CMMC Level 2 guide for movers
What each of the 110 Level 2 requirements means for a moving company, in plain words, with the official wording, the points it costs if missed and whether it can wait.
Know the number, such as 3.5.3? Look up a requirement by number.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
How Level 2 works
- 110 requirements in 14 families. Level 2 is the 110 security requirements of NIST SP 800-171 Revision 2.
- You assess yourself. A Level 2 self-assessment needs no outside assessor: you score your company, post the result in SPRS, and a senior official of your company affirms it. You assess again at least every three years and affirm every year in between, both counted from your CMMC Status Date.
- Scored out of 110. Your score starts at 110, and each requirement you do not meet subtracts 5, 3 or 1 points, so a score can fall below zero.
- Some gaps may wait, briefly. A gap may sit on a plan of action (POA&M) only if your score is at least 88 of 110, only for 1-point requirements (plus one encryption case), and it must be closed within 180 days. Six requirements can never wait: 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5 and 3.12.4.
- For DP3, section A.2 of the Tender of Service sets the dates for TSPs' Level 1 and Level 2 self-assessments and affirmations in SPRS. Check it for the current dates.
Sources: NIST SP 800-171 Rev 2, 32 CFR 170.16, 32 CFR 170.22, 32 CFR 170.24, 32 CFR 170.21, IAM CMMC Resource Center, IAM: What You Need to Do for CMMC
On these pages, “DoD shipment information” means the controlled information you handle for DP3 shipments, such as a service member's personal details and shipment documents. Each requirement also shows its official wording, because that is what your assessment is scored against.
Where to start
The same six steps as Start here:
- Learn what Level 2 asks. Read the 14 families below: all 110 requirements in movers' terms. For quick answers, see the FAQ.
- Work out what is in scope. Which systems, phones, papers and places the requirements apply to. See what's in scope at a moving company.
- Find your gaps. Take Project Spectrum's free Level 2 self-assessment. See your first hour on Project Spectrum.
- Fix and track. Fix the 5-point gaps first: they cost the most, and none of them can wait on a plan of action. Each family page shows how many it has. Track every gap, owner and date in the free workbook. Adapt and approve the policies pack, train your crews with the training kit, and check your providers and agents with the vendor and agent kit.
- Write your System Security Plan. Requirement 3.12.4: without it, the assessment cannot be completed. Start from the free SSP template.
- Assess, post and affirm. Do your self-assessment against the official assessment objectives in NIST SP 800-171A (the DoD Level 2 Assessment Guide lists them), and keep the evidence. Then post it in SPRS and have your Affirming Official affirm it.
Questions? See the FAQ: Level 2 questions movers ask.
The 14 families
Each card shows its family's requirement numbers: 3.5.1 to 3.5.11 are Identification and Authentication, for example. Know the number? Look up any requirement by number.
3.1.1 to 3.1.22 · 22 requirements
Access Control (AC)
Who can get into your systems, and what each person can do once inside.
3.2.1 to 3.2.3 · 3 requirements
Awareness and Training (AT)
Your people know the risks and their part in avoiding them.
3.3.1 to 3.3.9 · 9 requirements
Audit and Accountability (AU)
Records of who did what, kept long enough and protected from tampering.
3.4.1 to 3.4.9 · 9 requirements
Configuration Management (CM)
Know what equipment and software you have, and keep it set up safely.
3.5.1 to 3.5.11 · 11 requirements
Identification and Authentication (IA)
Everyone and everything proves who they are before getting in.
3.6.1 to 3.6.3 · 3 requirements
Incident Response (IR)
A plan for when something goes wrong, and practice using it.
3.7.1 to 3.7.6 · 6 requirements
Maintenance (MA)
Repairs and upkeep done without opening a door to the information.
3.8.1 to 3.8.9 · 9 requirements
Media Protection (MP)
Paper and drives count too: lock them up, track them, destroy them properly.
3.9.1 to 3.9.2 · 2 requirements
Personnel Security (PS)
Check people before they get access, and close access when they leave.
3.10.1 to 3.10.6 · 6 requirements
Physical Protection (PE)
Lock the doors to where the information lives.
3.11.1 to 3.11.3 · 3 requirements
Risk Assessment (RA)
Know your risks and find weak spots before someone else does.
3.12.1 to 3.12.4 · 4 requirements
Security Assessment (CA)
Check that your protections work, and write down how you meet each requirement.
3.13.1 to 3.13.16 · 16 requirements
System and Communications Protection (SC)
Protect the information as it travels and where it is stored.
3.14.1 to 3.14.7 · 7 requirements
System and Information Integrity (SI)
Keep systems updated, free of malware and watched.
Read the official text
- NIST SP 800-171 Revision 2: the 110 requirements, each with the government's own discussion.
- DoD CMMC Assessment Guide, Level 2: how an assessment checks each requirement.