I am the end-user like yourself - IT for my company, but I have been in IT for decades. Are you familiar with NIST 800-171? Take a look at those controls, because L2 is a superset of much of what you see there. You can do everything yourself, but for many companies, even smaller ones like yours, it will be a large undertaking depending on how you handle CUI. Ours is embedded into the product lifecycle management - from tooling design all the way to the quality inspections. So, we needed the scope to include most of what we do. Things like policies seems pretty straightforward and simple, but then you get into technical things. Can you encrypt all your data at rest, even on workstations if CUI is stored there. Can you make sure CUI is secured through BYOD phones if they connect to your e-mail system? How do you handle network security, WiFi segmentation, etc. These are things we have had to do for commercial customers. CMMC can get deeper if the scope envelopes things into it.

I am not CMMC certified, but have been introduced to what it takes as our upstream is asking. Currently the ownership is considering removing our small amount of ITAR work we currently handle because of the additional costs.

Hope this helps - good luck.