An r2 certification is good for how many years?

An r2 certification is valid fortwo years, but only if aninterim assessmentis performed at the one-year mark and interim requirements are met. The interim assessment ensures that the organization continues to maintain its controls, remediate CAPs, and discharge any pending N/A justifications. If an interim is not completed or requirements are not met, the certification can lapse. Unlike option A, remediation of all CAPs and N/As is not required before certification is maintained, though CAP progress must be monitored. Certification is not automatically valid for two years (option C), nor is it indefinite (option D). Thus, the correct answer is that certification is valid for two years provided interim requirements are met.