CMMC has 3 levels of increasing rigor, and which one applies to you is decided by the information your contracts involve — not by your size or your sector. Three questions narrow it down, and every sentence in the answer says where it came from.
Sourced from CMDash’s own CMMC guide (docs/user/feature-guides/cmmc-tracking.md, published at /docs) and the level facts the product ships. This is not legal advice and it cannot read your contract.
Answer the three questions and the level those answers point to appears here, with where each sentence comes from.
Answer all three questions and the result becomes printable and sendable.
| Level | Information | Standard | Assessment | POA&M |
|---|---|---|---|---|
| Level 1 | Federal Contract Information (FCI) | FAR 52.204-21 basic safeguarding requirements | Annual self-assessment | Not permitted. Every practice must be fully in place before the self-assessment is submitted. |
| Level 2 | Controlled Unclassified Information (CUI) | NIST SP 800-171 Rev 2 | Most contractors: triennial third-party (C3PAO) certification. A DoD-designated subset handling non-prioritized CUI may self-assess annually instead — the contracting officer decides which applies. | Only 1-point practices (plus SC.L2-3.13.11 at 3 points), and only when the assessment score is at least 88 of 110. Six practices — including the system security plan (3.12.4) and the external-connection controls (3.1.20, 3.1.22) — can never be POA&M’d. Every open item must be closed by a closeout assessment within 180 days of the Conditional CMMC Status date, or that status expires. 32 CFR § 170.21. |
| Level 3 | Prioritized CUI on the DoD’s highest-value programs | NIST SP 800-171 Rev 2 (inherited from Level 2) plus a subset of NIST SP 800-172 | Triennial government-led assessment by DIBCAC (the Defense Industrial Base Cybersecurity Assessment Center). No commercial C3PAO may perform a Level 3 assessment. | Permitted for a narrow set of specific requirements, with the same strict 180-day close-out as Level 2. |