Skip to content

CMMC Levels 1, 2 & 3 Explained: Which Level Does Your Organization Need?

CMMC requirements are determined by the information your contract puts on your systems - notby company size. Level 1 protects Federal Contract Information (FCI). Level 2 protects Controlled UnclassifiedInformation (CUI). Level 3 adds enhanced safeguards for selected high-priority programs facing advancedcyber threats.
What Are the Three CMMC Levels?

What Are the Three CMMC Levels?

CMMC has three levels. Level 1 requires 15 basic safeguards for organizations that handle Federal Contract Information. Level 2 applies to organizations that handle Controlled Unclassified Information andaligns with 110 requirements in NIST SP 800-171 Rev. 2. Level 3 builds on Level 2 with 24 selected NIST SP 800-172 requirements for higher-priority programs requiring enhanced protection against advanced threats.

Current CMMC Program Status - September 2026

CMMC implementation began November 10, 2025, but the Department of War suspended the transition to Phase II on July 13, 2026 and paused the program in Phase I while it conducts a broader review. Today,Phase I self-assessment requirements remain in place: Level 1 requires an annual self-assessment and annual affirmation, while Level 2 self-assessment is performed every three years with annual affirmation. The planned broad rollout of Level 2 C3PAO requirements is suspended during the review. Important note: CMMC rules and contract requirements can change. Always confirm the CMMC status listed in your solicitation, contract, subcontract flow-down, and current official guidance before making an eligibility decision. 

Important note: CMMC rules and contract requirements can change. Always confirm the CMMC status listed in your solicitation, contract, subcontract flow-down, and current official guidance before making an eligibility decision.



Top 250 MSSP Alert Badge



Cybersecurity Maturity Model Certification Badge




Cyber AB Authorized C3PAO Badge



Cyber AB Registered Practitioner Organization Badge

CMMC Levels at a Glance

The fastest way to understad CMMC is to start with the information your organization processes, stores, or transmits. Your contract or flow-down requirement determines the required CMMC status.

CMMC Levels at a Glance

 

What Is CMMC?

The Cybersecurity Maturity Model Certification (CMMC) program is the federal framework used to assess whether companies in the Defense Industrial Base are implementing required safeguards for sensitive unclassified information on contractor information systems.

The model does not assign a level based on revenue, headcount, or whether a company is a prime orsubcontractor. Applicability follows the information and the contract requirement. If your systems process, store, or transmit FCI, Level 1 may apply. If they handle CUI, Level 2 may apply. Level 3 is reserved for
designated programs that require enhanced protection beyond the Level 2 baseline.

CMMC is an assessment mechanism. It does not replace the underlying safeguarding obligations in FAR, DFARS, or NIST. Contractors should treat readiness as an operational cybersecurity program - not a one-time documentation project.

What Is CMMC?

How Do You Know Which CMMC Level You Need?

Start with the data and the contract. Do not choose a level because it “sounds right.” Use the following decision path.

Step 1: Identify whether Federal Contract Information enters your environment. If FCI is processed, stored, or transmitted on contractor systems and no CUI is involved, the contract may require CMMC Level 1.

Step 2: Determine whether your organization receives, creates, stores, processes, or transmits Controlled Unclassified Information. If CUI is in scope, the contract may require CMMC Level 2.

Step 3: Review the solicitation and flow-down language for an explicit Level 3 requirement. Level 3 is not simply a “better Level 2”; it is a designated requirement for higher-priority programs requiring enhanced safeguards.

Step 4: Map the systems, people, facilities, cloud services, external service providers, and data flows that support the contract. Your assessment scope depends on where FCI or CUI is actually handled.

Step 5: Validate the required CMMC status before award. The contract language - not a marketing checklist - is the controlling requirement.


How Do You Know Which CMMC Level Do You Need?

 

CMMC Level 1: Basic Safeguarding of FCI

CMMC Level 1: Basic Safeguarding of FCI

CMMC Level 1 is the foundational level for contractor systems that process, store, or transmit Federal Contract Information. It uses the 15 basic safeguarding requirements in FAR 52.204-21 and requires an annual self-assessment with annual affirmation. Level 1 does not permit a POA&M to leave requirements unresolved.

CMMC Level 2: Broad Protection of CUI

CMMC Level 2: Broad Protection of CUI

CMMC Level 2 applies to contractor environments that process, store, or transmit Controlled Unclassified Information. It aligns with all 110 security requirements in NIST SP 800-171 Rev. 2. Under the current Phase I pause, Level 2 self-assessments remain active, while the broader Phase II rollout of C3PAO
certification requirements is suspended pending the Department’s review.

CMMC Level 3: Enhanced Protection for Designated High-Priority Programs

CMMC Level 3: Enhanced Protection for Designated High-Priority Programs

CMMC Level 3 builds on the full Level 2 baseline and adds 24 selected enhanced security requirements from NIST SP 800-172. The defined model uses a government-led assessment by DCMA DIBCAC and requires Final Level 2 (C3PAO) status as a prerequisite for the same assessment scope. Because CMMC is currently paused in Phase I, organizations should verify current implementation guidance and contract-specific requirements before planning around future Level 3 milestones.

FCI vs. CUI: The Data Difference That Drives Your CMMC Level

FCI: Federal Contract Information is non-public information provided by or generated for the federal government under a contract, excluding information already intended for public release and simple transactional information such as payment data.

CUI: Controlled Unclassified Information is information the government creates or possesses - or that an organization creates or possesses for or on behalf of the government - that requires safeguarding or dissemination controls under law, regulation, or government-wide policy.

Bottom line: If your team cannot confidently identify where FCI and CUI enter, move through, and leave your environment, CMMC scoping will be unreliable. Data discovery and system scoping should come before control implementation.

FCI vs. CUI: The Data Difference That Drives Your CMMC Level

 

How CMMC Assessments Differ by Level

The security requirements become more demanding as the level increases, but the assessment method matters just as much as the control count. Your organization must be able to show that required practices areimplemented within the assessment scope and maintain the required affirmation in SPRS. 

What Defense Contractors Should Do Now -
Even While CMMC Is Paused in Phase I

The Phase II suspension is not a suspension of the obligation to protect federal information. Organizations handling CUI remain responsible for the underlying DFARS and NIST SP 800-171 safeguarding requirements.
 
Action 1
Confirm the data you handle: FCI, CUI, both, or neither. 		 Action 2
Define the systems and providers that are actually in scope.
Action 3
Perform the applicable Level 1 or Level 2 self-assessment and maintain supporting evidence.		 Action 4
Keep your System Security Plan, policies, technical configurations, diagrams, and evidence aligned with how your environment actually operates.
Action 5
Close security gaps instead of relying on the implementation pause as extra time.		 Action 6
Monitor contract language and official CMMC updates so your readiness plan changes when the program changes - not after an award is at risk. 

 

CMMC Readiness Built Around Real Security Operations

 MAD Security combines cybersecurity operations and compliance expertise so defense contractors do not have to manage CMMC as a disconnected paperwork exercise. Our team helps organizations identifyscope, assess gaps, implement and document controls, prepare evidence, support assessments, and maintain
 readiness after the assessment is complete.

MAD Security is a CMMC Level 2 Certified organization with a perfect SPRS score of 110 and hands- on experience supporting Defense Industrial Base organizations. Our 24/7 U.S.-based Security OperationsCenter helps connect compliance requirements to the day-to-day monitoring, response, vulnerability management, and operational discipline needed to protect CUI.

Proof line: One team. Security operations + compliance under one roof.
 


Not Sure Which CMMC Level Applies to Your Organization?

Not Sure Which CMMC Level Applies to Your
Organization?

Start with the contract, the data, and the systems that touch it. MAD Security can help you determine the likely CMMC requirement, define your scope, identify gaps, and build a practical readiness plan around the cybersecurity obligations that actually apply to your environment. (WITH 2ndary CTA)
 
What are the three CMMC levels?
CMMC has three levels. Level 1 protects Federal Contract Information using 15 FAR 52.204-21 safeguards. Level 2 protects Controlled Unclassified Information using 110 NIST SP 800-171 Rev. 2 requirements. Level 3 adds 24selected NIST SP 800-172 requirements for designated higher-priority programs requiring enhanced protection.
What CMMC level does my company need?
Your required CMMC level is driven by the information you handle and the requirement in your contract, solicitation, or subcontract flow-down. FCI generally points to Level 1, CUI generally points to Level 2, and Level 3
applies only when the Department designates the enhanced status for the contract or program.
Does company size determine the CMMC level?
No. CMMC level is not based on employee count, revenue, or whether you are a prime or subcontractor. Applicability follows the information and the contractual requirement.
Is CMMC Level 2 certification still required in 2026?
As of September 18, 2026, CMMC is paused in Phase I. Level 2 self-assessment requirements remain active, while the broad Phase II rollout of Level 2 C3PAO requirements that had been scheduled for November 10, 2026
is suspended during the Department’s review. Organizations should verify current contract language and official guidance.
Is CMMC the same as NIST SP 800-171?
No. NIST SP 800-171 is the security requirements baseline used to protect CUI in nonfederal systems. CMMC Level 2 uses the 110 requirements from NIST SP 800-171 Rev. 2 as the basis for assessment.
What is the difference between FCI and CUI?
FCI is non-public federal contract information that does not meet the higher CUI safeguarding category. CUI is information that requires safeguarding or dissemination controls under law, regulation, or government-wide policy. The distinction is critical because it affects the CMMC level and system scope.
Can a prime contractor flow CMMC requirements down to subcontractors?
Yes. CMMC requirements can flow down when a subcontractor will process, store, or transmit FCI or CUI. The required level must match the information and contract requirement being flowed down.
Do I need to wait for CMMC reform before improving compliance?
No. The Phase II pause does not remove the underlying requirement to protect federal information. Organizations handling CUI should continue implementing and maintaining NIST SP 800-171 Rev. 2 controls and the applicable contractual safeguards.
What should I do first if I am unsure of my CMMC level?
Start by reviewing the contract and mapping where FCI or CUI enters, moves through, and leaves your environment. From there, define the assessment scope and compare the applicable safeguards to your current
technical and documented practices.
Can MAD Security help determine our required CMMC level?
Yes. MAD Security can help review your data types, contractual requirements, technical environment, external service providers, and likely assessment scope so you can build a readiness plan around the correct CMMC level.