Insight
What is CMMC Level 2?
CMMC Level 2 is the cybersecurity certification level for defense contractors that process, store, or transmit Controlled Unclassified Information. It is based on the 110 security requirements in NIST SP 800-171 and usually requires a third-party assessment by a C3PAO for contracts involving CUI.
What it requires
- A defined CUI environment and assessment boundary
- A System Security Plan describing control implementation
- Evidence mapped to each applicable NIST 800-171 requirement
- POA&M management where allowed
- Assessment readiness for a C3PAO or required self-assessment path
How DefenseEye helps
- CUI scoping and control gap assessment
- SSP and POA&M development
- Evidence automation through CMMCLens
- Microsoft GCC High and Azure Government readiness support
Frequently asked questions
- Who needs CMMC Level 2?
- Organizations that handle CUI under DoD contracts generally need CMMC Level 2.
- Is CMMC Level 2 only documentation?
- No. Documentation must reflect implemented technical, administrative, and operational controls.