CMMC Levels 1, 2 and 3 Explained
CMMC has three levels. The level you need depends on the kind of federal information your contracts involve. This guide covers what each level requires and how it is assessed.
Level 1
Level 1 applies to Federal Contract Information (FCI). It has 15 basic safeguarding requirements, confirmed by a self-assessment every year.
Level 2
Level 2 applies to Controlled Unclassified Information (CUI). It requires the 110 security requirements of NIST SP 800-171. Depending on the contract, it is confirmed by a self-assessment or by a C3PAO assessment every three years.
Level 3
Level 3 adds selected requirements from NIST SP 800-172 for the most sensitive programs. It is assessed by the government.
Which level applies to you
Your contract or solicitation states the level required. If you only handle FCI, expect Level 1. If you handle CUI, expect Level 2. Most firms in this directory focus on Level 2 work.