Which CMMC Level Do You Need? Level 1, Level 2 and Level 3 for Small Defense Suppliers

CMMC levels decide what a defense supplier has to prove and who checks it. Level 1 covers basic contract data, Level 2 covers controlled unclassified information, and Level 3 is reserved for a small set of critical programs. The level is written into your contract, so the real question is which information you touch.

This post walks through how to work out which CMMC level you need. For a requirement-by-requirement comparison, see our CMMC levels guide, and for the most common decision, CMMC Level 1 vs Level 2.

What CMMC is

CMMC stands for Cybersecurity Maturity Model Certification. It is the DoD program that checks whether companies in its supply chain protect sensitive information properly. It applies to prime contractors, subcontractors and sub-subcontractors. If you touch a DoD contract that carries a CMMC requirement, you are in scope.

Before CMMC, companies could simply say they followed the security rules. CMMC adds a formal assessment and an annual affirmation by a senior official.

The question that decides your level: FCI or CUI?

The DoD works with two kinds of sensitive information.

Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Order details, delivery schedules and contract correspondence are typical examples.

Controlled Unclassified Information (CUI) is more sensitive. It includes technical drawings, engineering data and export-controlled information. Most defense suppliers that machine, build or design parts see some of it, often as an attachment in an email from the prime.

Only FCI points to Level 1. Any CUI points to Level 2. Level 3 is decided by the DoD for specific programs.

CMMC Level 1 (Foundational)

What it protects: FCI.

What it requires: the 15 basic safeguarding requirements in FAR 52.204-21. In plain English:

• Limit system access to authorized users, and limit what they can do
• Control connections to outside systems and what you post publicly
• Give every user a unique ID and make them prove who they are before access
• Sanitize or destroy media before you throw it out
• Limit physical access to your equipment, escort visitors and keep access logs
• Monitor and protect the boundary of your network, and separate public-facing systems
• Find and fix flaws promptly, run malware protection, keep it updated and scan files

Who assesses it: you do. Level 1 is an annual self-assessment, posted in the Supplier Performance Risk System (SPRS) with an affirmation from a senior official. You have to meet every requirement; Level 1 does not allow a plan of action for open items.

Example: a small machine shop that builds a simple bracket from a purchase order, never sees a drawing marked CUI, and ships the part.

CMMC Level 2 (Advanced)

What it protects: CUI.

What it requires: the 110 security requirements in NIST SP 800-171, grouped into 14 families: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity.

Who assesses it: it depends on the contract. Some Level 2 contracts accept a self-assessment. Many require a certification assessment by an authorized Certified Third-Party Assessor Organization (C3PAO). Either way the result is good for three years, with an affirmation in SPRS every year.

How it is scored: the DoD Assessment Methodology starts at 110 and subtracts 5, 3 or 1 point for each requirement not met. Our post on submitting your SPRS self-assessment explains the math.

What a passing result looks like: meeting all 110 gives final status. A score of at least 88 (80 percent) can give conditional status, with the open items on a plan of action and milestones (POA&M). Only certain lower-weighted requirements may be left open, and they have to be closed within 180 days.

CMMC Level 3 (Expert)

What it protects: CUI on programs the DoD treats as highest priority, against well-funded, persistent attackers.

What it requires: all 110 Level 2 requirements plus 24 selected requirements from NIST SP 800-172. These cover areas such as threat hunting, deception, supply chain risk, and resilience and recovery.

Who assesses it: the government. The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) runs Level 3 assessments. You need a final Level 2 certification from a C3PAO for the same scope before a Level 3 assessment.

You will know if you need Level 3. The DoD spells it out in the contract.

CMMC levels compared

	Level 1	Level 2	Level 3
Name	Foundational	Advanced	Expert
Information	FCI	CUI	CUI on priority programs
Requirements	15 (FAR 52.204-21)	110 (NIST SP 800-171)	110 plus 24 (NIST SP 800-172)
Assessment	Self-assessment	Self-assessment or C3PAO, per contract	DIBCAC, after Level 2 C3PAO certification
How often	Every year	Every three years	Every three years
Annual affirmation	Yes	Yes	Yes
Open items allowed	No	Limited, closed within 180 days	Limited, closed within 180 days

How to tell which CMMC level your contract needs

1. Read the solicitation and contract. The required level is listed there.
2. Look at what you receive. Drawings, specifications or technical data marked CUI mean Level 2.
3. Ask your prime. Your prime's compliance depends on its suppliers, so it should tell you which level it is flowing down.
4. If you are unsure, plan for Level 2. Level 2 covers everything in Level 1. Aiming at Level 1 and then finding a CUI drawing in your inbox means starting again.

The free scoping tool also helps you see which frameworks apply to you.

How to prepare for your CMMC assessment

Step 1: Draw the boundary

Decide which systems, people and places handle FCI or CUI. Everything inside the boundary has to meet the requirements; everything outside does not. Keep the boundary as small as you can. If CUI lives on one workstation in one room, that is your scope.

Step 2: Run a gap analysis

Compare what you actually do against each requirement for your level. Be honest. "Close enough" gets caught at assessment and has to be fixed anyway. An outside reviewer will see things you miss.

Step 3: Fix the gaps

Start with the quick fixes: automatic updates, firewalls, unique accounts and MFA. Then the harder items, such as encrypting CUI, central logging and segmenting your network. Train your staff on what changed and why.

Step 4: Document everything

If it is not documented, an assessor cannot give you credit for it. For Level 2 the core documents are the system security plan, your policies and procedures, and the POA&M. Keep a log of what you implemented, when and by whom.

Step 5: Assess and affirm

For Level 1 and Level 2 self-assessment, you post the result in SPRS and a senior official affirms it. For Level 2 certification, a C3PAO reviews your documents, interviews your staff and tests your controls. Then the affirmation repeats every year.

Common mistakes on the way to CMMC

• Waiting for the contract. The work takes months. Starting when the solicitation arrives is too late.
• Treating it as an IT problem. CMMC touches HR (screening and offboarding), facilities (physical access) and leadership (the affirmation).
• Thin documentation. Controls that work but are not written down score as not met.
• Going it alone without the expertise. A Registered Provider Organization or a managed provider can carry the technical work.

How AccuSights helps

Start with the CMMC framework page and the free CMMC checklist. When you are ready to measure, our CMMC Self-Assessment and SPRS Score package gives you a defensible score, and the CMMC Level 2 Gap Readiness package finds what stands between you and a C3PAO assessment. The CMMC Accelerator pairs compliance software with a Level 2 cohort. See what it costs on the CMMC cost page, or book 30 minutes with an engineer.

Questions people ask

What are the three CMMC levels? Level 1 (Foundational) with 15 requirements for FCI, Level 2 (Advanced) with the 110 NIST SP 800-171 requirements for CUI, and Level 3 (Expert), which adds 24 requirements from NIST SP 800-172.

How do I know which CMMC level I need? Your contract states it. If it does not yet, FCI only points to Level 1 and any CUI points to Level 2. Your prime or contracting officer can confirm.

Does CMMC Level 2 always need a third-party assessment? No. Depending on the contract, Level 2 is a self-assessment or a C3PAO certification. Both last three years with an annual affirmation in SPRS.