CMMC 2.0 Framework Levels

The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the Department of Defense’s (DoD) enhanced framework designed to safeguard sensitive information by implementing robust cybersecurity practices across the Defense Industrial Base (DIB). CMMC 2.0 introduces a more streamlined approach than its predecessor (CMMC 1.0), focusing on key cybersecurity practices and processes necessary for protecting Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). With three certification levels, CMMC 2.0 ensures contractors comply with DoD requirements, enhancing the security of the supply chain.

LEVEL 1: FOUNDATIONAL

Level 1 is designed for contractors handling Federal Contract Information (FCI) and requires basic safeguarding practices. These are equivalent to the 17 security controls outlined in FAR 52.204-21, which focus on simple measures like user identification and authentication, physical security, and basic data protection methods. Companies at this level can perform annual self-assessments instead of requiring third-party evaluations, reducing costs for smaller contractors that only need basic cybersecurity safeguards.

LEVEL 2: ADVANCED

Level 2 is the most critical for defense contractors that handle Controlled Unclassified Information (CUI). This level includes the 110 security controls from NIST SP 800-171 which outlines advanced cybersecurity measures designed to protect sensitive data from sophisticated cyber threats. Contractors handling CUI are required to undergo third-party assessments every three years to ensure compliance with the CMMC 2.0 framework, while also completing annual self-assessments with reported attestations to maintain their certification status. Some lower-risk contracts may allow for self-assessments, but most contractors will need third-party validation to secure higher-value or more sensitive contracts. Given that most defense contractors deal with CUI, Level 2 compliance will be a top priority for businesses looking to win and maintain contracts with the DoD. This level effectively bridges the gap between basic cybersecurity practices and the more stringent requirements of Level 3, ensuring that contractors have robust protections in place for critical information.

LEVEL 3: EXPERT

Level 3 is reserved for contractors handling highly sensitive and critical DoD information. It incorporates all of the security controls in NIST SP 800-172, focusing on advanced cyber resilience measures, including incident response, continuous monitoring, and threat detection. Level 3 requires government-led assessments due to the elevated risk profile of the contractors handling this information. Businesses operating at this level play a pivotal role in national defense, making this certification a top priority for those involved in critical missions.

Comparison of Compliance Levels: Focus on Level 2 for Defense Contractors

While Level 1 is sufficient for companies handling FCI, most DoD contractors will need to meet Level 2 (Advanced) requirements. This level covers the vast majority of contractors involved in the Defense Industrial Base, particularly those managing CUI. Achieving Level 2 certification ensures that your organization meets the necessary security requirements to protect sensitive information and maintain eligibility for vital defense contracts.

Level 2 emphasizes risk management, incident reporting, and more stringent access control mechanisms, making it a core requirement for contractors that frequently interact with sensitive DoD information. Since Level 2 assessments require third-party verification for many contracts, it's critical for contractors to begin preparations early to avoid bottlenecks as compliance deadlines approach.

CMMC 2.0 Implementation Timeline and DoD Deadlines

The Department of Defense (DoD) has outlined a phased, three-year rollout for the Cybersecurity Maturity Model Certification (CMMC) 2.0, ensuring that defense contractors have time to meet the necessary cybersecurity requirements. This phased approach will impact certain contracts during the initial three-year period and will become mandatory for all contracts handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) by the fourth year. To maintain contract eligibility, contractors will need to meet certification requirements according to the timeline outlined below.

Phase 1: Initial Rollout

Summary: The DoD will begin requiring CMMC Level 1 or CMMC Level 2 Self-Assessments as a condition for awarding applicable contracts. In some cases, these self-assessments may also be required to exercise an option period on contracts awarded before the effective date of DFARS 7021. Additionally, certain contracts may require a CMMC Level 2 Certification Assessment (conducted by a Certified Third-Party Assessor Organization, C3PAO) instead of a self-assessment.
Timeline: Begins on the effective date of December 16, 2024, for the certification revision to DFARS 7021.
Phased Implementation Detail: During this phase, the cybersecurity requirements will be selectively applied to contracts based on guidance from the CMMC Program Officer, with the aim of testing the process on specific DoD contracts.

Phase 2: Expanded Certification Requirements

Summary: The DoD will expand the use of Level 2 Certification Assessments (requiring a C3PAO) as a condition for awarding all applicable contracts. In some cases, the requirement may be delayed until an option period rather than at initial contract award. Additionally, contracts that involve highly sensitive information may require Level 3 Certification Assessments.
Timeline: Begins six months after Phase 1 starts (mid-2025).
Phased Implementation Detail: During this phase, the DoD will gradually expand the cybersecurity requirements to a broader range of contracts, focusing on those involving FCI and CUI.

Phase 3: Mandatory Compliance for Most Contracts

Summary: At this stage, CMMC Level 2 Certification Assessments (requiring a C3PAO) will be mandatory for all applicable contracts as a condition for both contract awards and option periods on contracts awarded prior to the DFARS 7021 effective date. CMMC Level 3 Certification Assessments will also be required for contracts involving higher levels of sensitive information.
Timeline: Begins one year after the start of Phase 2 (early 2026).
Phased Implementation Detail: By this phase, most DoD contracts involving the handling of FCI or CUI will require certification, although some selective applications may still be in place.

Phase 4: Full CMMC 2.0 Implementation

Summary: This phase represents the full implementation of CMMC 2.0. All applicable DoD contracts, including option periods on previously awarded contracts, will require the appropriate certification level (Level 1, 2, or 3) as a condition for contract award or continuation.
Timeline: Begins one year after Phase 3 starts (early 2027).
Phased Implementation Detail: After the three-year phased rollout, requirements will apply to all contracts where contractors process, store, or transmit FCI or CUI on their systems, and DoD Component program offices will be required to include these requirements in all relevant solicitations and contracts.

CMMC 2.0