[Verse 1]
Fourteen domains built from NIST eight oh one seventy one
Three levels rising up but Level Two's where most work gets done
One hundred ten practices waiting for your compliance call
From access control to system integrity, gotta implement them all
[Chorus]
CMMC Level Two, that's the target we pursue
AC dot L2 dash three dot one dot one, that's how we reference what we've done
Domain name and practice ID, policy language clear to see
CMMC Level Two, cybersecurity breakthrough
[Verse 2]
Configuration management, identification and authentication
Incident response planning with proper documentation
Media protection, personnel security standing strong
Physical protection, recovery processes when things go wrong
[Chorus]
CMMC Level Two, that's the target we pursue
AC dot L2 dash three dot one dot one, that's how we reference what we've done
Domain name and practice ID, policy language clear to see
CMMC Level Two, cybersecurity breakthrough
[Bridge]
When you're crossing that US-Canada line
CPCSC and CMMC must align
More restrictive requirement wins the day
Independent paths when they diverge away
Dual compliance keeps you safe and sound
Best of both nations' cyber battleground
[Verse 3]
Risk assessment, security assessment running side by side
System and communications protection cannot hide
System and information integrity, awareness and training too
Maintenance domain completes the set, now you know what you must do
[Chorus]
CMMC Level Two, that's the target we pursue
AC dot L2 dash three dot one dot one, that's how we reference what we've done
Domain name and practice ID, policy language clear to see
CMMC Level Two, cybersecurity breakthrough
[Outro]
This policy implements the way
CMMC Level Two leads the day
Maturity model certification
Protecting our digital nation