Do I Need CMMC Level 1 or Level 2?

The short answer

The level depends on what information you handle under the contract, not on the size of your company or the dollar value of the work.

• If the only government information on your systems is Federal Contract Information (FCI) (contract information not meant for public release, such as order details or schedules), you are looking at Level 1.
• If you handle Controlled Unclassified Information (CUI) (sensitive government information that a law or policy requires to be protected), you are looking at Level 2.
• A small number of the most sensitive programs require Level 3. If that applies to you, your contracting officer will say so.

The required level is stated in the solicitation and the contract. This guide helps you recognize which one you are likely to see; it does not replace reading your contract.

Does CMMC apply to me at all?

CMMC applies to DoD contracts and subcontracts where FCI or CUI will be processed, stored, or transmitted on your company's information systems. Contracts solely for commercially available off-the-shelf (COTS) items are excluded.

It is being phased into contracts over several years. Phase 1 began on November 10, 2025: since then, solicitations can require Level 1 or Level 2 self-assessments, and that is still the case.

The next step was to have been Level 2 certification by an authorized third-party assessor (a C3PAO), starting November 10, 2026. In July 2026 the Department of War paused that requirement, along with government-led Level 3 assessments, while it reviews the program. As of this guide's review date, it has not said when or how third-party certification will resume.

During the phase-in, DoD decides contract by contract when to include CMMC. So the practical question is not "has CMMC started?" but "does the contract I am bidding on, or performing, include it?"

Level 1: protecting FCI

Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21: things like limiting system access to authorized users, authenticating users, sanitizing media before disposal, controlling physical access, escorting visitors, and keeping malware protection current.

• Assessment: a self-assessment, every year.
• Passing: every requirement must be met. Level 1 does not allow a plan of action to finish items later.
• Reporting: results go into the Supplier Performance Risk System (SPRS), along with an annual affirmation from a senior company official.

Level 2: protecting CUI

Level 2 covers the 110 security requirements in NIST SP 800-171 Rev. 2. It is a substantially bigger job than Level 1: it includes everything from multi-factor authentication and audit logging to incident response, security training, and a written System Security Plan.

• Assessment: either a self-assessment or a certification assessment by a C3PAO. The solicitation states which. Either way, it repeats every three years.
• Passing: you can reach a conditional status with some items still open, if you score at least 80% and the open items are ones the rule allows. Those items must be closed within 180 days. See What is a POA&M?.
• Reporting: results go into SPRS, with an affirmation at each assessment and every year after.

Level 3, briefly

Level 3 is for a small set of high-priority programs. It requires a final Level 2 certification from a C3PAO first, plus 24 additional requirements from NIST SP 800-172, assessed by the government's own assessors (DCMA DIBCAC). Most small businesses will not see it.

How to confirm which level applies to you

1. Read the solicitation. Look for DFARS provision 252.204-7025, which states the CMMC level and assessment type required.
2. Read the contract. DFARS clause 252.204-7021 is the CMMC requirement itself.
3. Look for DFARS 252.204-7012. It applies when CUI is involved, so its presence is a strong sign that Level 2 is coming.
4. If you are a subcontractor, ask your prime. Your required level depends on what information the prime will flow down to you: FCI only means Level 1; CUI means Level 2.
5. Ask in writing when anything is unclear, and keep the answer.

Not sure whether what you handle counts as CUI? Start with What is CUI?, or try the Level Finder for a quick educational estimate.