CMMC 2.0 Level 1, Level 2 and Level 3
CMMC 2.0 compliance, level by level
If you sell to the US Department of Defense, or to a contractor who does, CMMC decides whether you can keep the contract. This page covers which level applies, what each level requires and how assessment works.
In short
The Cybersecurity Maturity Model Certification is the US Department of Defense's programme for verifying that contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). CMMC 2.0 has three levels. Level 1 is a self-assessment of 15 basic safeguards. Level 2 requires the 110 controls of NIST SP 800-171 and, for most contracts, a third-party assessment by a C3PAO. Level 3 adds a subset of NIST SP 800-172 with government-led assessment. Requirements are phased into contracts from 2025.
Which level do you need?
The contract clause tells you. If you handle only FCI, Level 1 applies. If you handle CUI, which covers most engineering, manufacturing and IT subcontracts, Level 2 applies. Level 3 is reserved for the most sensitive programmes.
Prime contractors flow the requirement down to every subcontractor that touches the data, so a 20-person SaaS vendor to a prime can be in scope.
| Level | Data | Controls | Assessment |
|---|---|---|---|
| Level 1 (Foundational) | FCI | 15 safeguards from FAR 52.204-21 | Annual self-assessment with executive affirmation |
| Level 2 (Advanced) | CUI | 110 controls, NIST SP 800-171 Rev 2 | C3PAO third-party assessment for most contracts |
| Level 3 (Expert) | CUI on critical programmes | Level 2 plus 24 controls from NIST SP 800-172 | Government-led (DIBCAC) |
What Level 2 asks for
NIST SP 800-171 groups its 110 controls into 14 families: access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.
You need a System Security Plan (SSP) that describes how each control is met, a Plan of Action and Milestones (POA&M) for any gaps, and evidence that the controls operate.
How assessment works
A certified third-party assessment organisation (C3PAO) reviews your SSP, interviews control owners and examines evidence for each of the 110 controls, scoring each one met or not met. A limited number of controls may sit on a POA&M for up to 180 days. The rest must be met at assessment.
Results are entered in the DoD's CMMC eMASS system, the status appears in SPRS, and a conditional or final certificate is issued.
Timeline and cost
How long Level 2 takes depends on where you start and how large the CUI environment is. Most of the effort goes into scoping that environment and writing an SSP that matches how your systems actually run. A named compliance lead helps keep both moving.
The C3PAO fee is paid directly to the assessor and depends on the size of the CUI boundary. An enclave that keeps CUI in a small, well-controlled environment reduces both the time and the assessment cost.
Reusing SOC 2 or ISO 27001 work
Many NIST SP 800-171 controls overlap with ISO 27001 Annex A and the SOC 2 Security criteria, particularly access control, logging, configuration, incident response and vulnerability management. In Certifyi you map a control once, so the access review you already evidence for ISO 27001 or SOC 2 counts towards CMMC Level 2 as well.
The CUI-specific pieces are added on top: FIPS-validated encryption, media marking, CUI training and the SSP itself.
The path to certification
Most of the effort sits in readiness. Keeping CUI inside a small enclave shortens every phase.
-
01
Scope the CUI boundary
Work out where CUI is stored, processed and transmitted. A small enclave is cheaper to assess than the whole company.
Your IT lead, with implementation support if you want help drawing the boundary
-
02
SSP and gap plan
Record how you meet each of the 110 controls. Gaps go on a POA&M with owners and dates.
Your team
-
03
Implement and evidence
Your team builds the controls and links evidence to each one as it is produced.
Your team, in Certifyi
-
04
Assessment
Engage the C3PAO early. The assessor reviews the same evidence through scoped, read-only access in Certifyi.
C3PAO
Who does what
Software, implementation support and the independent assessor are different jobs. This is how they divide.
| Task | Your team | Certifyi | C3PAO (Level 2) or DIBCAC (Level 3) |
|---|---|---|---|
| Scope and level | Decide, from the contract clause | Records scope and CUI boundary | Confirms what it will examine |
| Controls | Design and operate them | Holds controls, policies and your SSP | Not involved |
| Evidence | Upload it or request it | Links it to controls and logs every action on it | Samples it |
| Testing | Not involved | Gives the C3PAO scoped, read-only access to the evidence | Scores each control met or not met |
| The certificate | Not involved | Not involved | Issues conditional or final certification |
How Certifyi helps
Run CMMC on the same record as your other frameworks
Certifyi is the workspace your controls, evidence and assessor share. It does not issue your certificate.
-
CMMC in the framework catalogue
CMMC is in the framework catalogue. Adopt it and map its requirements to the controls you run.
-
Tamper-evident activity log
Evidence sits on the control it supports, and every change to it is written to the tamper-evident activity log, so its history is there when the C3PAO samples it.
-
Assessor engagements
Open an engagement for your C3PAO and give it scoped, read-only access to the evidence it will examine.
From the blog
CMMC articles
Longer answers to the questions teams ask while they work on CMMC.
Questions
CMMC questions we hear most
Is CMMC mandatory yet?
Yes, in phases. The CMMC programme rule took effect in late 2024 and the contract clause is being phased into new DoD solicitations from 2025, with Level 2 C3PAO assessments required for most CUI contracts as the phases progress. Primes are already flowing the requirement down.
Can we self-assess for Level 2?
A limited set of contracts allows self-assessment at Level 2. Most CUI contracts require a third-party C3PAO assessment. The contract clause specifies which applies.
What is CUI, and how do we know if we hold it?
Controlled Unclassified Information is information the government creates, or a contractor generates on the government's behalf, that requires safeguarding. Marking and handling requirements come from the CUI Registry and from the contract itself. If you manufacture, engineer or provide IT services to a defence prime, you probably handle CUI.
Does a SOC 2 report count?
Not directly, but many of the controls overlap. SOC 2 evidence for access control, logging, change management and incident response maps to NIST SP 800-171 families. The CUI-specific pieces (FIPS encryption, media marking, the SSP) are added on top.
What is the difference between CMMC and NIST SP 800-171?
NIST SP 800-171 is the control set. CMMC is how the DoD verifies it. Before CMMC, contractors self-attested to NIST SP 800-171. CMMC adds third-party and government-led assessment to check that the controls operate.
What does assessment cost?
The C3PAO fee depends on the size of the CUI boundary and the number of people and systems in scope. Keeping CUI in a small, well-controlled enclave reduces assessment cost. Certifyi pricing is separate from the assessor fee.
Selling into the defence supply chain?
Bring the contract clause. We will go through which level applies, where your CUI boundary might sit and what assessment would involve.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them