If your contract includes DFARS 7012, or you receive documents marked CUI, you're in Level 2 territory. Level 1 protects basic contract information. Level 2 protects Controlled Unclassified Information, and that raises the bar.
Here's what it looks like in practice.
Step 1: Confirm CUI is actually in your contract
CUI comes to you through the contract: the DFARS 7012 clause, flow-downs from your prime, and CUI markings on the documents you receive. If none of those are there, you may be a Level 1 company.
Step 2: Draw a box around the CUI
Decide where CUI will live and who touches it. Keeping it in a small, separate environment means fewer systems to protect and simpler compliance.
Step 3: Meet the 110 requirements in NIST SP 800-171
Level 2 maps to the 110 security requirements in NIST SP 800-171, grouped into 14 families such as access control, incident response and configuration management. See our Level 2 requirements page for the full list.
Step 4: Write it down in your System Security Plan
Your SSP explains how each requirement is met in your environment. If it isn't in the SSP, an assessor treats it as not done.
Step 5: Score yourself and post it in SPRS
You score against the DoD Assessment Methodology, starting at 110 and subtracting points for each gap. The result goes into SPRS. Our SPRS score guide walks through the math.
Step 6: Know the POA&M rules
Unlike Level 1, Level 2 allows a Plan of Action and Milestones for some gaps. You need at least 88 of 110 points, certain high-value requirements can't be deferred, and open items must be closed within 180 days.
Step 7: Self-assessment or third-party certification
Your contract decides which one applies. Some Level 2 contracts allow a self-assessment, and others require a certification assessment by a C3PAO. Either way, it's renewed every three years, with an affirmation every year. See self-assessment vs. C3PAO.
Where to go next
Cyberneza is a veteran-owned firm with a 100% US-based team that helps defense contractors get Level 2 right. Send us a message.