Understanding The 3 Levels of CMMC 2.0

EXECUTIVE BRIEF

On July 13, 2026, the Department of Defense (DoD) suspended Phase II of the Cybersecurity Maturity Model Certification (CMMC) program and held other pending milestones in abeyance while a task force reviews it. Compliance work continues because the underlying requirements remain in effect and primes and DoD still evaluate them on active contracts.

The CMMC program, codified in Title 32 of the Code of Federal Regulations (CFR) Part 170, sets three levels of cybersecurity compliance for organizations in the defense supply chain. The contracting officer specifies your required level in the solicitation based on the information you handle.

This guide covers the controls, assessment type, Plans of Action and Milestones (POA&M) limits, and applicability of each level.

Stay ahead of the latest CMMC program updates with ISI’s CMMC Status Tracker.

What Are the 3 CMMC Levels?

The CMMC program defines three levels of cybersecurity compliance for the defense supply chain. Level 1 covers contractors who handle Federal Contract Information (FCI). Level 2 covers contractors who handle Controlled Unclassified Information (CUI). Level 3 applies to CUI in the DoD’s highest-priority programs. The information you handle, set by your contract, determines your CMMC level requirements.

Here’s a quick reference:

The Shift to the Tiered Model: CMMC 1.0 vs. CMMC 2.0

CMMC 1.0 divided contractor requirements across five levels. CMMC 2.0 consolidated that model into three levels for DoD contractors. According to the U.S. Department of Defense, the CMMC model offers several advantages over the original framework:

• Consolidating five levels into three lets organizations focus on the cybersecurity requirements that matter most for the information they hold.

• The model builds directly on NIST SP 800-171, a security standard many teams already know.

• Level 1 and some Level 2 contractors can demonstrate compliance through self-assessments, which lowers assessment costs across the Defense Industrial Base (DIB).
• Closer oversight of third-party assessors raises confidence in what each certification level means.

A Deeper Look at the CMMC 2.0 Levels

CMMC Level 1: Foundational

CMMC Level 1 is for DoD contractors who handle Federal Contract Information (FCI) but not Controlled Unclassified Information (CUI). FCI is defined in Federal Acquisition Regulation (FAR) 52.204-21 as “Information not intended for public release, provided by or generated for the Government under a contract to develop or deliver a product or service to the Government.” These are everyday contract details: procurement data, pricing, delivery schedules, and contract performance records.

Level 1 requirements began appearing in applicable solicitations and contracts on November 10, 2025, as Part 1 of CMMC’s four-phased rollout. It establishes a baseline of cyber hygiene across 15 security requirements drawn from FAR clause 52.204-21. These aren't complex or exotic controls: they're the fundamentals every organization operating on a government network should already have in place.

Unlike CMMC Levels 2 and 3, which depend on triennial third-party evaluations, CMMC Level 1 requires an annual self-assessment and annual affirmation. Level 1 contractors must have the required CMMC status and affirmation recorded in the Supplier Performance Risk System (SPRS) as a condition of award.

Unlike Level 2, no POA&Ms are permitted at Level 1 — all 15 requirements must be fully met before you can affirm compliance. Assessment is conducted annually through self-assessment and submitted to the SPRS by a designated Affirming Official.

The information flowing through your systems determines your required CMMC level, regardless of contract size or value. The DoD program office or requiring activity sets the level, and the contracting officer states it in each solicitation based on the information involved. If a subcontractor receives any CUI from a prime, Level 1 no longer applies, and the subcontractor needs Level 2. Scoping starts with identifying where CUI enters your environment, using contract markings and designations from the government or your prime. See CUI Identification: What Counts as Controlled Unclassified Information for examples. 

CMMC Level 2: Advanced

CMMC Level 2 is designed for contractors that handle CUI. It requires all 110 security controls from NIST SP 800-171 Rev 2, organized across 14 security domains, and is met through either a self-assessment or a third-party C3PAO assessment depending on the contract.

The domains span controls such as access control, configuration management, media protection, and incident reporting. Every information system that touches CUI falls within scope, and DFARS 252.204-7012 separately requires you to report cyber incidents to the DoD within 72 hours. You can read the full breakdown in our expert guide to Level 2 requirements.

Assessment runs one of two ways: annual self-assessment for non-prioritized programs or a triennial third-party assessment conducted by an accredited Certified Third-Party Assessment Organization (C3PAO) for most contracts involving CUI. Either pathway requires annual affirmation by a senior official.

Your System Security Plan (SSP) is the foundation of your Level 2 assessment. This document maps every control to your environment, identifies which information systems are in scope, and demonstrates how your organization detects and remediates vulnerabilities. Assessors review it first — a weak or incomplete SSP is the fastest way to fail a CMMC assessment before it begins.

Level 2 permits POA&Ms, but with strict limits. Plans of Action and Milestones are only allowed for controls weighted at one point on the SPRS scale. Higher-weighted controls must be fully met. If you carry a POA&M, your minimum SPRS score must be 88, and every open item must be closed within 180 days — no extensions.

For most DIB contractors, Level 2 isn’t optional — it's a condition of contract award. The question isn't whether to pursue it, but how prepared you are when the assessor arrives.

CMMC Level 3: Expert

Level 3 targets contractors managing CUI in the DoD’s most critical programs, necessitating advanced cybersecurity measures to combat Advanced Persistent Threats (APTs). It incorporates sophisticated practices from both NIST SP 800-171 and NIST SP 800-172.

Organizations face more rigorous CMMC compliance requirements, including selected practices from NIST 800-172, to protect against Advanced Persistent Threats (APTs).
Certification assessment is conducted by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) on behalf of the DoD, focusing on enhanced protection measures and advanced cybersecurity practices.

What’s the Difference Between FCI and CUI? 

FCI (Federal Contract Information) and CUI (Controlled Unclassified Information) are two different types of information the Department of Defense requires contractors to protect.

• FCI is information provided by or generated for the government under a contract that isn’t intended for public release. Organizations that only handle FCI typically fall under CMMC Level 1. 
• CUI includes more sensitive data tied to national security, export controls, or other regulated programs. Because CUI carries a higher risk profile, it triggers stricter security requirements under NIST SP 800-171, the regulatory framework that underlies CMMC Level 2 certification. 
  

   

Contractors handling CUI must demonstrate stronger access control, authentication, and incident response capabilities across their information systems. 

What Is the Phased Rollout Timeline for CMMC?

DoD designed CMMC as a four-phase rollout under Title 32 and Title 48 of the CFR.

Phase 1 began November 10, 2025, the effective date of the final 48 CFR rule, and remains in force. Contracting officers can require Level 1 (Self) and Level 2 (Self) status as a condition of award, so contractors that handle CUI owe a current self-assessment and SPRS score when their contract includes those requirements.

Phase 2, scheduled for November 10, 2026, would have made C3PAO assessments the default for CUI contracts. DoD suspended it on July 13, 2026 and directed program managers and contracting officers to amend active solicitations that contain the suspended language.

Phase 3 would add Level 3 and DIBCAC assessments about a year after Phase 2, and Phase 4 completes full implementation. Both are suspended with Phase 2.

DFARS 252.204-7012 and NIST SP 800-171 Revision 2 remain in effect, and primes can continue to flow down their own requirements. The CMMC Reform Task Force’s recommendations were due between mid-September and early October 2026. DoD has not announced revised dates as of October 26, 2026, so treat Phases 2 through 4 as on hold. See CMMC Phase II Is Paused, Not Canceled.

Do Subcontractors Need To Be CMMC Certified?

Yes. If a subcontractor receives or processes FCI or CUI as part of a contract, the prime contractor must ensure that the appropriate security requirements flow down through the supply chain. This typically occurs through a DFARS clause included in the contract. In practice, the majority of subcontractors will need CMMC Level 2 certification.

See what your prime is saying about CMMC 2.0

How Much Does CMMC Level 2 Certification Cost?

The cost of CMMC Level 2 certification varies widely depending on the maturity of a contractor’s existing cybersecurity program. Organizations with strong controls already aligned to NIST SP 800-171 may spend tens of thousands of dollars preparing documentation and completing a CMMC assessment, while companies with major vulnerabilities or outdated information systems may need to invest significantly more in infrastructure, policies, and compliance support. For many small businesses, preparation and remediation represent the largest investment rather than the assessment itself.

How Many Controls Are in Each CMMC Level?

Level 1 contains 15 basic safeguards focused on protecting FCI. Level 2, which aligns with NIST SP 800-171, includes 110 controls covering areas such as access control, authentication, configuration management, media protection, and incident response. Level 3 builds on Level 2 with an additional subset of advanced security practices derived from NIST SP 800-172, designed to defend against more sophisticated cyber threats.

How Many Companies Will Need CMMC Level 2?

The DoD estimates that roughly 80,000 contractors across the DIB will need CMMC Level 2 certification because they handle CUI. This group includes many small businesses, subcontractors, and mid-sized defense suppliers.

Can You Self-Assess CMMC Level 2?

In some cases, organizations may perform an annual self-assessment for CMMC Level 2, but only when the contract allows it. The majority of companies that fall under Level 2 will need a third-party assessment performed by a C3PAO instead. Even when self-assessments are permitted, contractors must still document their system security plan (SSP), evaluate their cybersecurity posture against the assessment guide, and report results through DoD reporting systems.

How Long Does It Take to Get CMMC Level 2 Certified?

The timeline depends on your starting readiness. Companies that already meet most NIST SP 800-171 requirements may complete preparation and an assessment in a few months. Others may need a year or more to close gaps. C3PAO capacity across the DIB is limited, and lead times vary. If third-party requirements resume, demand will concentrate against that capacity, so contractors that build readiness now avoid the queue. Organizations that start early and follow a structured risk management approach generally reach certification faster. 

What Happens If You Fail CMMC Certification?

Failing a CMMC assessment can delay or exclude you from contract eligibility and damage your reputation in the DIB. Depending on the situation, contractors may need to remediate gaps identified during the assessment and schedule a follow-up evaluation before receiving CMMC 2.0 certification.

What Are POA&Ms and When Are They Allowed?

Plans of Action and Milestones (POA&Ms) document specific security gaps and outline the steps required to fix them within a defined timeframe. Under CMMC 2.0, limited POA&Ms may be allowed during a CMMC assessment, but only for certain non-critical controls. High-risk issues involving CUI protection, such as failures in access control, authentication, or incident response, typically must be resolved before certification. POA&Ms are tracked against defined milestones, ensuring organizations close remaining gaps quickly and maintain a strong cybersecurity posture across their information systems.

ISI not only builds your System Security Plan (SSP) and POA&Ms, we also keep them accurate and audit-ready year-round. Unlike general MSPs that provide templates or one-time checklists, ISI uses a purpose-built DIB compliance platform to map every NIST 800-171 control, assign owners, track evidence, and automate updates as your environment changes. Our compliance experts maintain the documentation, our engineers close technical gaps, and our platform ensures your SSP and POA&Ms always reflect your true security posture to make CMMC Level 2 certification far easier and more dependable.

ISI: Your Trusted Partner for CMMC Compliance in the Defense Industrial Base

ISI specializes exclusively in the DIB, helping mid-sized contractors meet the rigorous cybersecurity and documentation standards required by the DoD (also known as the Department of War). As one of the first MSPs in the U.S. to earn CMMC Level 2 certification, we understand both the technical requirements of CMMC/NIST SP 800-171 and the day-to-day realities faced by small DIB IT teams.

What sets us apart from general IT providers?

• Purpose-built expertise: Our compliance frameworks, assessment tools, and managed services were developed specifically for DoD contractors handling CUI.
• End-to-end support: From gap assessments and remediation planning to readiness reviews and C3PAO coordination, we help you streamline every step toward certification.
• Integrated platform: ISI combines cybersecurity, IT, and compliance management under one roof—reducing vendor complexity and ensuring continuous protection and documentation.
• Real-world results: We’ve guided hundreds of DIB clients through successful assessments, helping them stay contract-eligible and audit-ready without disrupting daily operations.