The intermediate tier under CMMC 2 applies to most defense contractors and subcontractors that handle Controlled Unclassified Information (CUI). Level 2 aligns directly with the 110 security requirements in NIST SP 800-171, spanning areas such as access control, incident response, audit logging, configuration management, and encryption. Meeting these requirements is essential for federal contractor compliance, particularly for those subject to DFARS 252.204-7012 and other DoD cybersecurity obligations.

Level 2 represents a significant step up from Level 1 (Foundational), which applies to Federal Contract Information (FCI) and requires only 15 basic safeguards. At Level 2, organizations must demonstrate that their cybersecurity program can effectively protect sensitive data throughout the Defense Industrial Base (DIB). Achieving this level requires not only technical controls, but also documented policies, procedures, and evidence that those controls are operating as intended. For subcontractors, understanding the CMMC requirements for subcontractors is crucial to ensure compliance.

CMMC Level 2 compliance may be validated through select lower-risk programs or through a third-party assessment conducted by a CMMC Assessor Organization (C3PAO) for higher-risk contracts. Because CUI is central to most DoD programs, Level 2 is expected to be the most common requirement across future DoD contracts. Utilizing a CMMC level 2 checklist can aid in preparing for these assessments and achieving cmmc compliance certification.

Preparing for a CMMC Level 2 assessment requires a comprehensive and defensible approach to security—one that can withstand documentation review, interviews, and technical validation. This preparation is a key component of information security and compliance for federal contractors aiming for cmmc 2.0 certification.