CMMC levels: what Level 1, Level 2 and Level 3 require

CMMC, the Cybersecurity Maturity Model Certification, is DoD’s program for checking that contractors protect the information it shares with them. The program rule is 32 CFR Part 170, in effect since 16 December 2024. CMMC 2.0 has three levels, down from five in the original model. Each level builds on the one below it, and the level a contract needs is written into the solicitation.

Two kinds of information decide the level. Federal Contract Information (FCI) is information the government provides or generates under a contract that is not meant for public release. Controlled Unclassified Information (CUI) is information that law, regulation or government policy requires to be safeguarded, as listed in the National Archives CUI Registry.

Level 1 is the 15 basic safeguarding requirements in FAR 52.204-21, which most contracts have carried since 2016. They cover the essentials: limit system access to authorized users, authenticate them, control what visitors can see, sanitize media before disposal, update and scan for malicious code, and separate public systems from internal ones.

You assess yourself every year, enter the result in SPRS and have a senior official affirm it. All 15 must be met. Level 1 allows no POA&M, so an open item means you cannot claim the level.

Level 2 is where most defense suppliers that touch CUI land. It requires all 110 requirements of NIST SP 800-171 Rev 2, across 14 families from access control to system integrity, scored with the DoD weights of 1, 3 or 5 points. The full list is in our NIST SP 800-171 guide.

The contract says whether a Level 2 self-assessment is enough or whether a Certified Third-Party Assessment Organization (C3PAO) must do it. Either way the cycle is three years with a yearly affirmation. A score of 110 earns Final status. A score of at least 88 earns Conditional status if the open items are ones the rule allows on a POA&M; they must be closed within 180 days, and a closeout assessment confirms it.

The scoring is the same one behind your SPRS score, so a current, honest self-assessment is the starting point for Level 2 whichever way it is assessed.

Level 3 is for CUI that DoD judges to be at risk from advanced persistent threats. It adds 24 selected requirements from NIST SP 800-172, such as threat hunting, a security operations capability and stronger protection against tampering. Before a Level 3 assessment you must already hold a Final Level 2 certification from a C3PAO for the same scope. DoD’s own assessors at DCMA DIBCAC run Level 3. Few small suppliers will see it in a contract.

• Only FCI: order details, schedules, drawings marked for contract use but not as CUI. Level 1.
• Any CUI: controlled technical information, export-controlled drawings, anything marked CUI or covered by DFARS 7012. Level 2.
• The solicitation names Level 3: Level 3, on top of a Level 2 certification.

If you are a subcontractor, the prime has to flow the requirement down to you at the level that matches the information you receive. Ask what information you will handle before you assume a level; an enclave that keeps CUI to a small part of the company can shrink what Level 2 covers.

Phase 1 began on 10 November 2025: self-assessments, DFARS 7012 and SPRS scores are in force. Third-party certification is paused and out of solicitations and contracts for now under a September 2026 class deviation, not cancelled.

For planning, that means Level 1 and Level 2 self-assessments and the SPRS score are the work to finish now, and Level 2 certification stays in next year’s budget. What each part costs is on what drives the cost of CMMC.