CybersecurityNearMe.aiApply for a Grant
MenuClose
Find a Provider
In-Kind Grants
Learn
AboutContact
Apply for a Grantinfo@cybersecuritynearme.ai

CMMC

Choosing Between CMMC Level 1, 2, and 3

Not all defense contractors need the same level of CMMC certification. Learn which level applies to your contracts and what each level requires.

January 22, 20266 min read

The three CMMC levelsLevel 1, Foundational: Federal Contract Information, 15 requirements, annual self-assessment. Level 2, Advanced: Controlled Unclassified Information, 110 practices, self-assessment or third-party assessment depending on the contract. Level 3, Expert: the most sensitive programs, more than 110 practices, government-led assessment.1LEVEL 1, FOUNDATIONALYou handle FederalContract Information15 requirements from FAR52.204-21. You check your ownwork once a year.2LEVEL 2, ADVANCEDYou handle ControlledUnclassifiedInformation110 practices from NIST SP800-171. Self-assessment or athird-party assessor, dependingon the contract.3LEVEL 3, EXPERTYou work on the mostsensitive programsMore than 110 practices, basedon NIST SP 800-172. Thegovernment runs the assessment.The three CMMC levelsLevel 1, Foundational: Federal Contract Information, 15 requirements, annual self-assessment. Level 2, Advanced: Controlled Unclassified Information, 110 practices, self-assessment or third-party assessment depending on the contract. Level 3, Expert: the most sensitive programs, more than 110 practices, government-led assessment.1LEVEL 1, FOUNDATIONALYou handle FederalContract Information15 requirements from FAR 52.204-21.You check your own work once a year.2LEVEL 2, ADVANCEDYou handle ControlledUnclassified Information110 practices from NIST SP 800-171.Self-assessment or a third-partyassessor, depending on the contract.3LEVEL 3, EXPERTYou work on the mostsensitive programsMore than 110 practices, based on NISTSP 800-172. The government runs theassessment.

One of the most common questions defense contractors ask is: which CMMC level do I need? The answer depends on the type of information you handle and the specific requirements in your contracts.

CMMC Level 1: Foundational

Level 1 applies to companies that handle Federal Contract Information (FCI) but not Controlled Unclassified Information (CUI). It requires 15 basic safeguarding requirements (FAR 52.204-21) and allows annual self assessment.

Typical Level 1 contractors: Small subcontractors providing commercial off the shelf products or services that do not involve sensitive government information.

CMMC Level 2: Advanced

Level 2 is the most common level for defense contractors. It applies to companies handling CUI and requires 110 practices aligned with NIST SP 800-171.

Assessment requirements: Depending on the contract, Level 2 is met through a self-assessment or a third party assessment by a CMMC Third Party Assessment Organization (C3PAO). Phase II, originally scheduled for November 10, 2026, was suspended on July 13, 2026, and Phase I self-assessment requirements remain in place (DoD CIO).

CMMC Level 3: Expert

Level 3 applies to companies working on the most sensitive DoD programs. It requires 110+ practices based on NIST SP 800-172 and involves government led assessments.

Who needs Level 3: Typically prime contractors on highly sensitive programs and companies with access to the most sensitive CUI.

Last reviewed:

Ready to close your cybersecurity gap?

Start with a grant application if budget is the blocker, or talk to a specialist if you are ready to buy.

Apply for an in-kind grantContact us

Or email info@cybersecuritynearme.ai