CMMC 2.0 Level 2
ActiveSpecialized framework
Best for: All DoD contract and subcontract awardees that will process, store, or transmit information, in performance of the DoD contract, that meets the standards for FCI or CUI on contractor information systems.
| Mandatory? | Applies to DoD solicitations and contracts where a contractor will process, store, or transmit FCI or CUI, with requirements phased in over four phases. |
|---|---|
| Who validates? | Self-assessment by the organization (Level 2 (Self)) or a CMMC Third-Party Assessment Organization (C3PAO) (Level 2 (C3PAO)) |
| Renewal | |
| Governing body | Department of Defense (DoD). Official source |
Controls by category
143 controls are Mapped to CMMC 2.0 Level 2.
AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
AC.L2-3.1.12 Monitor and control remote access sessions
AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
AC.L2-3.1.14 Route remote access via managed access control points
AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
AC.L2-3.1.4 Separate the duties of individuals to reduce the risk of malevolent activity without collusion
| Control | Status |
|---|---|
| Azure subscriptions should have more than one owner | Mapped |
AC.L2-3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts
AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
AU.L2-3.3.4 Alert in the event of an audit logging process failure
AU.L2-3.3.5 Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity
CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
IA.L2-3.5.10 Store and transmit only cryptographically-protected passwords
| Control | Status |
|---|---|
| Windows machines should not store passwords using reversible encryption | Mapped |
IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
IA.L2-3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
IA.L2-3.5.8 Prohibit password reuse for a specified number of generations
| Control | Status |
|---|---|
| Windows machines should prohibit reuse of the previous 24 passwords | Mapped |
IR.L2-3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization
MP.L2-3.8.9 Protect the confidentiality of backup CUI at storage locations
RA.L2-3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
RA.L2-3.11.3 Remediate vulnerabilities in accordance with risk assessments
SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
SC.L2-3.13.16 Protect the confidentiality of CUI at rest
SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
SI.L1-3.14.1 Identify, report, and correct system flaws in a timely manner
SI.L1-3.14.2 Provide protection from malicious code at designated locations within organizational systems
SI.L1-3.14.4 Update malicious code protection mechanisms when new releases are available
SI.L1-3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
SI.L2-3.14.3 Monitor system security alerts and advisories and take action in response
SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
SI.L2-3.14.7 Identify unauthorized use of organizational systems
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| FedRAMP Moderate Baseline Rev 4 | High 97% | |
| NIST SP 800-171 Rev 2 | High 87% | |
| NIST SP 800-53 Rev 5 | High 87% |
Frequently asked questions
What does CMMC 2.0 establish for defense contractors?
It establishes requirements for defense contractors and subcontractors to implement prescribed cybersecurity standards for safeguarding Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
Which NIST publication do the Level 2 practices align with?
Level 2 is described as Advanced and is based on practices aligned with `NIST SP 800-171`. The CMMC Program uses `NIST SP 800-171` Revision 2, February 2020, which includes updates as of January 28, 2021.
Does Azure hold a CMMC certification that a customer can inherit?
CMMC is not applicable directly to cloud services, so there is no corresponding certification for a cloud platform such as Azure. A DIB contractor offering a cloud-based solution must ensure the platform maintains a minimum of `FedRAMP Moderate` authorization.
How is CMMC implemented in phases?
DoD is using a phased approach with four phases. Phase 1 begins on the effective date of the complementary 48 CFR part 204 CMMC Acquisition final rule. Each later phase begins one calendar year after the start of the previous phase.