110 Practices. 182 Artifacts.
Here's What CMMC Level 2 Actually Requires.

When people hear that CMMC Level 2 has 110 practices and 182 artifacts, they picture an enterprise compliance program — the kind that requires a dedicated security team, months of work, and a six-figure consultant. That picture is wrong if you're using the CUI enclave approach.

Here's the key reframe: those 110 practices apply to your CUI enclave — not your entire company. If your contract involves handling Controlled Unclassified Information (CUI) in a defined, limited footprint, CMMC Level 2 is scoped to that footprint. Your main business systems, admin tools, and general email traffic outside the enclave aren't in scope.

This post breaks down what 110 practices actually cover, what 182 artifacts look like in plain language, how the work is divided across roles, and why the right package maps every single practice to a defined deliverable — so nothing is left to guesswork.

The Scope Is Smaller Than You Think

The first thing to understand about CMMC Level 2 and CUI is that compliance is scoped. You're not certifying your entire organization — you're securing the environment where CUI lives.

In practice, this means a dedicated CUI enclave: a defined set of devices, a cloud platform (Google Workspace for Government or Microsoft 365 GCC High), and the users who access CUI. That's your compliance boundary. Everything inside gets assessed. Everything outside stays out of scope.

This is the right-sizing that makes CMMC Level 2 achievable for small businesses. You're not rebuilding your entire IT infrastructure — you're securing a defined, bounded environment.

The 14 CMMC Level 2 Domains — What Each One Covers

CMMC Level 2 maps to NIST SP 800-171 and organizes its 110 practices into 14 security domains. Here's what each domain actually covers in plain terms:

When you look at them this way, none of these domains are exotic or surprising. They're the fundamentals of securing a defined system. The challenge isn't understanding what they require — it's having the documentation, configuration, and evidence to prove you're doing it.

What "182 Artifacts" Actually Means

An artifact is just proof. It's a document, a configuration record, a screenshot, a log, or a signed policy that demonstrates you're actually implementing a security practice — not just saying you are. "182 artifacts" sounds like a mountain of paperwork until you break it down by type.

Who Does What: The Three Roles in L2 Compliance

One of the most practical ways to understand the 182 artifacts is to look at which role is responsible for each type. Most small businesses handle all three roles with two or three people — and the package is designed with that in mind.

Time estimates are included for every task in the L2 CUI Enclave Package, so you can plan implementation around existing work commitments. The goal is a compliance program that's implementable part-time — not a second job for your whole team.

L1 + L2 Side-by-Side: The Complete Compliance Stack

If you're a contractor who handles both FCI (Federal Contract Information) and CUI, you may need both levels. L1 covers your main business systems under your prime contract. L2 covers your CUI enclave specifically. Together, they represent full coverage.

Platform Variants: Google Workspace for Government vs. M365 GCC High

The L2 CUI Enclave Package is designed for one of two platforms. Your artifact set is tailored to whichever you choose — you won't be translating enterprise documentation or adapting generic templates. You get only what applies to your environment.

In both cases, the package provides configuration guides and templates — clients implement the controls using their own platform subscription. Overwatch Tools does not have access to your environment or provide hands-on configuration services.

Every Practice Mapped. No Guesswork on What Counts as Evidence.

One of the most common failure points in CMMC self-assessment isn't implementing the controls — it's not knowing what evidence to collect, how to format it, or which artifact satisfies which practice. A blank-slate compliance effort leaves you constantly asking: "Is this enough? Does this count?"

The L2 CUI Enclave Package eliminates that ambiguity. Every one of the 110 practices maps to a defined artifact. You know exactly what document you're producing, what it needs to contain, and which practice it satisfies.

This mapping is what distinguishes a compliance package from a generic consulting engagement. You're not starting with a list of requirements and figuring out what to create. You're starting with a complete library of defined deliverables and working through implementation with consulting support.

The Bottom Line

110 practices and 182 artifacts is not a small compliance program — but it's a manageable one when three things are true:

1. The scope is limited to your CUI enclave — not your whole organization
2. Every practice maps to a defined artifact — no guesswork on what counts
3. Time estimates exist for every task — so implementation is plannable part-time

Small defense contractors have been achieving CMMC Level 2 self-assessment without enterprise IT, without full-time security staff, and without six-figure consultants. The right structure makes the difference.