What Are the Key Differences Between CMMC Level 1, 2, and 3 Certifications?
As cybersecurity threats evolve, the U.S. Department of Defense (DoD) continues to raise the bar for contractors handling government
As cybersecurity threats evolve, the U.S. Department of Defense (DoD) continues to raise the bar for contractors handling government data. The Cybersecurity Maturity Model Certification (CMMC) is the DoD way of ensuring contractors meet consistent cybersecurity standards. But with three certification levels—CMMC Level 1, Level 2, and Level 3—how do you know which one your business needs?
This guide breaks down each level, the requirements, and how they impact your eligibility to bid on and retain defense contracts.
An Overview of the Cybersecurity Maturity Model Certification (CMMC)
The DoD developed the CMMC framework to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) across the defense supply chain. The current version, CMMC 2.0, includes three maturity levels with varying degrees of cybersecurity rigor:
- Level 1: Basic Cyber Hygiene
- Level 2: Intermediate Cybersecurity (Aligned with NIST 800-171)
- Level 3: Advanced Security for Critical Programs
Each level corresponds to the sensitivity of the data your organization handles and the requirements of the contracts you pursue.
What Is CMMC Level 1? Basic Cyber Hygiene Explained
CMMC Level 1 is the foundational level, consisting of 17 practices derived from FAR 52.204-21. It applies to contractors handling Federal Contract Information (FCI) information not intended for public release but not classified either.
Key features of Level 1:
- Annual self-assessment
- No third-party certification required
- Covers basic cybersecurity hygiene such as:
- Password management
- Physical security
- Antivirus usage
Best for: Subcontractors and vendors with low-risk DoD engagements.
What Is CMMC Level 2? Transitioning to Intermediate Cybersecurity Practices
CMMC Level 2 aligns directly with NIST SP 800-171, requiring organizations to implement 110 security controls that protect CUI.
Key highlights:
- Divided into prioritized and non-prioritized acquisitions
- Third-party assessments (C3PAOs) are required for prioritized acquisitions
- Annual self-assessments acceptable for non-prioritized contracts
- Controls include:
- Multi-factor authentication (MFA)
- Incident response
- Access controls
- Data encryption
Best for: Contractors handling CUI or bidding on sensitive defense projects.
What Is CMMC Level 3? Advanced Protection for High-Value Information
CMMC Level 3 is designed for companies that work on DoD most sensitive programs involving high-value CUI or potential national security risks.
Level 3 includes:
- All 110 practices from Level 2
- Additional controls derived from NIST SP 800-172
- Requires government-led assessments
- Emphasizes:
- Continuous monitoring
- Defensive cyber operations
- Enhanced threat detection and response
Best for: Prime contractors and suppliers supporting mission-critical systems or national defense programs.
Core Differences between CMMC Level 1, Level 2, and Level 3 Requirements
Feature Level 1 Level 2 Level 3
Data Type Protected FCI CUI High-value CUI / Critical Data
Security Practices 17 110 (NIST 800-171) 110 + Additional (NIST 800-172)
Assessment Type Self-assessment Self or C3PAO (based on contract) Government-led
Certification Requirement No Yes (for prioritized contracts) Yes
Typical Use Case Low-risk contractors Mid-tier DoD suppliers High-security, national security ops
How CMMC Levels Impact Your Eligibility for DoD Contracts
Each DoD contract specifies the required CMMC level. If you’re not compliant at the designated level, you won’t be eligible to bid—or may risk non-renewal for existing contracts.
- Level 1: Small vendors providing basic services or supplies
- Level 2: Most contractors handling CUI
- Level 3: High-assurance environments involving classified adjacent data
Important: Your SPRS score (based on NIST 800-171 implementation) also plays a role in eligibility and competitiveness.
Factors to Consider When Deciding Which CMMC Level Your Business Needs
Before determining your level, consider the following:
- Does your organization handle CUI or FCI?
- Are you a prime contractor or subcontractor?
- What do your contract clauses (e.g., DFARS 252.204-7012) require?
- Do your projects involve export-controlled (ITAR) data?
The Role of CUI (Controlled Unclassified Information) Across CMMC Levels
CUI is the deciding factor between Level 1 and Level 2. If your organization creates, stores, or processes CUI—such as design drawings, specifications, or ITAR-controlled documents—you must meet at least Level 2.
CUI examples include:
- Technical drawings
- Engineering data
- Financial information related to DoD programs
- Export-controlled information
Handling CUI? CMMC Level 2 is non-negotiable.
Conclusion: Choosing the Right CMMC Level to Ensure Compliance and Competitive Advantage
Understanding the differences between CMMC Levels 1, 2, and 3 is essential for aligning your business with DoD requirements. Achieving the correct certification level not only protects sensitive data but also ensures contract eligibility, credibility, and growth in the defense sector.
Whether you’re just starting or preparing for a Level 2 or 3 audit, planning early and working with the right partner can save you time, resources, and lost opportunities.
