What Level 2 covers
Level 2 assesses all 110 security requirements in NIST SP 800-171 Rev. 2, across 14 families: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity. Each requirement breaks down into assessment objectives, and the assessor tests every one.
Self-assessment or certification?
Your contract decides. Some Level 2 work allows a self-assessment. From Phase 2, starting November 10, 2026, contracts can require certification by an authorized C3PAO before award. Either way the controls are the same. Certification is valid for three years, with an annual affirmation by a senior official.
Where the work is
- The CUI boundary: deciding whether the whole company is in scope or only a defined enclave. A smaller boundary often cuts cost and time a lot.
- Identity: MFA for every user with access to CUI, privileged accounts separated from daily ones, session limits and account lockout.
- Encryption: FIPS-validated cryptography for CUI at rest on laptops and in transit, which rules out a lot of consumer-grade tools.
- Logging and monitoring: security events collected, kept and actually reviewed, with alerts that reach a person.
- Configuration management: hardened baselines, an approved software list and change control that leaves evidence.
- Incident response: a tested plan and the ability to report cyber incidents to DoD within 72 hours, as DFARS 252.204-7012 requires.
- Documentation: a System Security Plan that describes how each requirement is met, and a POA&M for anything still open.
Our approach
- Gap assessment and scope, with a real score and a fixed-price plan.
- Remediation sprints done by our engineers, grouped so your production schedule isn't disrupted.
- CUI environment: Microsoft 365 GCC High or a dedicated enclave where it makes sense.
- Documentation written from the configured environment, not from a template.
- Mock assessment using the assessment objectives, with staff interview prep.
- Assessment support while the C3PAO is on site, and evidence pulled on request.
Questions about cmmc level 2
Can we use our current IT provider and just have you write the documents?
You can, but documentation has to match what's actually configured, and assessors interview the people who run your systems. We'll work alongside your provider if they're willing. Many clients find it simpler to have one team do both.
Do we have to move to GCC High?
Not always. If CUI flows through Microsoft 365, commercial tenants generally don't meet the DFARS 7012 cloud requirements, and GCC High is the common answer. Some contractors are better served by a smaller enclave that keeps CUI separate from everything else. We'll compare cost and disruption for your case.
