FAQ: Level 2 questions movers ask
Short answers, with sources for the facts. For what each requirement means, see the Level 2 guide.
This is an independent guide. Movegistics is not affiliated with or endorsed by Project Spectrum or the Department of War. The information provided in these guides is for general information purposes only. Links to official sources are provided where available. See the Disclaimer for more.
Facts last checked: .
Why use these guides instead of going straight to Project Spectrum?
Going straight to Project Spectrum is a good choice. It is the Department of War's free program, with a self-assessment tool aligned to CMMC, a report with your SPRS score, training, templates and free advisor sessions. These guides are made to sit alongside it, for movers:
- Every Level 2 requirement explained with moving-company examples, such as crew phones, bills of lading, the dispatch desk and seasonal crews.
- What is usually in scope at a moving company, and how to keep that list short.
- Open to read with no sign-up, so you can share a page with your office manager or IT company. Most of Project Spectrum's tools appear after you sign in.
- Movers' questions answered, with sources for the facts.
Use both: read here, assess there. These guides do not replace Project Spectrum's tools or advisors, or professional advice.
Sources: Department of War, business.defense.gov/cmmc, Project Spectrum FAQ
Does Level 2 apply to my moving company?
It does if you handle DoD shipment information. CMMC covers every company in the chain, at every tier, that handles federal contract information or CUI for a Department of War (DoD) contract or subcontract, and Level 2 is the minimum level for CUI. For DP3, IAM says that reaches TSPs, agents, storage facilities, hauling agents and crating companies: “If you touch DP3 shipment information, you are part of the cybersecurity chain of custody.” Work with no DoD contract behind it is not covered, but any system that also holds DoD shipment information is in scope.
Sources: 32 CFR 170.23, Project Spectrum FAQ, IAM CMMC Resource Center
When is it due?
For DP3, section A.2 of the Tender of Service sets the dates by which TSPs, and subcontractors that hold CUI or FCI, must post their Level 1 and Level 2 self-assessments and affirmations in SPRS. Check it, or the IAM CMMC Resource Center, for the current dates. If you are an agent or other subcontractor, ask your TSP when it needs yours. Level 1 comes first: IAM's guide says primes may not assign DoD shipments to subcontractors without it. If you have not posted Level 1, do it now; a Level 2 status covers Level 1 for the same scope. Under the rule, a company must have its Level 2 status and affirmation in SPRS before it can be awarded a contract or subcontract that requires them.
Sources: DP3 Household Goods Tender of Service, section A.2, IAM CMMC Resource Center, IAM: What You Need to Do for CMMC, 32 CFR 170.16
Do we have to hire an auditor?
No. The DP3 requirement is a self-assessment: you check your company against the 110 requirements, score it, post the result in SPRS, and a senior official of your company affirms it. Certification by an authorized third-party assessor (a C3PAO) is a different requirement.
Sources: IAM CMMC Resource Center, 32 CFR 170.16, 32 CFR 170.22
Do we need a consultant?
No rule requires one. Project Spectrum's advisor sessions are free, and these guides explain each requirement and what is usually in scope at a moving company. Paid help can still make sense for technical work your team cannot do.
Source: Project Spectrum FAQ
What will it cost?
The self-assessment costs time, not fees, and Project Spectrum's self-assessment, training and advisor sessions are free. The cost is in closing gaps, for example moving shipment information into cloud services that meet the cloud rule (FedRAMP Moderate or higher, or equivalent), adding multifactor sign-in, and encrypting laptops and phones. The smaller your scope, the less there is to fix.
Sources: Department of War, business.defense.gov/cmmc, Project Spectrum FAQ, 32 CFR 170.16
What counts as DoD shipment information?
On these pages, the controlled information you handle for DP3 shipments, such as a service member's personal details and the shipment documents. IAM says the information TSPs and their subcontractors handle in DP3 includes CUI. If you are not sure whether something counts, treat it as if it does and ask whoever gave it to you.
Source: IAM CMMC Resource Center
What is the difference between Level 1 and Level 2?
Level 1 is the 15 basic security requirements of FAR 52.204-21, for federal contract information; Project Spectrum counts them as 17 practices. Level 2 is the 110 requirements of NIST SP 800-171 for CUI. A Level 2 status also covers Level 1 for the same scope.
Sources: 32 CFR 170.14, Project Spectrum FAQ, 32 CFR 170.16
What score do we need?
Every requirement met, 110 of 110, gives a Final Level 2 status. A score of at least 88, with every remaining gap allowed on a plan of action (POA&M), gives a Conditional status. You then have 180 days to close the gaps and post a closeout in SPRS, or the conditional status expires. See how Level 2 works.
Sources: 32 CFR 170.16, 32 CFR 170.21
Who signs, and what do they sign?
Your Affirming Official: a senior person who is responsible for your company's CMMC compliance and has the authority to affirm it. In SPRS, they attest that the company has put every applicable requirement in place, and will keep it in place, for everything in your scope. They affirm after each assessment, after a plan of action is closed, and every year after a Final status, counted from your CMMC Status Date.
Sources: 32 CFR 170.22, 32 CFR 170.4
How often do we do it?
A new self-assessment at least every three years, with the results posted in SPRS, and the affirmation every year in between. Both count from your CMMC Status Date: the date you post the results of a full self-assessment in SPRS. Closing out a plan of action does not change it. Separately, the requirements themselves have you assess your risks (3.11.1) and check your protections (3.12.1) at least once a year, and keep your SSP up to date (3.12.4).
Sources: 32 CFR 170.16, 32 CFR 170.22, 32 CFR 170.4
Can the Department check our self-assessment?
Yes. The Department can assess you itself, through DCMA's DIBCAC team. If it finds you have not met or kept up the requirements, its results replace your status, standard contract remedies apply, and you cannot win new awards that need Level 2 until you have a new status. Score honestly, and keep your evidence for six years from your CMMC Status Date.
Source: 32 CFR 170.16
Does our moving software have to be certified?
It does not need CMMC certification. But if it is a cloud service that holds, processes or sends DoD shipment information for you, it must be FedRAMP authorized at Moderate or higher, or meet DoD's equivalency standard. The same goes for email, file storage and texting. Ask each provider for proof, and for its customer responsibility matrix. This site does not say whether any particular product meets the rule. See cloud services.
Sources: 32 CFR 170.16, 32 CFR 170.19, FedRAMP Marketplace
Our crews use their own phones. Is that allowed?
Level 2 does not ban personal phones, but any phone that shows, stores or photographs DoD shipment information is in scope and has to meet the requirements that apply to it, such as approval (3.1.18) and encryption (3.1.19). A personal phone is out of scope only if it cannot reach shipment information at all, for example with no company email, texting or moving-software app on it. A phone kept clear only by a company rule is still in scope, as a contractor risk managed asset.
Sources: NIST SP 800-171 Rev 2, 32 CFR 170.19
What if a requirement does not fit our company?
A requirement can be not applicable when what it covers is not in your scope. The rule's own example is 3.13.5, separating public-facing systems, when nothing the public can reach is in your scope. A requirement that does not apply counts as met. Note in your SSP why it does not apply.
Source: 32 CFR 170.24
Where do we start?
Six steps, the same as on Start here:
- Learn what Level 2 asks. Read the Level 2 guide: all 110 requirements in movers' terms. This page answers the common questions.
- Work out what is in scope. Which systems, phones, papers and places the requirements apply to. See what's in scope at a moving company.
- Find your gaps. Take Project Spectrum's free Level 2 self-assessment. See your first hour on Project Spectrum.
- Fix and track. Fix the 5-point gaps first: they cost the most, and none of them can wait on a plan of action. Each family page shows how many it has. Track every gap, owner and date in the free workbook. Adapt and approve the policies pack, train your crews with the training kit, and check your providers and agents with the vendor and agent kit.
- Write your System Security Plan. Requirement 3.12.4: without it, the assessment cannot be completed. Start from the free SSP template.
- Assess, post and affirm. Do your self-assessment against the official assessment objectives in NIST SP 800-171A (the DoD Level 2 Assessment Guide lists them), and keep the evidence. Then post it in SPRS and have your Affirming Official affirm it.
Sources: 32 CFR 170.16, 32 CFR 170.21, 32 CFR 170.24
Who wrote these answers?
Movegistics, a software company for movers, as a free resource. We are not part of Project Spectrum or the Department of War, and neither has endorsed this site. These answers are general information, not legal or compliance advice; see the disclaimer.
Back to the Level 2 guide or what's in scope.