CMMC 2.0 Level 2

Why does it matter?

Level 2 is where CMMC becomes a number. An assessment starts at 110 points, subtracts 5, 3 or 1 point for each requirement not met, and cannot be completed at all without a current System Security Plan (32 CFR 170.24(c)).

Key benefits include:

• Contract eligibility

Before award the offeror must hold a Conditional or Final Level 2 (Self) or (C3PAO) status, as the solicitation requires, and have submitted an affirmation in SPRS (170.16(b), 170.17(b)).

• A threshold with limits

A Conditional status needs at least 80 percent of 110 points, which is 88, and a plan of action restricted to one-point requirements, with one three-point exception (170.21(a)(2)).

• Three-year validity

A Final Level 2 status is valid for three years from the CMMC Status Date, with an annual affirmation (170.16, 170.17, 170.22).

• Reuse of earlier DIBCAC work

A perfect-score DCMA DIBCAC High Assessment with no open plan of action, finished before December 16, 2024, counts as Final Level 2 (C3PAO) for three years from that assessment (170.20).

• Clear cloud rules

A cloud service provider that handles CUI must meet the FedRAMP requirements in DFARS 252.204-7012, and other external service providers fall inside the assessment (170.19(c)(2)).

How does it work?

The organization specifies its Assessment Scope, records each asset in the inventory, network diagram and System Security Plan, then assesses each of the 110 requirements against NIST SP 800-171A (June 2018), which breaks them into assessment objectives. Each requirement is MET, NOT MET or Not Applicable, and evidence must be in final form, not draft (170.24(b)).

A self-assessment is run by the organization and posted to SPRS. A certification assessment is run by a C3PAO, which posts results to eMASS for transfer to SPRS and keeps hashed artifacts as evidence. Any plan of action must be closed by a closeout assessment within 180 days of the Conditional status date, or the status expires, and artifacts are kept for six years (170.16, 170.17).

A status is current for three years only while an Affirming Official affirms each year. DFARS 252.204-7021 defines a Final Level 2 status as current when it is under three years old, with no compliance changes and an affirmation under one year old. A DCMA DIBCAC assessment under DFARS 252.204-7020 can override an earlier status (170.16(a)(1)(iv)).

Key Elements

• Requirements and domains

The 110 requirements are those of NIST SP 800-171 Rev. 2, grouped into 14 domains from Access Control (AC) to System and Information Integrity (SI). Each has an identifier in the form DD.L2-3.x.x, for example AC.L2-3.1.1 (170.14(c)).

• Scoring methodology

Requirements carry 5, 3 or 1 point. Multifactor authentication (IA.L2-3.5.3) loses 3 points if used only for remote and privileged users and 5 if absent. FIPS-validated encryption (SC.L2-3.13.11) loses 3 points if encryption is not validated and 5 if absent (170.24(c)(2)).

• Conditional status and POA&M limits

A plan of action is allowed only with a score of at least 80 percent, only for one-point requirements (SC.L2-3.13.11 may be a three-point exception), and never for six named requirements, among them the System Security Plan (CA.L2-3.12.4) and external connections (AC.L2-3.1.20). Closeout is due in 180 days (170.21).

• System Security Plan

An up-to-date SSP describing each system in scope must exist at assessment time. Without it the assessment cannot be completed and is recorded as noncompliant with DFARS 252.204-7012 (CA.L2-3.12.4; 170.24(c)(5)).

• Asset categories

Scoping sorts assets into CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets (IoT, IIoT, OT, government furnished equipment, restricted systems and test equipment) and Out-of-Scope Assets. CUI Assets are assessed against all 110 requirements (170.19(c)).

• External service providers

A cloud service provider that stores CUI must meet the FedRAMP requirements in DFARS 252.204-7012. Other providers that handle CUI or Security Protection Data are assessed within the contractor's scope, and a customer responsibility matrix records who meets which requirement (170.19(c)(2)).

What does it cover?

Level 2 applies to contractor information systems that process, store or transmit CUI, and to the assets that protect them or are not logically or physically isolated from them (170.1(a)). A prime must flow at least Level 2 (Self) down to every subcontractor that handles CUI, and Level 2 (C3PAO) where its own contract requires Level 2 (C3PAO) or Level 3 (170.23). Federal information systems that a contractor operates for the Government are outside the program (170.3(b)).

What are its objectives?

Level 2 asks the contractor to meet, and be able to prove, every NIST SP 800-171 Rev. 2 requirement that applies.

Implement all 110 requirements, or hold a Conditional status with a compliant plan of action and milestones.

Keep an up-to-date System Security Plan for every system in the Assessment Scope.

Self-assess or obtain a C3PAO assessment as the contract requires, following NIST SP 800-171A.

Post results to SPRS and affirm every year through an Affirming Official.

Keep assessment artifacts for six years from the CMMC Status Date.

Reassess every three years and manage changes so the status stays current (DFARS 252.204-7021).

Framework in Context

Level 2 is the middle level of the CMMC Program. A Level 2 status also satisfies Level 1 for the same scope (170.16(a)), and a Final Level 2 (C3PAO) status is the prerequisite for a Level 3 assessment (170.18(a)). The rule incorporates NIST SP 800-171 Revision 2 by reference (170.2). DoD's CMMC Assessment Guide, Level 2, Version 2.13 of September 2024, sets out the objectives and evidence for each requirement.

Common Framework Mappings

Level 2 maps directly to NIST SP 800-171 Rev. 2, whose 110 requirements are identical, and it sits between the CMMC Level 1 and CMMC Level 3 requirements. Organizations also map it to NIST SP 800-53, NIST SP 800-161 for supply chain risk, ISO/IEC 27001, the NIST Cybersecurity Framework and the CIS Critical Security Controls to reuse evidence.

Mapped frameworks include:

CIS Controls v8.1

CMMC 2.0

CMMC 2.0 Level 3

ISO 27001:2022

NIST CSF 2.0

NIST SP 800-161 Rev.1

NIST 800-171 Rev.2

NIST 800-53 Rev.5