There are three aspects to the phase two:
1) Expanded set of TTPs based on a large case data set
2) Introductions of Observable Human Indicators
3) Mitigations - which includes monitoring
For a more detailed overview of phase 2, check out the link below.
Balancing Trust and Security in Organizations Using the MITRE ATT&CK Framework + Next DLP
Check out our blog post for more information.