What CMMC Level 2 is
The Cybersecurity Maturity Model Certification Level 2 practices: the 110 NIST SP 800-171 revision 2 requirements, by CMMC practice id and title.
Who asks for it: US Department of Defense contractors.
What Microsoft 365 can show
26 practices evidenced by 155 checks. A check maps to a practice only where its result is genuine evidence for it, so a practice is listed only when a tenant setting can show it.
Outside Microsoft 365
As for NIST SP 800-171; the assessment itself is by a C3PAO or self-assessment.
Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.
Every practice and the checks behind it
The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.
Related frameworks
- NIST SP 800-171: Protecting controlled unclassified information in the US defence supply chain.
- SOC 2: The AICPA Trust Services Criteria, asked of SaaS and service providers.
- CISA SCuBA Microsoft 365 baselines: CISA’s secure configuration baselines for Microsoft 365.
- NIST CSF 2.0: The NIST Cybersecurity Framework: govern, identify, protect, detect, respond and recover.