CMMC 2.0 and NIST SP 800-171: Where Penetration Testing Fits

The Cybersecurity Maturity Model Certification (CMMC) program is how the US Department of Defense checks that contractors protect the information it shares with them. With the contract clause rule in effect since November 10, 2025, CMMC requirements now appear in DoD solicitations, and the second phase begins on November 10, 2026. Many contractors ask the same question: do we need a penetration test? This guide explains what each level requires, what it says about testing, and where a pentest helps.

The three CMMC levels

The program rule sits in 32 CFR Part 170, and the contract clause rule in 48 CFR. Each solicitation states the level required for that contract, so the first step is always to check what your current and target contracts ask for.

Phased rollout: the dates that matter

• Phase 1, from November 10, 2025: Level 1 or Level 2 self-assessments can be required as a condition of award.
• Phase 2, from November 10, 2026: Level 2 certification by a C3PAO becomes a condition of award for applicable contracts.

Certification assessments take planning, and C3PAO capacity is finite. If your contracts involve CUI, the practical deadline for preparation is well before your next bid, not the Phase 2 date itself.

What NIST SP 800-171 says about testing

Level 2 doesn't contain a requirement titled "penetration testing". Two requirements are the closest fit:

• 3.11.2 Vulnerability scanning: scan for vulnerabilities in organizational systems and applications periodically, and when new vulnerabilities affecting them are identified.
• 3.12.1 Security assessment: periodically assess the security controls in organizational systems to determine whether they are effective.

A penetration test supports both. It validates scan results by showing which weaknesses are actually exploitable, and it tests whether controls such as access enforcement, segmentation, MFA and logging work in practice, not only on paper. Assessors look for evidence that requirements are implemented. Test reports with remediation records are strong evidence that your assessments are real.

Level 3 and NIST SP 800-172

Level 3 adds 24 enhanced requirements selected from NIST SP 800-172, aimed at advanced persistent threats. Among them is enhanced requirement 3.12.1e, which calls for penetration testing at least annually. Level 3 assessments are carried out by the DoD's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), not by C3PAOs.

Scoping a pentest for a CUI environment

CMMC scoping centers on where CUI is processed, stored or transmitted, and on the assets that protect it. A useful penetration test follows the same boundary:

1. External perimeter: VPNs, remote access, email and any internet-facing systems that touch the CUI environment.
2. Internal network and Active Directory: can an attacker who compromises one user reach CUI systems or administrator accounts?
3. Segmentation and enclaves: if you rely on an enclave to limit scope, test that the boundary holds.
4. Cloud tenancy: configuration of the Microsoft 365 or other cloud environment that holds CUI, including identity, conditional access and data sharing.
5. Security protection assets: the tools that protect CUI, such as EDR, SIEM and MFA, are often in scope too.

Agree rules of engagement with your IT provider or MSP before testing, and make sure the person signing the authorization can approve testing of every system in scope.

How a pentest fits your CMMC preparation

• Before your gap assessment: a test shows which of your documented controls actually work.
• During remediation: retesting confirms that fixes close the gaps, which feeds your plan of action and system security plan.
• Before the assessment: a recent report with remediation evidence supports requirements 3.11.2 and 3.12.1 and reduces surprises.
• Every year afterwards: annual testing keeps the evidence current, and is required at Level 3.

Common gaps a pentest uncovers

Small and mid-sized defense suppliers often have good policies but uneven technical controls. The issues we see most often in internal and cloud testing are practical ones:

• Flat networks: the "CUI enclave" is reachable from ordinary office workstations or shop-floor systems.
• Shared and over-privileged accounts: local administrator passwords reused across machines, or service accounts with domain-wide rights.
• MFA gaps: MFA enforced for email but not for VPN, remote desktop or administrator sign-ins.
• Unmonitored activity: attacks that succeed without triggering an alert, which undermines audit and incident response requirements.
• Stale scan results: scanning that runs, but whose findings are never triaged or fixed.

Each of these is cheaper to fix before an assessment than after a failed one.

What we do, and what we don't

To be clear: BugFoe is not a C3PAO and not a Registered Provider Organization (RPO), and we can't certify you or perform your CMMC assessment. We run penetration tests, vulnerability assessments and NIST SP 800-171 gap reviews that help you prepare and give your assessor useful evidence. We deliver remotely from India. If a contract or prime contractor requires US-only personnel or specific citizenship or facility arrangements for work that touches CUI, tell us at scoping and we'll say plainly whether we can meet it.

Frequently asked questions

Preparing for CMMC Level 2? Request a scoped proposal or see our compliance services and network penetration testing.