Oct 06, 2026  · 6 min read  · By The Rio Team

What a router can (and can't) do for CMMC Level 2

An engineer reviewing CAD drawings at her desk in a small manufacturing shop

Updated October 8, 2026.

The short answer

A router can help with a small part of CMMC Level 2: mainly segmentation, boundary protection and control over which devices join. It can't cover the policies, training, multi-factor sign-in, endpoint security and FIPS-validated encryption that make up most of NIST SP 800-171. No router makes a company CMMC compliant, Rio included.

Key takeaways
  • CMMC Level 2 rests on the 110 requirements in NIST SP 800-171 Rev 2.
  • A router touches a handful of them, all at the network layer.
  • Segmenting CUI machines can shrink what gets assessed.
  • Phase 2 is paused, but self-assessments and DFARS 7012 still apply.

Where does CMMC stand in October 2026?

Phase 2, third-party Level 2 certification by a C3PAO, was due on November 10, 2026. The Department of War suspended it on July 13, 2026, and a September 3 class deviation told contracting officers to remove third-party assessment requirements.1, 2

The work itself didn't pause. DFARS 252.204-7012 still requires NIST SP 800-171, self-assessments still apply where contracts call for them, and your SPRS score must be true.1 For the full story, read why CMMC Phase 2 was paused.

Which NIST SP 800-171 controls can a router cover?

CMMC Level 2 assesses against Rev 2, not the May 2024 Rev 3.3 Here are the network-layer requirements, with Rio's rating from its public control mapping.4 You or your assessor decide whether each is met.

Requirement What a router can do Rio's rating
3.13.5 Subnetworks Put systems in separate segments Supports (SecureRooms)
3.1.16 Wireless authorization Hold new devices until approved Supports (device approval)
3.13.1 Boundary protection Firewall at the internet edge Partial. Blocks unsolicited inbound; monitoring is the app's activity log
3.13.6 Deny by default Block inbound traffic by default Partial. Outbound is allowed by default
3.1.17 Wireless protection Wi-Fi encryption and access control Partial. WPA2 Personal plus device approval
3.1.18 Mobile devices Hold phones and laptops until approved Partial. Managing the devices needs other tools
3.1.20 External connections Firewall and approval help Partial. Also needs policy
3.13.8 Encryption in transit Needs FIPS-validated encryption Not covered
15 of 110 requirements in Rio's mapping: 2 rated Supports and 13 Partial, all at the network layer. Rio NIST SP 800-171 control mapping4

The other Partial ratings are 3.1.1, 3.1.3, 3.3.1, 3.4.1, 3.4.2, 3.5.1, 3.5.2 and 3.13.2. For those, Rio supplies only the network side, such as its device list and activity log.

What can't a router do for CMMC?

Most of NIST SP 800-171 lives outside the router. These need other tools, written procedures or an outside provider:

  • Multi-factor sign-in and least privilege (3.5.3, 3.1.2)
  • Training (3.2) and full audit logging (3.3)
  • Patching and malware protection on computers (3.14)
  • Incident response, including 72-hour reporting (3.6)
  • FIPS-validated encryption for CUI (3.13.8, 3.13.11)
  • Media, personnel and physical protection, risk assessment and your SSP (3.8 to 3.12)

Rio VPN is an outbound privacy VPN for the rooms you assign, not a remote-access VPN, and its FIPS validation isn't confirmed. Don't rely on it to protect CUI.

Can network segmentation reduce CMMC scope?

Yes. DoD's Level 2 scoping guide lets assets that are physically or logically separated from CUI systems sit out of scope.5 A CUI enclave is a segment that holds those systems, with a clear boundary.

A SecureRoom gives you that logical separation. Put CUI computers in their own room with its own password, approve each device that joins, and keep guests, phones and printers elsewhere.

  • The router enforcing the boundary is a security protection asset, so it stays in scope.
  • Email, USB drives and cloud services that carry CUI stay in scope too.
  • Write the boundary into your SSP and network diagram.

A network checklist for CMMC Level 2

  1. Confirm what your contracts require: DFARS 7012, a CMMC level, self-assessment or C3PAO.
  2. List where CUI lives and draw your network, including Wi-Fi.
  3. Move CUI systems into their own segment with its own Wi-Fi password.
  4. Require approval for every new device.
  5. Confirm the firewall blocks unsolicited inbound traffic.
  6. Use FIPS-validated encryption for CUI in transit and a proper remote-access solution.
  7. Write the network section of your SSP and keep evidence: device lists, settings, screenshots.
  8. Score yourself honestly in SPRS.

Where Rio fits. Rio for Defense ($599) pairs the Rio router with a five-document kit, including the SSP Builder, plus 2 years of Rio VPN, The Rio Guarantee on the controls rated Supports, priority support and one free replacement in year one. It covers the network layer only. See the control mapping.

A flat office network drags every printer and phone into CUI scope.

Rio for Defense walls off CUI machines, holds new devices for your approval and writes the network section of your SSP.

See Rio for Defense

Frequently asked questions

Will a router make my company CMMC compliant?

No. A router helps with a few network-layer requirements in NIST SP 800-171, such as segmentation, boundary protection and wireless access control. CMMC Level 2 covers 110 requirements, and most involve policies, training, endpoints, identity and logging. Rio handles the network layer and does not make anyone CMMC compliant.

Is CMMC Phase 2 still starting on November 10, 2026?

No. The Department of War suspended Phase 2 on July 13, 2026, and a September 3 class deviation told contracting officers to remove third-party assessment requirements. No new date has been set. Check the DoD CIO CMMC site for updates, and keep your self-assessment current in the meantime.

Does network segmentation reduce CMMC scope?

It can. Assets physically or logically separated from systems that handle CUI may be out of scope. The device enforcing the separation stays in scope, as does any other path CUI travels, such as email or cloud storage. Document the boundary in your System Security Plan and network diagram.

Can a router be CMMC certified?

No. CMMC assesses organizations, not products, so no router carries a CMMC rating. What a vendor can offer is a control mapping. Rio's public mapping rates it as supporting 2 NIST SP 800-171 requirements and partly covering 13 more, all at the network layer.

Can I use Rio VPN to protect CUI?

Don't rely on it for that. FIPS validation of Rio VPN isn't confirmed, and NIST SP 800-171 requires FIPS-validated encryption for CUI. Rio VPN also encrypts only outbound traffic for the rooms you assign. It isn't a remote-access VPN, so use a solution built for that job.

General information for small defense contractors, not legal or compliance advice.

Sources

  1. DoD CIO, memo 26-P-1023: Implementing Suspension of CMMC Phase II, July 13, 2026. defense.gov (PDF)
  2. Smith Currie, Class Deviation Memorandum Codifies CMMC Phase 2 Suspension, September 22, 2026. smithcurrie.com
  3. NIST, SP 800-171 Rev 2 (updated January 28, 2021). nist.gov
  4. Rio for Defense, NIST SP 800-171 control mapping (download on page). riorouter.com
  5. DoD CIO, CMMC Scoping Guide, Level 2. defense.gov (PDF)
  6. 32 CFR Part 170, CMMC Program. ecfr.gov
  7. Washington Technology, CMMC's Phase 2 suspension locked in with binding regulation, September 9, 2026. washingtontechnology.com
Share: Twitter Facebook LinkedIn Email

Keep reading

Oct 25, 2026 How to set up a second Rio as an extender (Rio Mesh) Read article Oct 22, 2026 How to reset your Rio: what it erases and what to do next Read article Oct 8, 2026 Guest Wi-Fi in a medical office: what HIPAA expects, and how to set it up Read article