Attestation, assessment and label schemes
CMMC:2.0 Level 2
Verifies protection of Controlled Unclassified Information across the US defense industrial base. The outcome lives in government systems and flows down through contract clauses.
What you receive
Assessment result filed to SPRS
Level 2 certification assessments are performed only by an authorised C3PAO. Results are recorded in government systems, not issued as a marketable certificate.
This scheme does not produce a certificate. If a body has offered you one for CMMC, that alone tells you what their audit work is worth.
Who needs it
Defense contractors and subcontractors handling CUI under DFARS flow-down.
Prerequisites
NIST SP 800-171 implementation, a current System Security Plan, and a SPRS score.
How this engagement is delivered
Programme managed by Securo Cert LLC. Audit and certification decision by the appointed partner body.
Securo Cert document not accreditedThe partner body is named in the proposal before any work begins, and printed on the resulting document alongside the delivery mode.
Frequent questions
What do we actually receive?
Assessment result filed to SPRS. Level 2 certification assessments are performed only by an authorised C3PAO. Results are recorded in government systems, not issued as a marketable certificate.
How long is it valid?
Three-year validity with annual affirmation.
What has to be in place first?
NIST SP 800-171 implementation, a current System Security Plan, and a SPRS score.