The Cybersecurity Maturity Model Certification program, CMMC, is how DoD verifies that its contractors protect the information they hold. It does not invent new security requirements. It checks the ones already in defense contracts, and it replaces trust in a self-reported score with a defined assessment and a senior official's signature.
CMMC has three levels. Each level is tied to a type of information, a set of requirements, and a type of assessment. This article explains each level, how assessment and affirmation work, how plans of action are treated, and how to work out which level applies to you. It describes the program's structure as set out in 32 CFR Part 170. Dates and contract specifics change, so check your solicitation and current DoD guidance for those.
Where CMMC comes from
The program has two legal parts. The program rule, 32 CFR Part 170, defines the levels, the assessment types, scoping, and the roles of assessors. A separate DFARS rule puts CMMC into contracts, through the clause at DFARS 252.204-7021 and a solicitation provision that tells offerors which level is required.
The current program is sometimes called CMMC 2.0, to distinguish it from an earlier five-level model that DoD replaced with the three-level structure.
CMMC is being phased into contracts over several years. Early phases rely mostly on self-assessments, third-party assessments and Level 3 follow in later phases, and the requirement eventually applies broadly. A program office can also require a higher level earlier than the phase schedule implies. What matters for you is what your solicitation says.
The three levels at a glance
| Level 1 | Level 2 | Level 3 | |
|---|---|---|---|
| Information protected | Federal contract information (FCI) | Controlled unclassified information (CUI) | CUI on programs facing advanced persistent threats |
| Requirements | 15, from FAR 52.204-21 | 110, from NIST SP 800-171 Rev. 2 | Level 2 plus 24 selected from NIST SP 800-172 |
| Assessment | Self-assessment | Self-assessment or third-party (C3PAO), as the contract specifies | Government assessment by DCMA's DIBCAC |
| How often | Every year | Every three years | Every three years |
| Affirmation | Every year | Every year | Every year |
| Plan of action allowed | No | Limited | Limited |
Level 1: federal contract information
Level 1 applies to contractors that handle federal contract information, which is information provided by or generated for the government under a contract and not intended for public release. It does not apply to information the government has made public or to simple transactional data, such as that needed to process payments.
The requirements are the 15 basic safeguarding requirements in FAR 52.204-21. They are basic hygiene: limit system access to authorized users and functions, identify and authenticate users, sanitize media before disposal, control physical access and escort visitors, protect network boundaries, fix flaws in a timely way, and run malicious code protection with current updates and regular scans.
Level 1 is a self-assessment, performed every year. All 15 requirements must be met. No plan of action is permitted at Level 1, so a gap means you do not have Level 1 status. Results are entered in SPRS, together with an annual affirmation.
Level 2: controlled unclassified information
Level 2 applies to contractors that handle CUI. The requirements are the 110 in NIST SP 800-171 Rev. 2, the same requirements DFARS 252.204-7012 has asked contractors to implement for years.
Level 2 has two assessment paths:
Level 2 self-assessment. You assess yourself every three years, post the results in SPRS, and affirm compliance each year.
Level 2 certification assessment. A CMMC Third-Party Assessment Organization, or C3PAO, authorized under the program's accreditation body, performs the assessment every three years. You affirm compliance each year.
The solicitation says which path applies. It depends on the information involved, not on your preference. The two paths test the same requirements; they differ in who tests them and in the evidence and process involved.
Level 2 assessments are scored using a weighted method much like the DoD Assessment Methodology behind SPRS scores. Our article on the SPRS score explains how that scoring works. Most of the effort at Level 2 goes into two things: getting the CUI scope right, and implementing the heavier requirements such as FIPS-validated cryptography and multi-factor authentication.
Level 3: the expert level
Level 3 is for CUI on programs DoD judges to face advanced persistent threats. It is not something most contractors will need, and DoD decides when it applies.
Level 3 builds on Level 2 rather than replacing it. You need a Level 2 certification from a C3PAO first, covering the same scope. On top of that, you implement 24 enhanced security requirements that DoD selected from NIST SP 800-172, with values DoD assigns to their parameters. The Level 3 assessment is performed by the government, through the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), every three years. Affirmations are annual.
The 800-172 requirements address resilience against sophisticated attackers: areas such as threat hunting, a security operations capability, and protections designed to limit an adversary who has already gained a foothold. They assume a mature Level 2 program is already in place.
Affirmations
At every level, a senior official of the organization, called the affirming official, affirms in SPRS that the organization has met and continues to meet the requirements. Affirmations are made after each assessment, annually, and when a plan of action is closed out.
The affirmation is a statement to the government by a named senior person. It should be treated with the seriousness that implies, backed by evidence the affirming official has actually reviewed. If your organization is unsure what an affirmation commits it to, confirm with counsel before signing.
How plans of action are treated
CMMC restricts plans of action far more than earlier DoD practice did.
Level 1: none permitted.
Levels 2 and 3: a plan of action can support conditional status only when the assessment reaches a minimum score set by the rule, the open items are ones the rule allows to be deferred, and they are closed within 180 days. Closure is verified by a closeout assessment. If items are not closed in time, conditional status expires.
The rule limits which requirements can be on a plan of action at all and excludes some entirely. Read 32 CFR 170.21 for the current conditions. Our guide to writing a POA&M assessors accept covers how to structure the items you are allowed to carry.
Which level do you need
The answer comes from your contract, and behind it from the information you handle.
Look at the solicitation. The required level and assessment type should be stated. If it is not clear, ask the contracting officer.
Look at the information. FCI alone points to Level 1. CUI points to Level 2 at least. Your CUI handling determines how much of your environment is in scope.
Look at your customers. If you are a subcontractor, the prime will flow requirements down based on what information reaches you.
Look ahead. If you expect to bid on work involving CUI, Level 2 takes time to prepare for. Starting after the solicitation arrives is usually too late.
Do not self-select a higher level out of caution. A Level 2 effort for a company that handles only FCI is a large cost with no contractual benefit. Do make sure, though, that you have not overlooked CUI, because finding it late changes everything. Our CMMC framework page and NIST 800-171 framework page cover the requirements in more detail.
How TrustLynce helps
TrustLynce shows readiness per framework, with gap analysis against the Level 1 and Level 2 requirements and executive reports for the official who signs the affirmation. See the readiness dashboard.