What does CMMC Level 2 actually require for cloud-hosted CUI?
CMMC Level 2 requires implementation of all 110 security controls from NIST SP 800-171, verified by a third-party assessment (C3PAO) every three years, when your environment stores, processes, or transmits Controlled Unclassified Information. For cloud-hosted CUI specifically, the hosting environment must also meet FedRAMP Moderate baseline (or equivalent) authorization.
That is the short answer. The rest of this post explains what that means in practice, because the gap between “we use a compliant cloud” and “our CUI environment passes a CMMC Level 2 assessment” is where most contractors lose months.
The three things that trip people up
The cloud being FedRAMP-authorized is not the same as your enclave being compliant. A FedRAMP Moderate platform gives you compliant infrastructure underneath. The controls that get assessed — access enforcement, audit logging, configuration management, incident response — are yours to implement and evidence inside that boundary.
Documentation has to match reality. Assessors do not grade the System Security Plan as a writing sample. They check whether the control described in the SSP is the control actually running in the environment. A narrative that says “FIPS-validated cryptography is enforced” fails the moment a nmap scan finds a service negotiating a non-validated cipher.
Scope is the lever. The single largest driver of assessment cost and risk is how much of your environment is in scope. A purpose-built enclave that isolates CUI from your general IT keeps the assessed boundary small, defensible, and cheap to maintain.
What an assessment-ready cloud enclave looks like
A defensible CUI enclave running on FedRAMP-authorized infrastructure typically demonstrates:
- FIPS 140-2/3 validated cryptography for data in transit and at rest
- STIG-hardened operating systems with enforced configuration baselines
- Centralized audit logging that maps to the 800-171 audit control family
- Multi-factor authentication brokered at the boundary, not per-application
- Continuous monitoring that produces evidence on demand, not once a year before the assessment
Why “ground truth” documentation wins
The most reliable way to pass an assessment is to generate your control documentation directly from the running infrastructure rather than writing narratives by hand. When the evidence is produced deterministically from live system state, the SSP cannot drift from reality, because the reality is the source.
That is the model Hermathena Labs builds on: the code deploys the controls, scripts read the live infrastructure, and the documentation reflects what is actually running.
This post is general information, not compliance advice for your specific environment. For an assessment of your CUI scope, schedule a consultation.