# Defense Contractors Document CMMC Level 2 Controls

A discussion among CMMC practitioners found no useful page-count benchmark for a Level 2 System Security Plan (SSP): reported examples range from about 30 to 1,200 pages, depending on system complexity and the detail needed to describe implementation. The practical guidance is to define the system boundary and explain how all 110 requirements are implemented at the assessment-objective level—320 assessment objectives, according to commenters—while keeping screenshots and supporting evidence in a controlled repository with clear, stable references instead of embedding them in the SSP. For defense contractors preparing for assessments or supporting procurement, the discussion emphasizes completeness and traceable evidence over document length.

- Contractors should organize the SSP around the system boundary and implementation of each requirement and assessment objective, rather than targeting a particular page count.
- Keep supporting screenshots and evidence in a controlled repository and use clear, stable references so assessors can locate them without bloating the SSP.
- Commenters note that the number of assessment objectives could change under R3; the signal provides no date or confirmed change, so it does not establish a new requirement or deadline.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 21, 2026

### Key Quotes
> Page count varies too much to be a useful target. For Level 2, the SSP should clearly define the system boundary and explain how each of the 110 requirements is implemented.
> — Community commenter

> Address all 110 controls at the Assessment Objective level (320) - VERY IMPORTANT
> — Sri Achary (LCCA)

### Sources
- [How long is your SSP?](https://www.reddit.com/r/CMMC/comments/1xbvtn8/how_long_is_your_ssp) - reddit-cmmc