Level 2 (L2) includes all of the L1 assessment and testing requirements and additional supplemental requirements for security risk assessment of software in products. L2 also provides an assessment of the security capabilities of a product with knowledge of internal security controls of the product.