Level 2 [Advanced]: Applicable to defense or aerospace contractors bidding on DoD contracts handling: • CUI • CTI • ITAR or export-controlled data that is CUI All contractors in Level 2 must implement 110 security controls from NIST 800-171. If the DFARS 252.204-7012 requirement is in your current contracts, you are most likely in the Level 2 category