Start with the data you handle
Your CMMC level is driven by the type of information you process, store or transmit for the Department of Defense (DoD), and by the level written into your solicitation or contract.
- Federal Contract Information (FCI) is information provided by or generated for the government under a contract that isn't intended for public release. Almost every DoD contractor handles FCI.
- Controlled Unclassified Information (CUI) is information the government requires to be safeguarded, such as controlled technical information, drawings and specifications. CUI is what moves you to Level 2 or above.
CMMC Level 1 (Foundational)
- Who: contractors that handle FCI but not CUI.
- Requirements: the 15 basic safeguarding requirements from FAR 52.204-21.
- Assessment: an annual self-assessment, with results entered in the Supplier Performance Risk System (SPRS).
- Affirmation: a senior company official affirms compliance every year.
- POA&Ms: not allowed. All 15 requirements must be met.
CMMC Level 2 (Advanced)
- Who: contractors that handle CUI.
- Requirements: the 110 security requirements in NIST SP 800-171 Revision 2.
- Assessment: either a self-assessment or a certification assessment by an authorized Third-Party Assessment Organization (C3PAO), every three years. Your contract specifies which.
- Affirmation: annual affirmation by a senior official.
- POA&Ms: allowed only in limited form. You can reach Conditional status with a minimum score of 88 out of 110, only certain requirements may be left open, and every open item must be closed within 180 days.
CMMC Level 3 (Expert)
- Who: contractors supporting DoD's highest-priority programs with the most sensitive CUI.
- Prerequisite: a Final Level 2 certification from a C3PAO for the same scope.
- Requirements: 24 additional requirements selected from NIST SP 800-172.
- Assessment: conducted by the DCMA Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), every three years, with annual affirmations.
Side-by-side comparison
| Level | Data | Requirements | Assessed by | How often |
|---|---|---|---|---|
| Level 1 | FCI | 15 (FAR 52.204-21) | Self-assessment | Every year |
| Level 2 (Self) | CUI | 110 (NIST SP 800-171 Rev 2) | Self-assessment | Every 3 years |
| Level 2 (C3PAO) | CUI | 110 (NIST SP 800-171 Rev 2) | Certified C3PAO | Every 3 years |
| Level 3 | CUI (highest priority) | Level 2 + 24 (NIST SP 800-172) | DCMA DIBCAC | Every 3 years |
Every level also requires an annual affirmation of continued compliance.
How do I know which level my contract requires?
The required CMMC level appears in the solicitation and the resulting contract through DFARS 252.204-7021. If you're a subcontractor, your prime should flow the requirement down to you. When in doubt, ask your contracting officer or prime which level, and which type of Level 2 assessment, applies.
Where to start
- Define your scope. Identify where FCI and CUI live and which people, systems and facilities touch them.
- Run a gap assessment against the requirements for your level.
- Document your System Security Plan (SSP) and a plan to close gaps. Learn what goes in an SSP.
- Remediate, then validate before your self-assessment or C3PAO assessment.
This guide is general information based on the CMMC Program rule (32 CFR Part 170) and the DFARS CMMC clause (DFARS 252.204-7021) as of November 2026. It isn't legal advice. The requirements in your solicitation or contract always govern. Last reviewed: November 4, 2026.