CMMC Level 1, 2 & 3 Tracking [Essentials+]

CMDash's CMMC module maps your integration data, manual evidence, and policy attestations directly to Cybersecurity Maturity Model Certification practices. This guide covers what CMMC is, how to pick which level applies to your program, how to enable and configure tracking for it, and how to use it to prepare for a formal assessment.

Your plan caps how many frameworks you can track at once (Starter 3, Essentials 5, Command and Enterprise unlimited). CMMC Level 1, 2, and 3 each count as one framework toward that cap like any other. The CMMC Level picker, which drives which level's tracking view you land on, is a tab on Security Program (Security → All Security tools → Security Program → CMMC Level) and is available on every plan.

What Is CMMC?

The Cybersecurity Maturity Model Certification (CMMC) is a U.S. Department of Defense (DoD) requirement for organizations that handle Controlled Unclassified Information (CUI). It applies to prime contractors and subcontractors in the Defense Industrial Base (DIB) that access, process, or store CUI.

CMMC is divided into three levels of increasing rigor:

• Level 1 (Foundational): 17 practices covering basic cyber hygiene. Annual self-assessment.
• Level 2 (Advanced): 110 practices mapped to NIST SP 800-171. Triennial third-party assessment (C3PAO) or annual self-assessment, depending on contract sensitivity.
• Level 3 (Expert): A subset of NIST SP 800-172 practices on top of Level 2. Government-led assessment. Reserved for programs involving the highest-sensitivity CUI.

CMDash tracks all three levels as separate frameworks — Level 1, Level 2, and Level 3 each seed their own practices and their own progress. Level 1 is not folded into Level 2; a Level 1 contractor sees a 17-practice tracker, not the full 110.

Why it matters: CMMC requirements have begun appearing as clauses in DoD solicitations following the 48 CFR rule that took effect on November 10, 2025, which phases the requirement into contracts over three years — not every current contract requires it yet. Check your specific solicitation or ask your contracting officer for which level, if any, currently applies.

Choosing Your Target Level

Before enabling a level's tracking, decide which one applies to your program. Go to Security Program → CMMC Level to see a side-by-side comparison of what each level protects, its assessment type, and its POA&M rules, along with your current tracking numbers for each. An OWNER or ADMIN can select the level the program is pursuing there; that selection is what the CMMC card on the Security Program hub reflects, and it is a program decision, not a per-user preference.

Enabling CMMC in CMDash

1. Navigate to Compliance in the left sidebar.
2. Click Add Framework.
3. Select CMMC Level 1, CMMC Level 2, or CMMC Level 3 from the framework library.
4. Confirm the addition. CMDash will begin mapping your connected integration data to CMMC practices immediately.

You can enable more than one level at once — for example, tracking Level 1 today while preparing for a future Level 2 contract. Level 3 tracking assumes the full Level 2 practice set is also enabled; it is not a superset on its own.

The 14 CMMC Domains

CMMC Level 2 organizes its 110 practices across 14 domains. CMDash tracks each domain separately and shows domain-level completion percentages on the CMMC overview page.

Click any domain name in CMDash's CMMC view to see all practices within that domain and their current status.

Control Status Workflow

Each of the 110 CMMC Level 2 practices (and additional Level 3 practices) moves through the following status states:

To update a practice status, navigate to Compliance → CMMC → [Domain] → [Practice], then click the status dropdown. For "Not Applicable," you will be prompted to enter a justification — this justification is included in exports and is reviewed by assessors.

Assessors scrutinize "Not Applicable" designations closely. Use this status only when the practice genuinely does not apply to your system boundary (for example, MA.L2-3.7.5 nonlocal maintenance controls if your systems do not permit remote maintenance).

Automated Evidence from Integrations

CMDash automatically maps data from connected integrations to the relevant CMMC practices. When an integration provides sufficient evidence for a practice, CMDash marks that practice as having automated evidence and adjusts its completion status accordingly.

Key Integration-to-Practice Mappings

To see the full mapping table for your connected integrations, navigate to Compliance → CMMC → Evidence Map.

When an integration syncs new data that satisfies a practice, CMDash updates the practice status automatically and logs a timestamped evidence entry. This evidence record is included in the assessment package.

Manual Controls

Not every CMMC practice can be satisfied by integration data. Physical protection (PE), awareness and training (AT), personnel security (PS), and maintenance (MA) practices typically require manual evidence.

To attach manual evidence to a practice:

1. Navigate to Compliance → CMMC → [Domain] → [Practice].
2. Click Add Evidence.
3. Choose one of three evidence types:
   • File Upload: Attach a document (PDF, DOCX, XLSX, PNG). Maximum file size: 25 MB per attachment.
   • Link: Paste a URL to an external document (e.g., a SharePoint policy or a JIRA ticket).
   • Narrative: Write a free-text description of how the practice is implemented.
4. Set an evidence expiration date if the evidence has a validity period (e.g., an annual training record).
5. Click Save.

Manual evidence is versioned. If you upload a new version of a document, the previous version is retained in history and visible to assessors.

Best practice: Attach at least one piece of manual evidence for every practice, even those covered by integrations. Assessors want to see documentation of your implementation, not just tool data.

POA&M Export [Starter+]

A Plan of Action and Milestones (POA&M) is a formal document listing each control deficiency, the planned remediation approach, responsible owner, resource estimate, and target completion date. The POA&M is a required artifact for CMMC Level 2 C3PAO assessments and for DFARS self-assessments submitted to the Supplier Performance Risk System (SPRS).

To generate your POA&M in CMDash:

1. Navigate to Compliance → CMMC → Export → POA&M.
2. Select which practices to include:
   • All Not Met: Includes every practice currently in "Not Met" status.
   • All Open: Includes "Not Met" and "In Progress."
   • Custom Selection: Manually choose practices.
3. For each included practice, CMDash pre-populates:
   • Finding: The CMMC practice ID, domain, and description.
   • Status: Current status and last updated date.
   • Owner: The CMDash user assigned to the practice (if set).
   • Due Date: Target remediation date (editable before export).
   • Resource Estimate: Optional cost/effort field (editable).
   • Milestone Description: Free-text field for remediation steps (editable).
4. Review and edit fields as needed.
5. Export to XLSX or CSV.

The exported POA&M follows the standard CMMC/NIST column format that C3PAOs and government reviewers expect. If your assessor uses a different template, the CSV export can be reformatted to match.

POA&M export is available on Starter, Essentials, Command and Enterprise. Tracking POA&M items in the POA&M register is on every plan.

Assessment Readiness Score

The Assessment Readiness Score is the percentage of Level 2 practices with status "Met" out of the 110 total practices:

Assessment Readiness = (practices with status "Met") / 110 × 100

This score is displayed prominently at the top of the CMMC overview page and on your Dashboard compliance card.

What score is typically needed for a C3PAO assessment?

There is no regulatory minimum readiness score required to schedule an assessment. However, most experienced practitioners recommend reaching at least 85% (approximately 93 of 110 practices in "Met" status) before engaging a C3PAO. Assessors will document every deficiency they find, and each deficiency requires a POA&M entry. Starting an assessment with significant gaps increases cost and delays certification.

For practices that cannot be met before your assessment date, ensure they have a thorough POA&M entry with realistic milestone dates and a responsible owner.

CMMC Timeline and Regulatory References

Key milestones for defense contractors:

• DFARS 252.204-7019 / 7020: Currently in effect. Requires a NIST SP 800-171 self-assessment score in SPRS before award.
• DFARS 252.204-7021 (CMMC clause): Requires contractors to achieve and maintain CMMC certification at the level specified in each contract. Being phased into contracts progressively.
• Level 2 C3PAO assessments: Required for contracts involving sensitive CUI programs. Triennial certification cycle.
• Level 3 government-led assessments: Required for the highest-sensitivity programs. Contact your DoD program office for schedule.

Subcontractors handling CUI passed down from a prime must meet the same CMMC level as the prime. Verify your flow-down obligations with your prime contract or legal counsel.

CMDash does not provide legal or regulatory interpretation. Consult your compliance counsel and your DoD program office for contract-specific CMMC requirements.

Common Questions

How long does a CMMC Level 2 assessment take?

A typical Level 2 C3PAO assessment takes 2 to 4 weeks of active assessment work, preceded by 4 to 8 weeks of preparation and document review. Organizations with complex environments, multiple enclaves, or significant POA&M items should expect the longer end of that range. Starting your CMDash CMMC tracking at least 6 months before your target assessment date is recommended.

Do I need a C3PAO for Level 2?

It depends on your contract. CMMC Level 2 is divided into two subsets: (1) programs with higher-sensitivity CUI that require a third-party C3PAO assessment, and (2) programs that permit annual self-assessment submitted to SPRS. Your DoD contracting officer or program manager will specify which applies to your contract. Most prime contractors fall into the C3PAO-required category. CMDash's POA&M export and evidence packages support both paths.

What is the difference between Level 2 and Level 3?

Level 2 requires implementation of all 110 practices from NIST SP 800-171. Level 3 adds approximately 24 additional practices drawn from NIST SP 800-172, which address advanced persistent threats (APTs). Level 3 is reserved for organizations handling the most sensitive CUI — typically those supporting specific national security programs. If your contract does not explicitly require Level 3, you need Level 2.