Which CMMC level does a contract require, and what does each level protect?
A solicitation or prime contract that names a CMMC level is telling you how much of the Department's information your systems must protect before you can receive the award. Level 1 covers Federal contract information (FCI) and applies the 15 safeguarding requirements of FAR 52.204-21. Level 2 covers controlled unclassified information (CUI) and applies the 110 requirements of NIST SP 800-171 Rev. 2. Level 3 is reserved for the most critical programs and applies 24 selected NIST SP 800-172 requirements with DoD-assigned parameters. Under 32 CFR 170.5(b), the DoD program manager or requiring activity chooses the level for a procurement, weighing mission criticality, the type of program or technology, the threat of losing FCI or CUI, and the impact of exploited weaknesses.
The level follows the information your organization handles for that contract, not the size of your company. Check the contract's CUI markings and the data flows in your environment before you accept a level. You own your controls and the evidence behind them. An implementation partner can help you configure systems and assemble documentation, but only an authorized assessor issues the status that your SPRS entry and the contracting officer rely on. Ask your contracting officer which status is required, and confirm whether the solicitation names a self-assessment or a third-party certification.
The level in a contract may now differ from what you expected. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to require Level 2 C3PAO certification for applicable contracts. The 3 September 2026 DoW class deviation (Revision 3) lets requiring activities specify Level 1 (Self) or Level 2 (Self) and directs contracting officers to revise existing and new requirements accordingly. Confirm the exact status written into each solicitation and modification, because a self-assessed status still requires the full set of requirements for that level to be met.
How the three levels and four assessment statuses compare
This table compares CMMC Level 1, Level 2 and Level 3 by the information each protects, its requirement source, who assesses it, how often, and whether a POA&M is allowed, then lists the four assessment statuses named in DFARS 252.204-7021. Read the columns as a decision aid: a higher status also satisfies the lower ones for the same scope, so the status a contract names determines how much work you face. The three-year cycle and affirmation timing come from 32 CFR 170.16 and 170.17.
| Item | What it means | Who assesses | POA&M allowed |
|---|---|---|---|
| Level 1 (FCI) | Protects Federal contract information with the 15 safeguarding requirements of FAR 52.204-21 | The contractor, through an annual self-assessment under 32 CFR 170.15 | No, every requirement must be MET |
| Level 2 (CUI) | Protects controlled unclassified information with the 110 requirements of NIST SP 800-171 Rev. 2 | The contractor (Self) or a C3PAO authorized or accredited by The Cyber AB (C3PAO) | Limited, under the scoring rules in the CMMC POA&M guide |
| Level 3 (critical CUI) | Adds 24 selected NIST SP 800-172 requirements with DoD-assigned parameters, for the most critical programs | DCMA DIBCAC, under 32 CFR 170.18 | Confirm with the requiring activity and the Level 3 guidance |
| Level 1 (Self) | Final Level 1 (Self) status, required for award at Level 1 | Contractor self-assessment, repeated every year | Not applicable, all requirements must be MET |
| Level 2 (Self) | Conditional or Final Level 2 (Self) status, also satisfies Level 1 (Self) | Contractor self-assessment against NIST SP 800-171A, every three years | Limited, see the CMMC POA&M guide |
| Level 2 (C3PAO) | Conditional or Final Level 2 (C3PAO) status, also satisfies Level 1 (Self) and Level 2 (Self) | C3PAO, every three years, with an annual affirmation in SPRS after each assessment | Limited, see the CMMC POA&M guide |
| Level 3 (DIBCAC) | Conditional or Final Level 3 (DIBCAC) status, requires a Final Level 2 (C3PAO) for the same scope | DCMA DIBCAC | Confirm with the requiring activity |
| Suspended Phase II | Since 13 July 2026, requiring activities may specify Level 1 (Self) or Level 2 (Self) only | Confirm current contract language with the contracting officer | Confirm with the contracting officer |
Which level fits a contractor's information and contract
The level a contractor needs is set by two things: the information it handles (FCI or CUI) and the status the requiring activity specifies in the contract. Under 32 CFR 170.5(b), the program manager or requiring activity weighs mission criticality, the type of program or technology, the threat of losing FCI or CUI, and the impact of exploited weaknesses, so the four cases below start with confirming those facts in writing.
Handles only federal contract information
If the contractor receives or creates FCI but no CUI, the baseline is Level 1, which applies the 15 safeguarding requirements of FAR 52.204-21. The decision factor is the information itself, so the contractor should confirm with the requiring activity that the contract involves no CUI marking or handling. Level 1 requires a Final status for award, every requirement must be MET, and no POA&M is permitted. Ask the contracting officer to state the expected status in the solicitation.
Handles controlled unclassified information
When a contract involves CUI, Level 2 applies. The contractor must then decide whether a self-assessment or a C3PAO certification assessment is required, and the requiring activity makes that call under the same mission and threat factors. During the suspension, requiring activities may specify Level 2 (Self), so the contractor should confirm in writing which status appears in the contract and whether the contract's CUI scope matches the systems it plans to assess.
Program needs Level 3 for critical technology
Level 3 is generally reserved for the most critical programs and technologies, where the impact of exploited weaknesses is high. It is assessed by DCMA DIBCAC, and a Final Level 2 (C3PAO) status for the same scope must already exist before that assessment can start. Contractors should ask the program office to confirm the Level 3 requirement, the scope it covers, and whether the Level 2 (C3PAO) prerequisite must be met before award or before the DIBCAC assessment begins.
Contract specifies self-assessment during suspension
After the 13 July 2026 suspension, a requiring activity may specify Level 1 (Self) or Level 2 (Self), and contracting officers are working to revise solicitations and existing contracts that carry C3PAO requirements. A contractor should not assume the change applies automatically. It should get the revised clause or modification in writing, confirm which status now governs the award and any option periods, and keep DFARS 252.204-7012 obligations and SPRS postings current while Phase I remains in effect.
How a higher status satisfies lower ones for the same scope
A higher CMMC status covers the lower statuses for the same assessment scope. A Final Level 2 (C3PAO) status also satisfies Level 2 (Self) and Level 1 (Self) for that scope, and Level 2 (Self) satisfies Level 1 (Self). The reverse does not hold, so a contractor holding only a Level 1 self-assessment cannot use it to bid work that requires Level 2. Level 3 sits on top of this chain: under 32 CFR 170.18, a Final Level 2 (C3PAO) status for the same scope must exist before a DCMA DIBCAC Level 3 assessment can start. Confirm the scope boundary before you rely on this. A status covers only the systems, enclaves and assets named in the assessed scope, so a company that assesses one business unit cannot assume the other units inherit the status.
Each status also carries a state. Under DFARS 204.7502(b)(2), Levels 2 and 3 may be held in a Conditional status for up to 180 days from the CMMC status date, and award can occur while the status is Conditional. Level 1 does not work this way. It requires a Final status before award. A Conditional Level 2 status is therefore a bridge, not a finish line: the contractor must complete the remaining requirements and reach Final within the 180-day window, and its plan for doing so should be documented before the bid is submitted. Review how the contracting officer will treat a Conditional status in the solicitation, since the terms that apply to award and to the closeout window should be checked against the current DFARS text.
The status a solicitation accepts is a decision made by the requiring activity, not a default you can assume. Under 32 CFR 170.5(b), the program manager or requiring activity selects the level for each procurement, and the 2026 class deviation lets requiring activities specify Level 1 (Self) or Level 2 (Self) and asks contracting officers to revise existing requirements. Before bidding, ask the contracting officer in writing which status is required, whether a Conditional status is accepted for award, and whether a Level 2 (Self) status satisfies the requirement or a C3PAO assessment is needed. Record the answer with the solicitation so that your proposal, SPRS entry and affirmation all match what the buyer accepted.
What each level asks of your team and your assessor
Your organization owns every control, even when an outside firm builds or documents the systems. At Level 1 the 15 requirements of FAR 52.204-21 cover Federal contract information, and the company affirms its own result in SPRS after a self-assessment. At Level 2 the 110 requirements of NIST SP 800-171 Rev. 2 cover CUI, and the status comes from either your own self-assessment (Level 2 (Self)) or an independent C3PAO authorized or accredited by The Cyber AB (Level 2 (C3PAO)). Only the assessor or the self-assessing affirmation creates a status. An implementation partner such as DeployOpen can plan, build, harden and document the environment and prepare evidence, but it does not issue a status or sign the affirmation for you.
- Control ownership: your team must be able to show each requirement is implemented and operating, not just designed.
- Evidence in final form: a requirement counts as MET only when evidence is final, so policies and logs in draft will not carry the score.
- Affirming role: the Affirming Official signs the SPRS affirmation for self-assessed statuses and after each assessment.
- Assessor independence: a firm that helped build the environment should not also be the C3PAO that assesses it.
- Recurring duties: Level 1 repeats yearly, and Level 2 repeats every three years with annual affirmations between.
Confirm with your assessor which level your contract requires and whether a self-assessment is permitted for that scope.
The executive decides which CMMC status the company must hold and whether it can bid or keep work. Under 32 CFR 170.5(b), the DoD program manager or requiring activity chooses the level for a procurement based on mission criticality, the sensitivity of the information and the impact of an exploited weakness. Contract clauses then tie award to a status. Level 1 requires a Final status for award, while Levels 2 and 3 may be held in a Conditional status for up to 180 days from the status date, and award can occur on that basis under DFARS 204.7502(b)(2). The executive's role is to know which status each contract names and to have a named owner who signs the affirmation accurately.
- Required status: read the solicitation to find the level and whether it is Self or C3PAO.
- Accountable signer: name an Affirming Official who understands what the affirmation attests.
- Partner boundaries: an implementation partner can prepare the environment, but the company remains responsible for its SPRS entries and claims.
- Policy changes: the 2026 suspension means some solicitations may now specify Level 1 (Self) or Level 2 (Self), so re-check open bids before committing spend.
- Board visibility: report the status, its expiry date and open remediation items to leadership.
Ask counsel and the contracting officer to confirm which clauses currently apply to each contract.
Procurement teams buy help, not status. The useful question is which party does which job. The company owns the controls, the implementation partner prepares systems and evidence under a written scope, and the independent C3PAO or the company's own affirmation establishes the status. A proposal that promises a certification, a pass or a guaranteed score should be treated as a warning sign, because only an independent assessor can issue a Level 2 (C3PAO) result and only the company can make the self-assessment affirmation. Verify any assessor's authorization on The Cyber AB Marketplace rather than relying on the vendor's description.
- Scope statement: ask for a written scope listing systems, deliverables and the level targeted.
- Deliverable list: request the documents and evidence the partner will hand over, in final form.
- Independence: confirm whether the partner plans to assess the same environment, which would create a conflict.
- Status claims: reject any proposal that says the partner will issue a status or certificate.
- Recurring support: ask whether post-assessment upkeep, affirmations and re-assessment support are in the quote or separate.
Confirm with the Cyber AB Marketplace and your prime's flow-down requirements before signing any partner agreement.
Can a plan of action and milestones close a gap at each level?
At Level 1, a plan of action and milestones (POA&M) cannot close a gap at all. Under 32 CFR 170.15, a Level 1 self-assessment must be repeated every year, every one of the 15 requirements must be MET, and no POA&M is permitted. A contractor that handles only Federal contract information either meets all 15 safeguarding requirements at the time of assessment or does not hold a Final Level 1 status. The practical check is to walk each FAR 52.204-21 requirement against final evidence before the annual affirmation, because a single unmet item blocks the status rather than entering a remediation schedule.
Level 2 works differently. Under 32 CFR 170.16 and 170.17, the assessment is performed every three years against the assessment objectives of NIST SP 800-171A, whether the contractor assesses itself or a C3PAO assesses it, and an affirmation is posted in SPRS after each assessment and annually after that. Because a Level 2 assessment can end with some requirements open, a POA&M is a recognized route for a limited set of gaps. Which requirements may be deferred, how many points may remain open, and how the closeout window works are governed by separate rules, so confirm the current threshold, the non-deferrable requirements and the closeout deadline against the eCFR text of 32 CFR 170.21 before you plan a remediation schedule. Treat a POA&M as a planned exception with a deadline, not as permission to delay controls you have not yet built.
What must be final before any level is assessed
Every CMMC level is judged on evidence, and the assessor only accepts evidence that is final, not drafted. The cards below are the checks a buyer can run before anyone outside the organization looks at the environment. The organization makes these decisions and owns the result, and an independent assessor verifies them.
Confirm the assessment scope
Before testing any requirement, decide which systems, people, locations and external providers handle Federal contract information or CUI, and write that boundary down. Every requirement is judged against that boundary, so a system left out of the scope statement but used to store CUI becomes a finding later. Check that the scope matches data flows, not only the asset inventory, and that someone can explain each exclusion.
Keep the system security plan current
The system security plan describes how each requirement is implemented in the environment being assessed. A plan that predates a recent change to identity, network or cloud configuration will not match what the assessor observes. Before assessment, reconcile the plan with current configuration and confirm that its version and approval date are recorded.
Inventory evidence in final form
Build a register that lists, for each requirement, the artifact that shows it is met, its owner, its date and where it is stored. A requirement is MET only when every applicable assessment objective is satisfied with evidence in final form, not drafts, so unsigned policies, unreviewed procedures and screenshots of unfinished configurations do not count. Check that each artifact is dated and that logs cover the period the assessor will sample.
Name one accountable owner
Assign a single person with authority to speak for the organization on scope, evidence and open gaps. Assessors will ask who owns each control, and an answer that changes by team signals weak governance. The owner should confirm that every requirement has a named implementer, and that any help from a consultant or managed provider is documented as support rather than as the organization's own decision.
Map requirement IDs to evidence
Use the requirement format DD.L#-REQ, where DD is the domain, L# is the level and REQ is the source requirement number, as in AC.L2-3.1.1. Tagging each evidence item with its requirement ID lets a reviewer trace a control from the objective to the proof in minutes. Check that every Level 2 requirement ID has at least one linked artifact, and flag any ID without one.
Verify the status an assessor will record
The organization decides whether it believes each requirement is met, and the assessor verifies that belief against the objectives in NIST SP 800-171A. Before scheduling, have the owner confirm which requirements are fully met and which are not, because a claim of MET that fails verification affects the status recorded for the contract. Ask the assessor or the Cyber AB process documents which status outcomes apply to the level being sought.
Common questions about CMMC levels
Does CMMC Level 1 require an outside assessor?
No. A Level 1 assessment is a self-assessment, so the organization itself determines whether each of the 15 requirements is met and submits the result to SPRS. Under 32 CFR 170.15, the self-assessment is repeated every year, every requirement must be MET, and no plan of action and milestones is permitted, so there is no partial credit to negotiate. Outside help is optional. Costs come from internal staff time, any consultant you choose to hire, and the documentation needed to prove each requirement. Before relying on a self-assessment, confirm with your contracting officer that the contract actually calls for Level 1 and not a higher level.
Can a Level 2 self-assessment satisfy a Level 2 requirement in a contract?
It can, but only if the contract's required status is Level 2 (Self) and not Level 2 (C3PAO). A higher status satisfies lower ones for the same scope, so Level 2 (C3PAO) also satisfies Level 2 (Self) and Level 1 (Self). The requiring activity chooses the status based on factors such as mission criticality and the threat to the CUI involved, under 32 CFR 170.5(b). Check the solicitation's DFARS 252.204-7021 language and the status it names. A self-assessment is still assessed against the NIST SP 800-171A objectives, and every applicable objective must be satisfied with final evidence.
What does the 2026 suspension change for an existing contract?
It changes what can be required in new and existing contracts, but it does not remove your current obligations. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification. The DoD class deviation of 3 September 2026 lets requiring activities specify Level 1 (Self) or Level 2 (Self), and contracting officers are working to remove or revise CMMC requirements in solicitations and contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Ask your contracting officer in writing which status applies to your contract.
Which CMMC level does a subcontractor need?
The subcontractor's level follows the information it handles and the level its prime requires, not the prime's own level. A subcontractor that handles only Federal contract information generally needs Level 1, while one that handles CUI needs the Level 2 status the flow-down requires. The prime must verify that status before awarding the subcontract. The 2026 suspension can lower the level a prime specifies, so the requirement in each subcontract should be confirmed against the current solicitation. Ask the prime to state the required status, the DFARS clause it will flow down and the scope of systems the subcontractor must bring into assessment.
Does a DeployOpen engagement produce the CMMC certification?
No. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own environment, and prepares the systems, controls and evidence that an assessment will examine. Only an independent assessor issues a certification: a C3PAO authorized by The Cyber AB for Level 2 (C3PAO), or DCMA DIBCAC for Level 3. For a Level 2 (Self) status, the organization makes its own determination and affirmation. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that written scope.
How much effort does Level 2 readiness take and what must the buyer provide?
Effort depends mainly on how many systems are in scope, how well the current controls are already documented, and how many external service providers handle CUI. Organizations that already run an accurate system security plan and asset inventory usually have less to prepare. The buyer must provide access to in-scope systems, named owners for each control family, current policies and procedures, the list of external service providers and their responsibility matrices, and a decision on the status required by the contract. Ask any provider for a written scope, a list of deliverables and a schedule before agreeing to anything, and confirm the assessment time and fees with your C3PAO, since those are set by the assessor.
What to confirm with the contracting officer before you plan
A solicitation names a CMMC status, but the status can change under a class deviation and the contract text decides what you must hold. Confirm each item below with the contracting officer and the eCFR text rather than assuming the level from the program schedule.
The exact status named in the solicitation
Read the CMMC requirement in the solicitation and any resulting contract, and record the exact status it names, such as Final Level 1 (Self), Final Level 2 (Self), or Final Level 2 (C3PAO). DFARS 252.204-7021 lists the seven statuses a contractor can hold, and the wording determines whether you need a self-assessment or a third-party certification. Ask the contracting officer to confirm the status in writing before you budget for it.
Whether the requiring activity revised the requirement
DoW Class Deviation 2026-O0025, Revision 3 lets requiring activities specify Level 1 (Self) or Level 2 (Self) assessments and directs contracting officers to remove or revise CMMC requirements in new and existing contracts. Ask whether your solicitation or contract has been amended under that deviation, and get the revised clause or modification number. Do not assume an older requirement still applies.
Acceptance of a Conditional status
Levels 2 and 3 can be held in a Conditional status for up to 180 days from the CMMC status date, and award can occur with that status, while Level 1 requires a Final status. Ask the contracting officer whether the solicitation accepts a Conditional Level 2 status at award and what happens if the 180-day window closes before the Final status posts. Plan your POA&M and closeout dates against that deadline.
The scope the status applies to
A CMMC status applies to a defined assessment scope, and a higher status covers lower ones only for that same scope. Ask which systems, enclaves, and facilities the contract requires you to cover, and whether the requirement applies to the whole company or only to the team handling FCI or CUI. Get the scope in writing so your self-assessment or certification boundary matches what the buyer expects.
The assessment body the contract references
Confirm whether the contract calls for a self-assessment, a Level 2 certification by a C3PAO, or a Level 3 assessment by DCMA DIBCAC. Level 3 requires a Final Level 2 (C3PAO) status for the same scope before it can start, so a Level 3 requirement changes your sequence and budget. Ask the contracting officer to name the assessment body and the status date the contract will check.
How DeployOpen prepares systems and evidence for a CMMC level
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own environment, whether that is their cloud accounts, data center or air-gapped network. For a CMMC level, that work means building the systems that hold FCI or CUI, configuring the controls for the requirements in scope, writing the system documentation an assessor will read, and running security testing to check that those controls behave as written. The organization still owns its controls and its scope decisions. DeployOpen's role is to prepare the systems and the evidence so that the organization can judge its own readiness and, where a Level 2 certification assessment applies, hand a prepared environment to an independent C3PAO.
Scope, deliverables and timelines are agreed in writing before any work starts. For a CMMC engagement, that written scope should name the assets in the boundary, the requirements each platform is expected to support, the evidence each deliverable produces, and who on the client side signs off on scope decisions. Ask for the same detail in any proposal you receive from any implementer, including the list of security requirements a platform will be configured to support and the artifacts that will be handed over. A quote follows from that written scope, so the more precisely the boundary and deliverables are defined, the more precise the quote can be.
DeployOpen prepares evidence but does not issue any self-assessment affirmation, SPRS entry, certificate, or Level 2 or Level 3 status. Those decisions belong to the organization's Affirming Official for self-assessments, to a C3PAO authorized or accredited by The Cyber AB for Level 2 certification, and to DCMA DIBCAC for Level 3. The CMMC Program final rule sets out those roles. No implementation work, however thorough, guarantees a particular assessment result, so treat any claim of guaranteed status as a warning sign.
