Guessing your CMMC level costs money either way. Underestimate it, and you risk bidding on a contract you can’t legally hold. Overestimate it, and you pay for security controls you don’t need. CMMC breaks into three levels, and knowing which one applies to your contract is what keeps you out of both traps.
| CMMC Level | Data Handled | Requirements | Who Assesses | Current Status |
|---|---|---|---|---|
| Level 1 | FCI | 15 | Self-assessment | Active |
| Level 2 | CUI | 110 | Self-assessment, or a C3PAO for priority contracts | Self-assessment active; third-party certification paused |
| Level 3 | High-priority CUI | 134 | DIBCAC (government-led) | Certification timeline paused |
What Does CMMC Level 1 Require?
Level 1 is the floor. It applies once you handle Federal Contract Information, or FCI — information that isn’t classified, but that the government still doesn’t want floating around unprotected.
The 15 Basic Safeguarding Requirements
The requirements come from FAR 52.204-21, a federal contracting rule that predates CMMC and applies whether or not the certification program itself is in flux. A few of the 15:
- Limit system access to authorized users only
- Control and monitor connections to external systems
- Verify and control physical access to any space where FCI lives
- Sanitize or destroy media before disposal or reuse
None of it requires specialized tools. Most businesses already do some version of it, whether or not anyone’s written it down as policy. If you haven’t, the essential IT basics your business needs cover most of this list already.
How Level 1 Compliance Is Verified
No outside auditor is involved. Your company self-assesses against the 15 requirements and files an annual affirmation in the government’s system. That’s the whole model for FCI-level work, and it’s one of the only pieces the 2026 pause left untouched.
What Does CMMC Level 2 Require?
This is where the real jump happens. Level 2 applies once your contract involves Controlled Unclassified Information, or CUI — a broader, more sensitive category than FCI, covering technical drawings, proprietary manufacturing processes, or unclassified defense information.
The 110 Requirements From NIST SP 800-171
Level 2 draws its requirements from NIST SP 800-171, built specifically to protect CUI on non-federal systems. The 110 requirements span:
- Access control
- Incident response
- System and network monitoring
- Configuration management
NIST published a newer edition, Revision 3, in 2024. CMMC’s current rule still incorporates the earlier Revision 2 by reference, so that’s the version your 110 requirements need to match today.
Self-Assessment or Third-Party Certification
Level 2 splits into two paths, and which one applies depends on how sensitive your specific CUI is.
- Priority contracts — the ones carrying the most critical information — require a formal assessment from a third-party assessment organization, or C3PAO.
- Everything else can self-assess, the same way Level 1 does.
Right now, given the pause below, self-assessment is the only path the government is actively enforcing at either tier of Level 2.
What Does CMMC Level 3 Require?
Level 3 sits at the top, and you’re unlikely to hit it unless you’re handling the government’s most sensitive information. It builds on Level 2’s 110 requirements by adding 24 selected requirements from NIST SP 800-172, for a total of 134 — aimed specifically at defending against advanced, persistent threats.
No outside vendor handles this one. The Defense Industrial Base Cybersecurity Assessment Center, a government body, runs Level 3 assessments directly, because this tier protects information the Department of Defense treats as a priority target for foreign intelligence.
What Does the 2026 CMMC Pause Change?
On July 13, 2026, the Department of War — the renamed Department of Defense — suspended CMMC’s Phase 2 rollout. That decision is the reason the levels above matter differently today than they will once the pause lifts.
What the pause changed:
- Paused the move to mandatory third-party certification on a set timeline
- Paused required assessments tied to that Phase 2 rollout
What it didn’t change:
- Level 1’s self-assessment requirement
- Level 2 or Level 3 as part of the framework itself
- The underlying security requirements behind any level
Right now, self-assessment is the only enforcement path active at Level 1 and Level 2. Third-party certification stays paused until the Reform Task Force review wraps up.
A Reform Task Force conducted a 60-day review of the program, and that review closed on September 11, 2026. As of this writing, the Department hasn’t made its recommendations public. Whether Phase 2 resumes as written, changes shape, or extends its pause further is still an open question.
How Do You Know Which CMMC Level Applies to You?
The honest answer depends mostly on your contract, not your industry or company size. A few questions can help you place yourself before you go further:
- Does your contract mention Federal Contract Information, or does it stay silent on the kind of information you’ll handle?
- Will you receive, store, or transmit Controlled Unclassified Information from the prime contractor or the government directly?
- Has your contracting officer or prime named a specific CMMC level in the solicitation or the contract itself?
- Is the work tied to a program the Department of Defense has flagged as especially sensitive, the kind of work Level 3 exists for?
Answering these honestly gets you closer to your level. The contract itself, and the CUI it involves, is what ultimately decides it. If you’re a subcontractor, the CMMC 2.0 requirements every subcontractor must know go one layer deeper than the self-check above.
Knowing Your Level Is the Starting Point
Placing yourself on this framework tells you what’s required. It doesn’t tell you how close your current systems are to meeting it, or where the gaps might be. That conversation starts with your own documentation and your own systems. If you want a second set of eyes on where your setup stands against whichever level applies to you, reach out to our team. We’ll walk through it with you.
