Compliance & Regulations/North America/CMMC L2 / L3
Defence · United States — Defense Industrial Base

CMMC Level 2 / Level 3

Cyber maturity certification for any contractor handling CUI in the US Defense Industrial Base.

Regulator
US Department of Defense (Cyber-AB)
Jurisdiction
United States — Defense Industrial Base
Status
Final rule (32 CFR 170) effective December 2024; rolling DFARS 252.204-7021 inclusion underway.
In force since
2024 (final rule)
Regulator's source
Who it applies to

All DoD prime and sub-contractors that store, process, or transmit CUI or FCI.

Audit / certification status

Safeguard supports both self-assessment (Level 1) and C3PAO-led (Level 2) workflows for customers.

What it requires

What CMMC L2 / L3 actually requires.

These are the obligations a regulated entity owes — the things an assessor or supervisor will ask about.

01

Level 2: 110 NIST SP 800-171 Rev 2 controls + 320 assessment objectives.

02

Level 3: an additional 24 controls from NIST SP 800-172 plus enhanced threat-hunting and DLP.

03

C3PAO third-party assessment every three years (Level 2) or government-led assessment (Level 3).

04

Annual self-attestation by a senior officer of the company.

05

Documented System Security Plan (SSP) and POA&M with no critical gaps at assessment.

06

Incident reporting to DoD CYBER within 72 hours of discovery.

How Safeguard maps to it

Pre-mapped controls. Continuous evidence.

Each requirement above is bound to live telemetry — not screenshots. The mapping below is what your auditor or regulator sees.

Each of the 110 Level 2 controls + 24 Level 3 controls has a written narrative tied to live telemetry.

C3PAO-ready evidence packets export as a single signed bundle including SSP, POA&M, and scan history.

Continuous control attestation replaces point-in-time snapshots — assessors see 24+ months of history.

SBOMs, dependency provenance, and patching cadence meet 800-171 §3.14 (system integrity) without screenshot work.

Crosswalk to NIST 800-53, FedRAMP, and ITAR/EAR control families bundled in the same export.

Evidence we produce

Artifacts your auditor accepts.

Each evidence artifact is signed and timestamped. Auditors can verify integrity without trusting Safeguard.

SSP (System Security Plan) — exportable in DoD format.

POA&M with remediation owners and target dates.

Vulnerability scan history (90-day rolling window required for assessment).

Access review logs with quarterly attestations.

Configuration management baseline diffs.

Incident response plan + tabletop exercise records.

Certification path

How you get there.

01

Gap assessment against NIST 800-171

02

Remediation + SSP authoring

03

C3PAO assessment (Level 2) or DIBCAC (Level 3)

04

Affirmation in eMASS / SPRS

Ready for CMMC L2 / L3?

Bring the framework. We'll walk the controls with you — section by section, evidence packet by evidence packet, with the regulators you actually have to answer to.

Safeguard | Software Supply Chain Security Platform | Zero CVE + Self-Healing