CMMC levels 1, 2, and 3 in plain terms

Contractors that handle government information on their own systems are assessed on how well they protect it, and the Cybersecurity Maturity Model Certification (CMMC) program is the framework for that assessment. CMMC has three levels. Level 1 covers 15 basic safeguarding requirements for federal contract information (FCI), Level 2 covers the 110 requirements of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2 for controlled unclassified information (CUI), and Level 3 adds 24 selected requirements from NIST SP 800-172. The Department of War (DoW) suspended the phase that would have required third-party assessments in July 2026. As of October 12, 2026, the DoW Chief Information Officer (CIO) pages say only self-assessments at two levels may be required.

Level 1

15

basic safeguarding requirements

Federal contract information

Level 2

110

requirements of NIST SP 800-171 Revision 2

Controlled unclassified information

Level 3

24

requirements selected from NIST SP 800-172

The most critical programs and technologies

Sources: 32 CFR Part 170 and the Department's CMMC pages, as cited in this post.

Where the requirement comes from

FCI is non-public information provided by or generated for the Government under a contract. CUI is government information that a law, regulation, or policy requires to be safeguarded or controlled. Two rules carry the program.

32 Code of Federal Regulations (CFR) Part 170 is the program rule. The rule's source is a Federal Register final rule published October 15, 2024 (89 FR 83214), and the Electronic Code of Federal Regulations (eCFR) version history shows every section of Part 170 last amended on December 16, 2024.

The second rule puts CMMC into contracts. The Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7021, dated November 2025 on Acquisition.gov, requires a contractor to hold a current CMMC status at the level the contracting officer selects. DFARS subpart 204.75 tells contracting officers not to award to an offeror without a current status at that level, and to check the Supplier Performance Risk System (SPRS) first.

The three levels

• Level 1 applies the 15 requirements of the basic safeguarding clause at 48 CFR 52.204-21. The contractor must meet every one, and plans of action and milestones (POA&Ms), which are documents listing unfinished tasks and their schedules, are not permitted.
• Level 2 applies requirements the rule describes as identical to NIST SP 800-171 Revision 2. The DoW About CMMC page counts them as 110.
• Level 3 applies 24 requirements selected from NIST SP 800-172 (February 2021), listed in a table in section 170.14. Part 170 says the Department of Defense (DoD) generally designates Level 3 for its most critical programs and technologies.

Program managers choose the level for each procurement, weighing factors such as mission criticality (section 170.5).

Who does the assessing

Each CMMC status carries a label for who assessed:

• Self: the contractor assesses itself against the requirements, enters the result in SPRS, and a senior official affirms compliance. Level 1 repeats annually. Level 2 repeats every three years, with an affirmation each year.
• C3PAO: a CMMC Third-Party Assessment Organization, which the Accreditation Body has authorized or accredited, conducts a Level 2 certification assessment.
• DIBCAC: the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center conducts the Level 3 assessment. A contractor must first hold Final Level 2 (C3PAO) status for the systems in scope.

The clause lists seven possible statuses: Final Level 1 (Self), Conditional and Final Level 2 (Self), Conditional and Final Level 2 (C3PAO), and Conditional and Final Level 3 (DIBCAC). Conditional status means a POA&M exists. At Levels 2 and 3 the contractor has 180 days to close it, or the conditional status expires. The clause's definition of a current status allows no more than one year for Final Level 1 and no more than three years for Final Level 2 and Level 3, with an affirmation no older than one year.

Phases, and the status as of October 12, 2026

Section 170.3 sets four phases. Phase 1 starts on the effective date of the DFARS rule, and each later phase starts one calendar year after the one before. In Phase 1 DoD intends to require Level 1 (Self) or Level 2 (Self) as a condition of award. Phase 2 adds Level 2 (C3PAO). Phase 3 extends Level 2 (C3PAO) and Level 3 (DIBCAC) to all applicable solicitations, and Phase 4 applies CMMC to all applicable solicitations and contracts. The DoW About page says Phase 1 began on November 10, 2025.

Subpart 204.75 adds its own dates. Until November 9, 2028, the clause is used when the program office determines a specific CMMC level is needed. From November 10, 2028, it is used when the contractor must use its own information systems to process, store, or transmit FCI or CUI.

On July 13, 2026, the DoW announced a suspension of Phase II, which had been scheduled for November 10, 2026. The DoW CIO CMMC page says Phase I self-assessment requirements remain in place, announces a broader review of the program, and gives no new date for Phase II. The About page says the program is paused in Phase 1 and may only require self-assessments at two levels, and that the pause does not eliminate the requirement to protect information under DFARS 252.204-7012.

The Part 170 text in the eCFR, current as of October 8, 2026, still describes all four phases and all three levels. Where the sources differ on what is required today, the DoW CIO pages are the more recent.

What to check

• The level and the assessor the solicitation names, for example Final Level 2 (Self) or Final Level 2 (C3PAO), and for a self-assessment, the result in SPRS.
• A vendor's claimed status against the seven the clause lists, and, at Levels 2 and 3, the 180-day window for a Conditional status.
• The age of the status against the clause's limits: one year for Final Level 1, three years for Final Level 2 and Level 3.
• The date on any statement about phases. As of October 12, 2026, the DoW CIO page gave no new date for Phase II.

Sources

1. 132 CFR Part 170 - Cybersecurity Maturity Model Certification (CMMC) Program · Electronic Code of Federal Regulations, Office of the Federal Register
2. 2252.204-7021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements · Acquisition.gov
3. 3Subpart 204.75 - Cybersecurity Maturity Model Certification · Acquisition.gov
4. 4About CMMC · Department of War Chief Information Officer
5. 5CIO - Cybersecurity Maturity Model Certification · Department of War Chief Information Officer