The CUI protection baseline
Level 2 uses the 110 security requirements in NIST SP 800-171 Revision 2 under the current CMMC rule. The requirements span 14 security families, including access control, incident response, configuration management, risk assessment, and security assessment. Use the revision incorporated into the applicable rule and contract; a newer NIST publication does not automatically replace the CMMC baseline.
Self-assessment or C3PAO assessment
The procurement determines whether Level 2 self-assessment or a Level 2 certification assessment by an authorized or accredited C3PAO is required. Both pathways have a three-year assessment cycle and annual affirmation obligations, subject to continued compliance and the applicable conditions. A consultant, software subscription, or internal readiness review cannot substitute for a required C3PAO assessment.
Scope and the System Security Plan
The System Security Plan should describe the assessed environment and how requirements are implemented. Align it with asset inventories, data flows, provider responsibilities, and the evidence used to support assessment objectives. When a diagram, an implementation statement, and the actual environment disagree, resolve the discrepancy before relying on the packet.
Conditional status has limits
A qualifying Level 2 assessment may result in conditional status with a permitted POA&M. The rule imposes a minimum score, exclusions for particular requirements, and closeout within 180 days. A score alone does not establish eligibility for conditional status. Check the specific requirements in 32 CFR 170.21 and the required closeout assessment pathway.