Our previous articles on CMMC Level 1 certification focused on what organizations need to know when conducting self-assessments. These documents relied primarily on the fact that the contractor would do their assessments and reporting.

With Level 2 certification, the game changes. Not only are nearly all assessments performed by C3PAOs, but their requirements expand nearly tenfold. That said, some basics of what to expect in the assessment remain the same.

Here, we’re discussing the CIO’s guidance for Level 2 assessments.