CMMC Level 2 Certified
CMMC Level 2 is the U.S. Department of Defense standard that validates the protection of Controlled Unclassified Information (CUI).
It verifies that the full set of cybersecurity practices aligned with NIST Special Publication 800-171 is in place, with controls validated through an independent third-party assessment by a C3PAO.
What It Means
Element U.S. Space & Defense holds Cybersecurity Maturity Model Certification (CMMC) Level 2, the U.S. Department of Defense standard validating the protection of Controlled Unclassified Information.
The certification verifies that the full set of cybersecurity practices aligned with NIST Special Publication 800-171 is in place, and that those controls were validated through an independent third-party assessment by a C3PAO.
[Michelle to confirm: the hub calls this company-wide. Does the certificate cover all six facilities?]
[Michelle to confirm: Issued by shows U.S. DoD program. The DoD CMMC site now uses Department of War. Which name should we use across the subpages?]
Common Questions
[Michelle to confirm: please route these answers for compliance review. The CMMC explanations came from public DoD and CFR sources, not Element documents.]
[Michelle to confirm: we left out rollout dates, since the DoD CMMC page says implementation is paused in Phase 1. Should the page mention timing?]
[Michelle to confirm: is the Perfect Score blog claim OK to feature in Further Reading?]
What is CMMC Level 2?
CMMC Level 2 is the Cybersecurity Maturity Model Certification level for organizations that handle Controlled Unclassified Information. It is built on the 110 security requirements in NIST SP 800-171. Element U.S. Space & Defense holds Level 2 certification, with its controls validated through an independent third-party assessment.
Read the full answer →What is Controlled Unclassified Information?
Controlled Unclassified Information, or CUI, is government information that is not classified but still requires safeguarding under law, regulation or policy. On a defense program it can include technical drawings, specifications and test data. Your contract and its markings define what applies, so raise this with Element U.S. Space & Defense early.
Read the full answer →What is a C3PAO?
A C3PAO is a CMMC Third-Party Assessment Organization, an independent organization authorized to perform Level 2 certification assessments. The assessor checks whether required controls are in place rather than taking a company's word for it. Element U.S. Space & Defense had its controls validated through a C3PAO assessment.
Read the full answer →What is the difference between Level 2 self-assessment and C3PAO certification?
Both use the same 110 NIST SP 800-171 requirements. In a self-assessment, the organization evaluates itself. In a certification assessment, an independent C3PAO performs the evaluation. The contract states which is required. Element U.S. Space & Defense holds certification through a third-party assessment, which is the independent form of validation.
Read the full answer →How is CMMC related to NIST SP 800-171?
NIST SP 800-171 defines the security requirements for protecting CUI. CMMC is the Department of Defense program that verifies those requirements are in place. At Level 2, the requirements match the 110 in NIST SP 800-171 Revision 2. Element U.S. Space & Defense was assessed against this set of practices.
Read the full answer →Does a test lab need CMMC certification?
It depends on the contract and the information involved. A lab that receives CUI, such as controlled drawings or test plans, can fall under the requirements a prime contractor passes down to suppliers. Ask each lab for its status. Element U.S. Space & Defense publishes its Level 2 certificate on this page.
Read the full answer →How long does CMMC Level 2 certification last?
Under 32 CFR Part 170, a Level 2 certification assessment must be performed every three years, and an affirming official must confirm continuing compliance annually. Check the status date on any supplier's certificate. Contact Element U.S. Space & Defense if your program needs current certificate details for its supplier records.
Read the full answer →Does the certification cover every Element U.S. Space & Defense facility?
Element U.S. Space & Defense lists this certification as company-wide. Any CMMC certification applies to a defined assessment scope, so if your program requires confirmation for a specific site or system, share that requirement with the team and review the certificate linked on this page.
Read the full answer →How is CMMC different from ISO/IEC 17025?
They answer different questions. CMMC addresses how an organization protects sensitive information. ISO/IEC 17025 addresses whether a laboratory is competent to perform specific tests. A defense program may need both, and Element U.S. Space & Defense holds CMMC Level 2 alongside ISO/IEC 17025 accreditation at four of its facilities.
Read the full answer →How can I verify this certification?
Element U.S. Space & Defense publishes its CMMC Level 2 certificate and a press release, both linked on this page. Prime contractors and contracting officers may have their own process for confirming supplier status, so ask the team if your program needs additional supporting information for its records.
Read the full answer →Further Reading
More from Element U.S. Space & Defense on this topic.
Articles
Accessibility: If you are vision-impaired or have some other impairment covered by the Americans with Disabilities Act or a similar law, and you wish to discuss potential accommodations related to using this website, please contact us at (833) 673-8773