The Advanced Level in CMMC will contain Access Control {AC) practices from:

The Cybersecurity Maturity Model Certification (CMMC) 2.0 framework is cumulative. The "Advanced Level" directly corresponds to CMMC Level 2. To achieve Level 2, an organization must implement all security practices from Level 1 ("Foundational") in addition to the specific practices required for Level 2.

Therefore, the full set of Access Control (AC) practices for the Advanced Level is composed of the AC practices specified for Level 1 and the additional AC practices specified for Level 2. Practices from Level 3 ("Expert") are part of a higher tier and are not included in the requirements for Level 2.

A. Level 1.

This is incomplete. The Advanced Level (Level 2) includes all Level 1 practices but adds many more to meet its requirements.

B. Level 3.

This reverses the model's logic. Level 2 is a prerequisite for achieving Level 3; practices from Level 3 are not included in Level 2.

D. Levels 1, 2, and 3.

This is incorrect because the Advanced Level (Level 2) does not include any practices from the higher Expert Level (Level 3).

1. U.S. Department of Defense

"Cybersecurity Maturity Model Certification (CMMC) Model v2.0

" November 2021.

Page 6

Figure 2

"CMMC 2.0 Levels and Associated Assessments": This figure explicitly labels Level 2 as "Advanced."

Pages 7-8

"CMMC 2.0 Levels": The document describes the cumulative nature of the model

stating that Level 2 is aligned with the 110 controls in NIST SP 800-171

which fully encompasses the 17 controls required for Level 1. This confirms that Level 2 contains practices from Level 1 and Level 2.

2. U.S. Department of Defense

"CMMC Scoping Guide: Level 2

" Version 2.0

December 2021.

Section 1.1

"CMMC Level 2": This guide states

"CMMC Level 2 is equivalent to the 110 security requirements in NIST SP 800-171... CMMC Level 1 is a subset of CMMC Level 2." This officially confirms that Level 2 requirements are composed of both Level 1 and Level 2 practices.