CMMC Basics: CMMC Levels Explained
The Cybersecurity Maturity Model Certification (CMMC) establishes a framework for enhancing cybersecurity across the defense supply chain. Understanding these CMMC levels is crucial for compliance and risk management.
While CMMC was initially released for public comment in January 2020, the framework has been significantly adjusted and simplified since its introduction. Today, the final CMMC rule has three levels of cybersecurity, starting at the most basic, Level 1, and culminating in the most advanced, Level 3. Each of these levels corresponds to specific cybersecurity practices and processes that must be implemented to protect Federal Contract Information (FCI), which is information that is not intended for public release and is provided by or generated for the government under a contract to develop or deliver a product or service to the government, and Controlled Unclassified Information (CUI), which is information that requires safeguarding or dissemination controls pursuant to and consistent with federal law, regulations, and government-wide policies.
The U.S. National Archives and Records Administration (NARA) oversees the federal CUI program, clarifying that: “While FCI is any information that is ‘not intended for public release,’ CUI is information that requires safeguarding and may also be subject to dissemination controls.”
One critical note: CMMC Statuses are awarded to an assessed environment, not holistically to the organization itself. If an organization seeks multiple contracts, either the assessment scope must be inclusive of activities required for each contract or separate assessments must be conducted.
The 3 CMMC Levels
CMMC Level 1 — Basic Safeguarding of FCI
Focused on organizations who only handle FCI and do not come into contact with any CUI, Level 1 requires an organization to demonstrate compliance with 15* basic cyber hygiene practices to protect FCI that aligns to 48 CFR 52.204-21, which is commonly known as the FAR Clause. Contractors (and their subcontractors) awarded a Level 1 (Self) contract must self-assess their compliance annually. No exceptions are allowed. Third-party assessments are not required.
Level 1 summary
To ensure that organizations have basic cyber security practices in place, organizations must follow the 15 practices derived from the FAR Clause, including limiting system access to authorized users, controlling physical access to information systems, system and communications protection, and protecting information during disposal.
Level 1 Example Organization: A small machine shop subcontractor that manufactures a commercial, off-the-shelf (COTS) metal component of military equipment needs to comply with Level 1 because they handle specifications and purchase orders (FCI) from the prime contractor, but does not have access to the full design.
CMMC Level 2 — Broad Protection of CUI
Organizations that handle CUI will be required to meet CMMC Level 2. An organization must demonstrate compliance with 110 controls to validate that they have implemented cyber hygiene practices required to protect CUI. The 110 controls are outlined in the National Institute of Standards and Technology (NIST) security requirements and processes in NIST 800-171 r2. (While NIST 800-171 r3 was finalized in May 2024, at this time, the DoD explicitly indicates that the focus for the final CMMC rule is on r2.) These 110 controls cascade into 320 explicit assessment objectives, as outlined in NIST 800-171a r2, against which an organization is measured.
There are two types of assessments available in Level 2, and which assessment is required will be determined by the individual contract being awarded.
- Self-Assessment: Performed by the entity itself, self-assessments are required every three years, with an affirmation of conformance submitted annually by an executive of the contractor. While specific guidelines around which contracts will require a CMMC Status of Level 2 (Self) rather than a CMMC Status of Level 2 (C3PAO) have not been made clear, the decision will be subject to the determination of Program Managers. It’s estimated that only 5% of Level 2 awards will be eligible for self-assessments. Regardless, contracts that require a CMMC Status of Level 2 (Self) still require the organization seeking assessment to adhere to NIST SP 800-171 standards r2. Self-assessment results must be submitted to the Supplier Performance Risk System (SPRS), including CMMC Level, Assessment Date, Score, Commercial and Government Entity (CAGE) codes, and Plan of Action & Milestones (POA&M) status if applicable.
- Certification Assessment: Performed by a Certified 3rd Party Assessment Organization (C3PAO), these formal assessments are required every three years with an affirmation of conformance submitted annually by an executive of the contractor.
Both self-assessments and certification assessments require entities to implement NIST SP 800-171 r2 controls. If the organization achieves a score of 110, they are issued a “CMMC Status” of either “Final Level 2 (Self)” or “Final Level 2 (C3PAO)” depending on the type of assessment conducted.
Scoring and Status: Both self-assessments and certification assessments use the same scoring system, but result in different designations:
If their score falls between 88-109 (with caveats, see the note below), they may receive a “Conditional CMMC Status,” which will require a POA&M to address any requirements that are scored as NOT MET. Conditional assessment statuses can last no longer than 180 days and all POA&M issues must be resolved in order to achieve the desired final assessment status.
Note: The ability to qualify for a conditional assessment status at Level 2 is in fact quite limited. Of the 320 assessment objectives listed in NIST 800-171a, 215 assessment objectives constitute an “instant failure” if not met at the time of the assessment, with no ability to put them on a temporary POA&M.
[Learn More: CMMC Solutions]
Level 2 summary
Organizations must follow 110 controls aligned with NIST SP 800-171, covering fourteen domains. These include Access Control, Awareness Training, Audit and Accountability, Configuration Management, and many more. These practices include user access provisioning, securing application services, event logging, and incident response. The objective is to effectively manage and reduce cybersecurity risks through documented and consistent practices.
CMMC Level 3 — Protection of CUI against Advanced Persistent Threats (APTs)
Building on the requirements of Level 2, an organization seeking CMMC Status of Final Level 3 (DIBCAC) must first have achieved a CMMC Status of Final Level 2 (C3PAO) for the relevant environment and then also have standardized and enhanced practices that enable advanced protection against Advanced Persistent Threats (APT)s, such as nation-state actors, and comprehensive safeguarding of CUI. To receive a CMMC Status of Final Level 3 (DIBCAC) the entity must also implement 24 selected security requirements from NIST SP 800-172. This level is targeted at entities working on the most critical defense programs. Contracts that require a CMMC status of Final Level 3 (DIBCAC) require their scoped environment to undergo an assessment conducted by a team from the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). Results will be entered into CMMC Enterprise Mission Assurance Support Service (eMASS), which electronically transmits the results to SPRS. Assessment scores are affirmed by a senior official of the contractor after each assessment, including POA&M closeout, and annually thereafter. Seven of the 24 additional assessment objectives required for Level 3 certification constitute an automatic failure.
If any Plan of Action & Milestones is not closed out within 180 days, the Conditional Assessment will expire.
CMMC Level 3 summary
By requiring organizations to implement advanced cybersecurity measures and maintain a robust cybersecurity plan, organizations demonstrate a high level of cybersecurity maturity and resilience against sophisticated threats. In the CMMC proposed rule, the government provided estimates of the number of entities expected for each CMMC Level. As outlined in the table below, 37% of the Defense Industrial Base—or more than 80,000 organizations—will be subject to Level 2 requirements, with an additional 1% (~1,500 entities) requiring Level 3 certification.
Level 3 Example Organization: A defense contractor involved in developing and maintaining critical defense systems, such as missile defense technology, would be an example of a company that may need to comply with Level 3. These systems are high priority due to their strategic importance and the sensitive nature of the information they handle.
Conclusion: CMMC Levels
Understanding the CMMC framework is essential for organizations within the DIB that handle FCI and CUI. With three distinct levels of compliance, each requiring increasingly stringent cybersecurity practices, CMMC ensures that all contractors are equipped to protect sensitive information from evolving cyber threats. As the DoD implements this framework, it will not only enhance the security posture of individual organizations but also strengthen the overall resilience of the supply chain against potential breaches. By prioritizing compliance with CMMC, defense contractors can demonstrate their commitment to safeguarding critical information and maintaining eligibility for future contracts.
Meet the Author
