CMMC consists of three (3) levels ranging from Foundational to Expert. These levels measure an organization’s degree of cyber maturity via an established set of processes, practices and focus areas.
Level 2 (Advanced) is for companies working with CUI. The requirements mirror NIST SP 800-171, and align with the 14 domains and 110 security controls developed to protect CUI.
Certifications
Level 2 is focusing primarily on protecting, storing and transmitting Controlled Unclassified Information (CUI). If your organization handles both – FCI and CUI – you will have to meet CMMC Level 2 requirements or higher.
This level aims at fleshing out the base security practices established in Level 1 and increasing the overall security of the organization. Level 2 is a considerable step up that impacts both timeline and cost.
Assessment requirements for Level 2 compliance differ based on whether the CUI data handled is considered critical or non-critical to national security.
The Department of Defense has stated that roughly 80,000 in the DIB will need to achieve CMMC Level 2 via a C3PAO assessment.
Level 2 requires organizations to engage in a set of 110 practices from NIST 800-171. CMMC 2.0 Level 2 focuses on intermediate cyber hygiene, creating a logical but necessary progression for organizations to step from Level 1 to Level 3. In addition to safeguarding Federal Contract Information (FCI), Level 2 begins to include protections of Controlled Unclassified Information (CUI).
Based on the 110 controls found in NIST 800-171.
Required for any contractor that handles CUI, CTI, or ITAR.
In most cases, requires a third-party assessment by an authorized C3PAO.
At level 2, the AC domain adds ten controls. These are geared toward further isolating key systems and defining authorized session privileges.
CMMC Level 2 compliance requires strict AC mechanisms to be put in place.
The AU domain has four additional controls for CMMC Level 2 compliance.
By considering these controls, contractors will have accurate reporting and clear knowledge of their entire system.
There are two additional control practices for meeting the AT domain requirements at Level 2 maturity.
AT maturity involves training and support so that all individuals can handle their assigned roles for CMMC Level 2 compliance.
For those seeking CMMC Level 2 compliance, six control practices have been added to the CM domain.
These controls ensure any changes made can be tracked and managed according to security best practices.
The IA domain for CMMC Level 2 compliance provides five controls for granting system access to authorized users.
IA focuses primarily on the strategic use of passwords and policies for changing or updating those passwords.
IR addresses existing plans or strategies for dealing with potential IT security problems that may arise. There are five controls in IR that are directly concerned with discovering, reporting on, and resolving incidents.
IR is necessary for CMMC Level 2 compliance because it gives contractors a way to respond to incidents before these incidents cause further harm to existing IT infrastructure.
CMMC Level 2 compliance offers four controls within the MA domain.
The MA domain provides steps to secure systems when malfunctions or other unexpected incidents occur.
For the MP domain, CMMC Level 2 compliance has added three controls associated with protecting and properly disposing of media content.
Good media protection practices allow users to safeguard CUI on all organizational systems.
The PS domain for CMMC Level 2 compliance deals with protecting CUI during transitions in employee status. There are two controls associated with PS.
These controls ensure that critical CUI won’t be compromised due to changes in HR.
Protecting physical infrastructure is the primary purpose of PE. It adds a single control for CMMC Level 2 compliance.
This control provides an added layer of protection against potential security breaches.
RE is a key domain for CMMC Level 2 compliance. There are two controls associated with managing backups.
Regularly backing up and storing CUI will ensure you maintain operational requirements for contracts with the DoD.
RM is primarily concerned with mitigating security threats that could cause data to be compromised. RM offers three controls for CMMC Level 2 compliance.
Managing security risks quickly is essential for IT directors and security professionals who want to mitigate potential problems down the road.
The CA domain is defined by the ability of an organization to develop a cohesive system security plan and related mechanisms. There are three controls that have to be accounted for.
With the CA controls in place, companies can remedy deficiencies and get their security infrastructure ready for CMMC Level 2 compliance.
Adhering to the SC domain allows IT directors and security professionals to clarify their security policies for communication inside and outside the system. SC contains two controls dealing with user devices and sessions.
Control and monitoring of communications across the network are essential for meeting CMMC Level 2 compliance.
For SI compliance, contractors must be able to find and mitigate potential security flaws while monitoring the network. There are three controls for attaining CMMC Level 2 compliance.
Level 2 SI compliance means preventing data theft, spying, and other illegal activities that may pose a threat to CUI.
A CMMC Level 2 assessment is conducted by an accredited C3PAO to certify that a DoD contractor or subcontractor in possession of Controlled Unclassified Information (CUI) is compliant with the mandated security standard established in the CMMC regulation. Currently, the CMMC Level 2 standard is based on NIST 800-171r2. Contractors are also required to flow down those requirements to any subcontractors that will process or manage CUI.
CMMC Level 2 consists of the 110 security controls specified in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, which pertains to protecting Controlled Unclassified Information (CUI). Contractors must demonstrate compliance with both Level 1 and Level 2 practices to achieve CMMC Level 2 certification.
Contractors requiring CMMC Level 2 certification must have a CMMC Level 2 assessment conducted by an Authorized CMMC Third-Party Assessment Organization (C3PAO).
Before conducting a CMMC assessment, the contractor must specify the CMMC Assessment Scope, which informs which assets within the contractor’s environment will be assessed and the details of the assessment. Assets are categorized into five groups: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets. Each category must be carefully considered as described in the CMMC Scoping Guide.
In a CMMC Level 2 assessment, the findings can be categorized as “MET,” “NOT MET,” or “NOT APPLICABLE (N/A)” for each practice. To achieve a specific CMMC level, the contractor needs a “MET” or “N/A” finding on all CMMC practices required for that level as well as for all lower levels.
The assessment methods as defined in the CMMC Assessment Guide include examine, interview, and test. These methods involve reviewing access control policies, procedures, system security plans, conducting interviews with personnel responsible for access enforcement and asking key personnel to demonstrate controls.
Detailed information on each CMMC Level 2 practice, including assessment objectives, methods, objects, discussions, and further explanations, can be found in the CMMC Assessment Guide – Level 2, which is organized by domain, level, and practices. It provides comprehensive guidance for assessing each practice.
Yes, all CMMC levels, including Level 2, are achievable by contractors of various sizes. The CMMC assessment methodology is designed to apply the practices equally, regardless of the contractor’s size, constraints, or complexity.
Organizations can improve compliance by establishing clear policies and procedures, conducting regular assessments, implementing secure technologies, and providing training to their personnel. Continuous monitoring and adjustment of security measures are also key to compliance.
References for CMMC Level 2 assessment include the FAR Clause 52.204-21 (for Level 1) and NIST SP 800-171 Rev 2. These documents provide additional information and requirements related to CMMC assessment practices. The DoD provides comprehensive documentation on CMMC Assessment requirements.