today, fix that now. It is simpler this month than it is the week a contract depends on it.

Call FIT Solutions at (888) 339-5694.