CMMC Level 2 Requirements

CMMC Level 2 is the level of the Cybersecurity Maturity Model Certification (CMMC) program designed to protect Controlled Unclassified Information (CUI). It requires organizations to implement the 110 security requirements in National Institute of Standards and Technology (NIST) SP 800-171 Rev. 2. When a Department of War (DoW) contract requires Level 2, organizations need to achieve that status before award and maintain it for the life of the contract, through either a self-assessment or a third-party assessment, depending on the contract. 

CMMC Level 2 includes 110 security requirements from NIST SP 800-171 Rev. 2, organized into 14 families such as Access Control, Incident Response, and System and Communications Protection. You may see 97 requirements referenced elsewhere. That number comes from NIST SP 800-171 Rev. 3, which CMMC does not currently use. Each requirement also has assessment objectives that define what “met” looks like, so understanding them early can save time during readiness work 

Controlled Unclassified Information (CUI) is information the government creates or possesses, or that a contractor creates or possesses on the government’s behalf, that a law, regulation, or government-wide policy requires to be handled using safeguarding or dissemination controls. Examples can include controlled technical information and export-controlled data. The National Archives and Records Administration (NARA) maintains the CUI Registry, which lists recognized categories. If you’re unsure whether information you’ve received is CUI, ask your contracting officer or prime contractor. 

Not always. Depending on the contract, CMMC Level 2 can be met through a self-assessment or a third-party assessment by a Certified Third-Party Assessment Organization (C3PAO). Handling CUI doesn’t automatically mean you need a C3PAO. The contract specifies which path applies. Our advisors can help you understand what your contract requires and prepare for either path. 

NIST SP 800-171 is a publication from the National Institute of Standards and Technology (NIST) that defines security requirements for protecting CUI in nonfederal systems, such as those operated by defense contractors. Contracts that include Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 already require contractors handling CUI to implement it. CMMC Level 2 builds on those requirements by adding a way to verify implementation through assessment. 

CMMC Level 2 status is valid for three years, whether it’s achieved through a self-assessment or a C3PAO assessment. Organizations must also submit an annual affirmation in the Supplier Performance Risk System (SPRS) confirming they continue to meet the requirements. Because status has to be maintained throughout a contract, ongoing readiness matters as much as the initial assessment. Our advisors can help you keep your documentation and practices current, so you’re not starting over at reassessment time and you’re ready when the next opportunity comes.