To decide what CMMC level you need, look at the data the contract will put in your hands. Level 1 applies when you only handle Federal Contract Information (FCI). Level 2 applies when you handle Controlled Unclassified Information (CUI). Level 3 is reserved for CUI tied to the most sensitive defense programs. You don’t pick the level yourself — the contracting officer designates it in the solicitation — but the type of data is what drives that designation, so knowing where your work falls lets you plan before a bid is on the table.
FCI or CUI: The Question That Sets Your Level
Every CMMC determination comes down to one distinction, and the compliance burden on either side of it is very different.
Federal Contract Information is data the government provides or generates under a contract that isn’t meant for public release. Delivery schedules, internal pricing sheets, and administrative correspondence are typical examples. It needs basic protection.
Controlled Unclassified Information is sensitive material — technical drawings, engineering specifications, test results — that could damage national security or hand an adversary an advantage if it leaked. The government marks documents as CUI based on laws and policies that require safeguarding, and contractors are expected to recognize those markings and protect the data throughout their systems. The contracting officer designates the CUI category based on program sensitivity, so this is not a judgment call you make on your own.
If your contract only involves FCI, you need Level 1. If it involves CUI, you need at least Level 2, and possibly Level 3.
CMMC Level 1: Foundational
Level 1 covers companies that handle only FCI. The 15 security controls come from the Federal Acquisition Regulation at 48 CFR 52.204-21 and represent basic cyber hygiene: limiting system access to authorized users, running antivirus, keeping systems patched, controlling physical access, and monitoring network boundaries.1Acquisition.GOV. 48 CFR 52.204-21 – Basic Safeguarding of Covered Contractor Information Systems Most small businesses already do most of this, even if they haven’t documented it formally.
Compliance is proven through an annual self-assessment. There is no third-party audit. You evaluate your own systems against all 15 controls, submit the results in the Supplier Performance Risk System (SPRS), and a senior company executive affirms that the business meets every requirement.2eCFR. 32 CFR 170.15 – CMMC Level 1 Self-Assessment and Affirmation That affirmation must be current before the government will issue a contract award.
One trap catches contractors off guard. Level 1 does not allow a Plan of Action and Milestones. There is no conditional pass, no promise to close gaps later. Every control has to be fully met at the time of the assessment.3eCFR. 32 CFR 170.21 – Plan of Action and Milestones Requirements
CMMC Level 2: Advanced
Most contractors who handle CUI land at Level 2. It maps to the 110 security requirements in NIST SP 800-171 Revision 2, covering access control, incident response, audit logging, system integrity, and a dozen other security families.4eCFR. 32 CFR Part 170 – Cybersecurity Maturity Model Certification Program The program specifically references Revision 2, not the newer Revision 3, and the two versions organize requirements differently. Make sure your documentation aligns with the right one.
Self-Assessment or Third-Party Audit
Not every Level 2 contractor needs an outside auditor. The solicitation tells you whether your contract requires a self-assessment or a certification assessment conducted by a Certified Third-Party Assessment Organization (C3PAO). The program office makes that call based on the sensitivity of the specific program. Self-assessments follow the same criteria and scoring methodology as third-party audits, but they don’t carry the independent verification a C3PAO provides.5U.S. Department of Defense Chief Information Officer. CMMC Assessment Guide Level 2
A successful assessment, self-conducted or third-party, produces a CMMC status valid for three years from the status date.6Department of Defense Chief Information Officer. About CMMC After that, you reassess. The affirming official also submits an annual affirmation in SPRS confirming continued compliance, independent of the three-year cycle.
Shrinking Your Assessment Scope
This is where planning saves real money. Your CMMC assessment only covers the systems that process, store, or transmit CUI, plus assets that provide security protections for those systems. Everything else is out of scope.7U.S. Department of Defense. CMMC Scoping Guide Level 2 Isolating CUI into a defined enclave — a smaller network segment with its own security boundary — shrinks the number of endpoints you need to secure and the cost of the assessment. If your entire organization can access CUI, your entire organization gets assessed. Restricting CUI access to only the people and systems that genuinely need it is the most effective way to control compliance cost.
The scoping guide sorts assets into five categories: CUI assets, security protection assets, contractor risk-managed assets, specialized assets, and out-of-scope assets. Mapping your environment before you begin remediation prevents wasted effort on systems that don’t matter to the assessment.
CMMC Level 3: Expert
Level 3 targets advanced persistent threats — the sophisticated, state-sponsored attacks aimed at the most sensitive defense programs. It adds 24 enhanced security requirements drawn from NIST SP 800-172 on top of the full 110 controls from Level 2.8U.S. Department of Defense Chief Information Officer. CMMC Alignment to NIST Standards Those additions include things like operating a security operations center, maintaining a dedicated cyber incident response team, and conducting threat-informed risk assessments.
Before you can pursue Level 3, you must already hold a Final Level 2 (C3PAO) status for the same assessment scope. A Level 2 self-assessment does not satisfy this. There is no shortcut.6Department of Defense Chief Information Officer. About CMMC
The assessment itself is conducted only by the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). No private C3PAO can perform a Level 3 assessment.9Defense Contract Management Agency. Defense Industrial Base Cybersecurity Assessment Center Certification is valid for three years, as at Level 2. The DoD has not published dollar thresholds or program types that automatically trigger Level 3; program offices make that determination based on the threat profile and sensitivity of the data.
How to Find the Required Level in a Solicitation
You don’t choose your CMMC level. The contracting officer tells you what it is, and the notice appears through specific DFARS clauses. DFARS 252.204-7021 is the primary clause mandating CMMC compliance and identifying the level your company must reach before award.10eCFR. 48 CFR 252.204-7021 – Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements The newer DFARS 252.204-7025 provision serves as a solicitation notice identifying the required CMMC level for the procurement.
Even where the CMMC-specific clauses haven’t yet appeared, the presence of DFARS 252.204-7012 signals that the contract involves covered defense information and imposes safeguarding and incident-reporting obligations.11eCFR. 48 CFR 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting That clause has been in DoD contracts for years and effectively means you should already be implementing NIST SP 800-171 controls. When CMMC requirements roll into the contract at renewal or recompete, you won’t be starting from scratch.
If a solicitation is ambiguous about the required level, ask. Contracting officers can clarify during the question-and-answer period. Guessing wrong, and especially underestimating, can leave you ineligible for award after you’ve invested in a bid.
What Level Your Subcontractors Need
CMMC does not stop at the prime contractor. If subcontractors will handle FCI or CUI in performing the contract, the certification requirement flows down to them. Prime contractors are responsible for including the relevant DFARS clauses in their subcontracts and for ensuring the supply chain is certified at the right level before subcontractor work involving protected data begins.
The subcontractor’s required level depends on the data the subcontractor touches, not the level the prime holds. A Level 2 prime working with a subcontractor who only handles FCI can flow down a Level 1 requirement. A subcontractor processing CUI needs Level 2 regardless of position in the supply chain. Primes can also flow down CMMC requirements ahead of the official phased rollout schedule, so subcontractors may face these demands before they appear in government solicitations directly.
When the Requirement Will Hit Your Contracts
CMMC requirements are being introduced in phases, not all at once. The underlying program rule at 32 CFR Part 170 took effect on December 16, 2024.12Federal Register. Cybersecurity Maturity Model Certification (CMMC) Program The acquisition rule that puts CMMC requirements into contracts followed in 2025. The phased schedule works like this:6Department of Defense Chief Information Officer. About CMMC
- Phase 1, beginning November 2025: solicitations may require Level 1 or Level 2 self-assessments.
- Phase 2, beginning November 2026: solicitations may require Level 2 certification (C3PAO audit). The DoD can defer the requirement to an option period within the contract.
- Phase 3, beginning November 2027: solicitations may require Level 3 certification (DIBCAC assessment), again with the option to defer to a later option period.
The DoD can accelerate. A Phase 1 solicitation can include a C3PAO requirement, and a Phase 2 solicitation can include Level 3. The government acknowledges this may limit competition or raise costs, but reserves the right to do it. By November 2028, any contract involving FCI or CUI is expected to include the appropriate CMMC clause.
Waiting until a requirement appears in a solicitation to begin compliance work is a losing strategy. A Level 2 C3PAO assessment takes months of preparation, and assessor availability will tighten as Phase 2 approaches. If you handle CUI, work toward Level 2 now.