Access and identity
Access Control and Identification & Authentication govern who can access CUI systems, how privileges are limited, how remote access is protected, and how identities are authenticated.
CMMC Level 2
CMMC Level 2 applies 110 NIST SP 800-171 requirements to the systems and assets inside the assessment scope.
Level 2 applies the 110 security requirements in NIST SP 800-171 Revision 2 to the systems and assets inside the CMMC scope, then evaluates that implementation through the CMMC assessment type required by the contract.
Current implementation
Current Phase 1 procurement requirements center Level 2 Self.
The Department's current CMMC guidance says the program is paused in Phase 1. During this phase, procurements may require Level 1 (Self) or Level 2 (Self). The underlying CMMC regulation still defines Level 2 C3PAO certification, but mandatory Phase II third-party requirements are suspended while the Department reviews the program.
The 110 requirements
Fourteen requirement families applied to one operating environment.
People and process
Awareness & Training and Personnel Security require recurring operational practices that no security tool can satisfy by itself.
Operations and evidence
Audit & Accountability, Configuration Management, Maintenance and Media Protection create many of the records an assessment relies on.
Risk and assurance
Risk Assessment, Security Assessment, Incident Response and System & Information Integrity require repeatable processes, not one-time documents.
Environment and communications
Physical Protection and System & Communications Protection address the physical and technical boundaries around systems handling CUI.
Documentation and evidence
The SSP describes the system, boundary and implementation. Supporting evidence must demonstrate the stated implementation. Open eligible items may be tracked in a POA&M only within the limits of the CMMC rule.
Five Level 2 workstreams
- 1. Scope: determine which assets and external services are inside the assessment boundary.
- 2. Implement: satisfy the 110 Rev. 2 security requirements in the operating environment.
- 3. Document: build an SSP and supporting procedures that match the implemented environment.
- 4. Evidence: maintain final, dated artifacts demonstrating that requirements are implemented and performed.
- 5. Assess and maintain: conduct the applicable assessment, submit required results and affirmations, and maintain the assessed environment.
What does not establish compliance
- Purchasing a product marketed as “CMMC compliant.”
- Writing policies for requirements that are not implemented.
- Assuming an MSP or cloud provider assumes all contractor responsibilities.
- Treating every open requirement as POA&M-eligible.
- Assuming an enclave automatically removes every supporting system from scope.
Architecture before licensing
Scope can materially change Level 2 implementation cost.
The Level 2 rule has defined asset categories and scoping treatment. If CUI is allowed to spread through ordinary commercial email, shared drives and endpoints, the assessment boundary can grow. A deliberately designed CUI enclave can instead concentrate CUI handling into a smaller protected workflow when the business use case allows it.
PreVeil is one example. It provides end-to-end encrypted email and file sharing and publishes FedRAMP Moderate Equivalency and FIPS 140-3-validated cryptography information. Used in a properly scoped architecture, an enclave can help minimize the CUI footprint. It does not satisfy all 110 requirements and does not replace formal scoping analysis.
Cyberneza support
Implementation, documentation, evidence, and assessment preparation.
CUI boundary definition
Trace CUI flows and document the asset categories that determine which systems and services are in scope.
Control-by-control gap assessment
Assess all 110 requirements, identify missing implementation and produce a sequenced remediation plan.
Implementation support
Remediate technical, administrative and operational gaps in the environment.
SSP, POA&M and evidence
Build documentation that matches the operating environment and organize evidence suitable for self-assessment, government review or an independent assessment when required.
SPRS preparation
Where the DFARS 7019/7020 Basic Assessment applies, calculate a supportable NIST SP 800-171 score and prepare the required submission information. Separately prepare the information required for the applicable CMMC assessment status.
Assessment readiness
Prepare for Level 2 Self when required today and maintain evidence suitable for future C3PAO or government-led review if the contract requires it.
Need an implementation plan for the 110 Level 2 requirements?
Start with the contract and the CUI boundary. Cyberneza can identify the applicable requirements, assess current implementation, document the specific gaps, and sequence remediation, SSP development and evidence collection.