CMMC Level 2: Requirements & How to Pass

What is CMMC Level 2?

CMMC Level 2 (Advanced) is the most common certification level for defense contractors. It requires implementation of all 110 security controls from NIST SP 800-171 and typically requires assessment by a Certified Third-Party Assessment Organization (C3PAO).

Level 2 is required for any DoD contractor or subcontractor that handles Controlled Unclassified Information (CUI).

CMMC Level 2 Requirements

To achieve CMMC Level 2, you must:

1. Implement all 110 NIST 800-171 controls across your CUI environment
2. Document your controls in a System Security Plan (SSP)
3. Address any gaps with a Plan of Action & Milestones (POA&M)
4. Pass a C3PAO assessment — a certified third party verifies your implementation
5. Maintain compliance with annual affirmations

The C3PAO Assessment Process

Common Level 2 Failures

The most common reasons organizations fail CMMC Level 2 assessments:

• Incomplete SSP — Missing control descriptions or inaccurate scope boundaries
• Insufficient access controls — Lacking MFA, excessive privileges, poor session management
• Weak audit logging — Incomplete logs, no log review process, insufficient retention
• Poor configuration management — No baseline configurations, uncontrolled changes
• Missing incident response plan — No documented IR procedures or untested plans

How Hatty AI Ensures You Pass Level 2