Terms / Certification

Level 2

The 110 requirements of NIST SP 800-171, assessed by you or by a C3PAO depending on what your contract says. This is where most CMMC work happens.

Also called CMMC Level 2, Level 2 (Self), Level 2 (C3PAO).

Official Source Material

The OSA must complete and achieve a MET result for all security requirements specified in § 170.14(c)(3) to achieve the CMMC Status of Level 2 (Self).

Source: 32 CFR 170.16(a)(1), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

Level 2 applies when your work involves Controlled Unclassified Information.

The requirements are the 110 in NIST SP 800-171. The assessment tests them through the objectives in NIST SP 800-171A. They run from AC.L2-3.1.1 to the end of the system and information integrity family. Nothing here is new. The clause in your contract has required the standard for years, and Level 2 is how the Government confirms it.

Self and C3PAO are two different worlds, and the contract picks one.

Level 2 (Self) means you assess yourself and submit the result, under 32 CFR 170.16. Level 2 (C3PAO) means you hire an authorized C3PAO and pay for a certification assessment, under 170.17. The requirements are identical. The cost, the scheduling, and the scrutiny are not. Read the blank in DFARS 252.204-7021 before you plan.

A Level 2 status lasts three years, with an affirmation each year.

You reassess every three years and affirm annually in between. A conditional status lasts only 180 days and must be closed out to become final. Build the calendar at the start, because the annual affirmation is the obligation companies forget.

Scope decides your cost more than any control does.

Bringing the whole company into scope means 110 requirements across every system. Bringing one enclave into scope means 110 requirements across a much smaller environment. The requirements do not change. The number of assets you must evidence them on changes entirely.

What falls short

Preparation that starts with buying tools. The scoping decision comes first, and it often removes the systems the tool was meant to cover.
A system security plan written after the assessment is booked. The plan is a requirement and cannot go on a plan of action.
A score submitted with no evidence behind it. The affirmation asserts the requirements are implemented.

Edge cases

You reach Level 2 (Self) for the same scope. That also satisfies Level 1 (Self) under 170.16(a).
Your score does not reach the threshold. A POA&M is only available if your score divided by 110 is at least 0.8 and the open items meet the limits in 170.21.
The Government later assesses you and disagrees. A DCMA DIBCAC result takes precedence over a pre-existing status, and awards at that level stop until a new status is achieved.

Over-engineering

Hiring an assessment organization when the contract names Level 2 (Self). The difference is a substantial fee for the same requirements.
Certifying the whole enterprise because it is conceptually simpler. You pay for that simplicity in every requirement, on every asset, every three years.

Connects to

Controlled Unclassified Information (CUI) CUI is unclassified information a law, regulation, or Government-wide policy requires you to protect. Handling it puts you at CMMC Level 2. What you protect
NIST SP 800-171 The publication holding the 110 security requirements that make up CMMC Level 2. Revision 2 is the version the CMMC Program uses. Assessment
NIST SP 800-171A The companion publication holding the assessment objectives. It is the document an assessor actually works from, so it is the one to read. Assessment
AC.L2-3.1.1 Authorized Access Control Access Control (AC)
C3PAO A CMMC Third-Party Assessment Organization. It is the company that performs a Level 2 certification assessment and charges you for it. Assessment
DFARS 252.204-7021 The contract clause that requires a current CMMC status at the level the contract names, an annual affirmation, and flow-down to subcontracts. The contract
Conditional certification The status you hold when your assessment left items on a POA&M. It lasts 180 days and expires if the closeout does not happen. Certification
Final certification The status you hold when every requirement is met. It lasts one year at Level 1 and three years at Level 2 and Level 3. Certification
Scope The set of assets that will be assessed. Scope is the single decision that drives your cost, your evidence burden, and your assessment length. Scope and assets
Enclave A separated environment built to hold the controlled work and nothing else. It is the usual way a small company keeps its assessment small. Scope and assets
System Security Plan (SSP) The document describing your system and how it meets each requirement. It is itself a requirement, and it cannot go on a POA&M. Assessment
Plan of Action and Milestones (POA&M) A POA&M lists the CMMC requirements you have not met, who fixes each one, and by when. It buys a Conditional status and 180 days, not a pass. Assessment

Referenced by

CMMC The Cybersecurity Maturity Model Certification. It is the program that verifies a defense contractor meets the security requirements already in its contract. Certification
Final certification The status you hold when every requirement is met. It lasts one year at Level 1 and three years at Level 2 and Level 3. Certification
Level 1 The 15 basic safeguarding requirements for FCI, assessed by you every year. No plan of action is permitted at Level 1, ever. Certification
Level 3 The 24 additional requirements from NIST SP 800-172, assessed by the Government. Final Level 2 (C3PAO) is a prerequisite for even starting. Certification
AC.L2-3.1.20 External Connections Access Control (AC)
AC.L2-3.1.22 Control Public Information Access Control (AC)
IA.L2-3.5.3 Multifactor Authentication Identification and Authentication (IA)
MP.L2-3.8.3 Media Disposal Media Protection (MP)
PE.L2-3.10.3 Escort Visitors Physical Protection (PE)
SC.L2-3.13.11 CUI Encryption System and Communications Protection (SC)