Unofficial. Not affiliated with SAM.gov or the U.S. government. Data from SAM.gov (public). Registration in SAM.gov is free — never pay anyone to register.
CMMC Levels and Requirements: Level 1, 2 and 3 Compared
CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense rule that decides which cybersecurity assessment a contractor must have before award. Level 1 covers basic Federal Contract Information with 15 requirements and a yearly self-assessment; Level 2 covers Controlled Unclassified Information with the 110 NIST SP 800-171 requirements; Level 3 adds 24 NIST SP 800-172 requirements assessed by the government.
CMMC requirements by level
| Level | Information protected | Requirements | Who assesses | How often | Plan of action (POA&M) |
|---|---|---|---|---|---|
| Level 1 (Self) | Federal Contract Information (FCI) | 15 basic safeguarding requirements in FAR 52.204-21 | Self-assessment by your company | Every year, with results and an affirmation in SPRS | Not allowed: all 15 must be met |
| Level 2 (Self) | Controlled Unclassified Information (CUI) | 110 requirements in NIST SP 800-171 Rev. 2 | Self-assessment by your company | Every 3 years, plus an affirmation in SPRS every year | Allowed for some items if you score at least 80%; close within 180 days |
| Level 2 (C3PAO) | Controlled Unclassified Information (CUI) | 110 requirements in NIST SP 800-171 Rev. 2 | Certified third-party assessor (C3PAO) | Every 3 years, plus an affirmation in SPRS every year | Allowed for some items if you score at least 80%; close within 180 days |
| Level 3 (DIBCAC) | CUI in the highest-priority programs | Level 2 (C3PAO) first, plus 24 selected requirements from NIST SP 800-172 | DCMA DIBCAC (government assessors) | Every 3 years, plus an affirmation in SPRS every year | Allowed for some items; close within 180 days |
What small businesses should do first
- Check each Defense notice for the CMMC level it requires before you spend time on a bid.
- Work out whether you will receive FCI only (Level 1) or CUI (Level 2).
- For Level 1 or Level 2 (Self), run the self-assessment and enter the result and affirmation in SPRS.
- Keep your SAM.gov registration and the other bidding steps current; CMMC does not replace them.
Browse open Department of Defense opportunities or all contracts closing soon.
FAQ
Do I need CMMC to bid on federal contracts?
Only for Department of Defense solicitations that include the CMMC clause (DFARS 252.204-7021). The notice states the required level. Most civilian agency contracts do not require CMMC.
Which CMMC level does my company need?
Level 1 if you will only handle Federal Contract Information (FCI). Level 2 if you will handle Controlled Unclassified Information (CUI). Level 3 only when the solicitation asks for it for the most sensitive CUI programs.
When does CMMC apply?
The DFARS rule took effect on (Phase 1: Level 1 and Level 2 self-assessments). Under 32 CFR 170.3(e), Level 2 third-party (C3PAO) certification is added one year later (Phase 2), Level 3 the year after (Phase 3), and full implementation in Phase 4.
Where do I report my CMMC status?
In SPRS (Supplier Performance Risk System). You enter self-assessment results there, and a senior official affirms continuing compliance every year.