What Is CMMC? The Levels, Requirements and Deadlines

The email usually comes from a prime contractor rather than from the government, and it is short. Our contract now requires CMMC, so we need your status before we can issue the next purchase order. Nothing in it tells you which level applies, what an assessment involves, or how long you have. The counts in general circulation do not agree either, because the Department of Defense restructured the program in 2021 and the older numbers never stopped travelling.

The program is written down. It is a federal rule with section numbers, and everything below traces to that text.

What Is CMMC?

CMMC is a verification program. The security requirements it enforces already existed: the basic safeguarding clause has been in the Federal Acquisition Regulation for years, and NIST SP 800-171 has been flowed down to defense contractors through DFARS clause 252.204-7012 for almost as long. What contractors did with them was self-attest. CMMC replaces the attestation with an assessment, a score submitted to a government system, and a status that a contracting officer can check before award.

The program was announced in 2019, published as a five-level model in 2020, and restructured in November 2021 into the three-level version everyone calls CMMC 2.0. That name is marketing shorthand and does not appear in the rule. The codified text calls it the CMMC Program.

Federal Contract Information is the broader and less familiar of the two information types. The FAR definition is information not intended for public release that is provided by or generated for the government under a contract to develop or deliver a product or service, excluding information the government publishes and simple transactional information such as what is needed to process payments. A statement of work, a delivery schedule and a drawing package are all FCI. Controlled Unclassified Information is the narrower category created by Executive Order 13556, and in defense work it usually arrives marked, in technical data, specifications and export-controlled drawings.

Who Has to Comply With CMMC?

Anyone who processes, stores or transmits FCI or CUI on their own systems in the performance of a DoD contract or subcontract. Not the size of the company, not the dollar value of the award beyond the micro-purchase threshold, not whether you think of yourself as a defense contractor.

The reach through the supply chain is the part small suppliers underestimate. Section 170.23 requires prime contractors to flow CMMC requirements down at all tiers to any subcontractor that will handle FCI or CUI in performance of the subcontract. A three-person machine shop cutting parts from a controlled drawing is inside the program even though it has never spoken to a contracting officer, which is why the manufacturers in the defense supply chain are the population this rule changes most.

What Are the CMMC Levels?

Three levels, each defined by a different source document, and each stacking on the one below it. The rule gives the counts precisely, which is worth knowing because a lot of published guidance still carries the old ones.

Vendor pages label the levels Foundational, Advanced and Expert. Those words do not appear in the final rule. What the rule uses, and what will appear in your contract and in the government's supplier database, is a CMMC Status: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC). Four statuses, not three, because the assessment type is part of the requirement rather than a detail of how you meet it.

Which CMMC Level Do You Need?

You do not choose. Section 170.3(d) puts the decision with the DoD program manager or requiring activity, based on the type of information the contract involves, and it reaches you as a line in the solicitation. For subcontracts, section 170.23 sets the floor rather than leaving it to negotiation: a subcontractor handling only FCI needs Level 1 (Self); one handling CUI needs at least Level 2 (Self); one handling CUI under a prime contract that carries Level 2 (C3PAO) needs Level 2 (C3PAO); and one handling CUI under a Level 3 prime contract still needs Level 2 (C3PAO) as its own minimum.

So the practical question is not which level to pick. It is which information you actually hold, because that is what the level follows from, and most companies have never looked.

CMMC Level 1 Requirements

Level 1 is the fifteen basic safeguarding requirements in FAR clause 52.204-21(b)(1): limit system access to authorized users, limit it to permitted transactions and functions, control connections to external systems, control what gets posted publicly, identify users and devices, authenticate them, sanitize media before disposal, limit physical access, escort visitors and keep physical access logs, monitor and protect communications at the boundary, put publicly accessible components on separated subnetworks, correct flaws in a timely manner, protect against malicious code, update those protections, and scan periodically and in real time as files arrive.

That is the security floor any competent small business already stands on. The compliance work is proving it. Level 1 is a self-assessment, conducted annually against the assessment objectives in NIST SP 800-171A, with the result submitted to the Supplier Performance Risk System and an affirmation from a senior company official entered alongside it. Every one of the fifteen has to be scored MET. There is no partial credit and no plan to fix it later, because section 170.21(a)(1) prohibits a plan of action and milestones at Level 1 entirely.

CMMC Level 2 Requirements

Level 2 is NIST SP 800-171 Revision 2 in full: 110 requirements across 14 families, from access control and audit logging through multi-factor authentication, media protection, personnel security and system integrity. If your contracts have carried DFARS 252.204-7012 for the past several years, this is the same standard you have already been obliged to meet. What is new is that somebody now checks.

Scoring is what makes Level 2 unlike a checklist. Section 170.24 starts you at 110 and subtracts the weight of every requirement scored NOT MET: 5 points where the gap could lead to significant exploitation of the network or exfiltration of CUI, 3 points where the effect is specific and confined, and 1 point for the rest. Two requirements have their own arithmetic. Multi-factor authentication costs 3 points if it is implemented only for remote and privileged users and 5 if it is not implemented at all. Encryption of CUI costs 3 points if it is employed but not FIPS-validated, and 5 if it is not employed. A score can go negative.

Whether you self-assess or hire a C3PAO is not your decision either. Both are Level 2, both cover the same 110 requirements, and the contract says which one applies. A C3PAO assessment produces a Certificate of CMMC Status and its results go into the government's eMASS instance and on to SPRS; a self-assessment goes into SPRS directly. Either way the artifacts used as evidence must be kept for six years from the status date, and for a certification assessment they must be cryptographically hashed so the assessor can show they were not altered afterward.

CMMC Level 3 Requirements

Level 3 adds 24 requirements selected from NIST SP 800-172 on top of a current Level 2 (C3PAO) certification, which is a prerequisite rather than a parallel track. Section 170.18 requires a Final Level 2 (C3PAO) status on the Level 3 scope before a Level 3 assessment can even begin, and the assessment is performed by DCMA DIBCAC, the government's own assessment organization, not by a commercial assessor.

The 24 requirements are a different order of ask. Table 1 to section 170.14(c)(4) includes maintaining a security operations center capability that operates 24 hours a day, seven days a week, with remote and on-call staff permitted; maintaining a cyber incident response team deployable within 24 hours; conducting penetration testing at least annually or after significant changes; threat hunting on an ongoing aperiodic basis; verifying the integrity of security critical software using root of trust mechanisms or cryptographic signatures; and assessing, responding to and monitoring supply chain risk with a plan updated at least annually. Scoring is simpler than Level 2: every requirement is worth 1 point, and a maximum score at Level 2 is required to start.

DoD expects this to reach a small fraction of the defense industrial base, and the rule's own cost analysis says inclusion of Level 3 is expected to affect only a small subset of contractors. If nobody has told you that you are on a Level 3 program, you are not.

How CMMC Assessments Work

Four things move through the system, and knowing which is which prevents most of the confusion in a first cycle.

The assessment is conducted against the objectives in NIST SP 800-171A, by you at Level 1 and Level 2 (Self), by an accredited C3PAO at Level 2 (C3PAO), and by DCMA DIBCAC at Level 3. Findings are MET, NOT MET or NOT APPLICABLE, and evidence has to be final rather than draft. Working papers and unapproved policies are named in section 170.24(b) as unacceptable.

The score goes to SPRS, directly for a self-assessment and by way of eMASS for a certification assessment. A contracting officer checks it there before award.

The status is Conditional or Final, at the level and assessment type the contract requires. Conditional means an open plan of action with 180 days on the clock.

The affirmation is separate from all of it. Section 170.22 requires an affirming official, defined as the senior level representative responsible for compliance, to affirm continuing compliance after every assessment, after every plan closeout, and annually thereafter. Level 1 self-assessments run annually, Level 2 and Level 3 assessments run on a three-year cycle with an affirmation every year in between. A Level 3 company files two affirmations rather than one, because section 170.22 requires it to keep affirming its Level 2 (C3PAO) status alongside its Level 3 status.

When Does CMMC Take Effect?

It already has. The phase-in is written into section 170.3(e) as four phases, each one calendar year after the last, starting from the effective date of the acquisition rule.

Two details in the schedule are easy to miss. DoD has discretion to pull requirements forward inside any phase, so a Level 2 (C3PAO) requirement can appear in a solicitation well before Phase 2. And the phases govern new solicitations, so an existing contract stays as it is until an option is exercised or the contract is modified. The date that matters to you is the next award or option you are counting on, not November 2028.

How Much Does CMMC Compliance Cost?

The Department published its own estimates in the final rule's regulatory impact analysis. They are the only cost figures for this program that come from a source with an obligation to show its arithmetic, and they are calculated per assessment, per contractor information system, for a small entity.

Read the assumption underneath those numbers before you budget from them. The analysis states there are no nonrecurring or recurring engineering costs at Level 1 or Level 2, because it assumes the contractor has already implemented the safeguarding requirements and NIST SP 800-171 R2 under existing clauses. The figures are the cost of being assessed, not the cost of becoming compliant. A company that genuinely holds all 110 requirements today will recognize them. A company starting from a partial implementation is looking at remediation on top, and that number depends on how much of the environment has to change.

The one place the rule does price the engineering work is Level 3, where the requirements are new. It estimates $2,700,000 in nonrecurring and $490,000 in recurring engineering costs per small entity, against assessment costs of only $9,050. The ratio is the honest picture of every level: the assessment is the cheap part.

CMMC vs NIST 800-171

At Level 2 they are the same 110 requirements, word for word. The difference is enforcement.

How to Prepare for CMMC