CMMC Level 2 — Advanced

Limit system access to authorized users, processes, and devices, and to the functions they're permitted to perform.

Make managers and users aware of security risks and train them to carry out their security responsibilities.

Create, protect, and review audit records so activity can be traced to individual users.

Establish and maintain secure baseline configurations and control changes to systems.

Identify and authenticate users, processes, and devices before granting access, including multifactor authentication.

Establish, operate, and test an incident-handling capability, and report incidents to designated authorities.

Perform system maintenance securely and control the tools, personnel, and remote sessions involved.

Protect, control, sanitize, and account for system media — digital and paper — containing CUI.

Screen personnel before granting access and protect CUI during personnel actions like termination and transfer.

Limit and monitor physical access to systems, equipment, and operating environments.

Assess and remediate risk to operations, assets, and individuals, including vulnerability scanning.

Assess control effectiveness, plan corrective action (POA&M), and maintain the System Security Plan.

Monitor and protect communications at system boundaries and apply cryptography to CUI in transit and at rest.

Identify and correct flaws, defend against malicious code, and monitor systems for attacks.