CMMC Level 1, 2, and 3: which one does your DoD contract require?
CMMC 2.0 has three certification levels. Which one you need depends on the data your DoD contract gives you access to: Federal Contract Information (FCI) means Level 1; Controlled Unclassified Information (CUI) means Level 2 or Level 3 depending on sensitivity. Pick wrong and you risk contract termination and False Claims Act exposure.
3 minutes. No signup required. See exactly which of the 110 controls you're missing.
15-minute call. No sales pressure. Bring your specific situation.
Founder-led
Built by Chad Griffith, a decade in aviation / defense / real estate ops
Anthropic ZDR
Zero data retention with our AI provider. Your CUI never trains a model.
Full Rev 2 coverage: 14 control families, weekly evidence refresh.
G2 verified
2 reviews · Neil C., Marlon U.
How to pick your level
- Read your contract. Look for FAR 52.204-21 (FCI handling) and DFARS 252.204-7012 (CUI handling) clauses.
- Identify the data. FCI = non-public information generated under the contract. CUI = information from NARA's CUI Registry (defense technical data, controlled procurement information, etc.).
- If FCI only: Level 1. If CUI: Level 2 (or Level 3 for highest-priority CUI). If unclear, ask the contracting officer.
- If still unclear, default up. Treating ambiguous data as CUI and implementing Level 2 is safer than under-classifying and losing the contract.
CMMC Level 1 Foundational
- Scope
- FCI handlers
- Controls
- 17
- Framework basis
- FAR 52.204-21
- Assessment
- Annual self-assessment + senior official affirmation to SPRS
- Validity
- 1 year
- Audience
- Contractors handling Federal Contract Information only
CMMC Level 2 Advanced
- Scope
- CUI handlers
- Controls
- 110
- Framework basis
- NIST SP 800-171 Revision 2
- Assessment
- C3PAO third-party assessment (prioritized CUI) OR self-assessment (non-prioritized CUI)
- Validity
- 3 years
- Audience
- Contractors handling Controlled Unclassified Information: the wedge for FileFlo for Defense
CMMC Level 3 Expert
- Scope
- Highest-priority CUI handlers
- Controls
- 110
- Framework basis
- NIST SP 800-171 + NIST SP 800-172 enhanced controls
- Assessment
- DIBCAC government assessment
- Validity
- 3 years
- Audience
- ~1,500 contractors handling weapons-system data + advanced technology programs
Frequently Asked Questions
How do I know which CMMC level my contract requires?
Check the contract clauses. Contracts requiring CMMC Level 1 reference FAR 52.204-21 only. Contracts requiring Level 2 reference DFARS 252.204-7012 (CUI). Contracts requiring Level 3 are explicitly designated by DoD program office and involve the most sensitive CUI categories.
Can I do a Level 2 self-assessment instead of C3PAO?
Only if the contract designates the CUI as "non-prioritized." For "prioritized CUI" (the larger portion of the 80,000 Level 2 population), a C3PAO third-party assessment is required.
What is the difference between FCI and CUI?
Federal Contract Information (FCI) is non-public contract performance information. Controlled Unclassified Information (CUI) is information requiring safeguarding per the CUI Registry (defense technical data, procurement source selection, privacy data, etc.). The data type drives the CMMC level.
How often does certification need to be renewed?
Level 1: annually (self-assessment). Level 2: every 3 years (with annual senior official affirmations). Level 3: every 3 years.
What if my contract requires CMMC but doesn't specify a level?
Ask the contracting officer in writing. Don't guess. If the contract involves any technical data, procurement-sensitive information, or any CUI category from the NARA Registry, plan for Level 2: the cost of under-classifying and certifying at Level 1 is contract termination plus False Claims Act exposure. Many sub-contractors implement Level 2 organization-wide even on Level-1-only contracts to simplify operations.
Can I start at Level 1 and upgrade to Level 2 later?
Yes, but every Level 1 control is a subset of Level 2's 110, so starting at Level 1 doesn't get you Level 2 faster, it just delays the larger gap. If you anticipate ever handling CUI (which most DIB sub-contractors do), build for Level 2 from day one.
What's the difference between Conditional and Final CMMC Status?
Conditional CMMC Status is achieved when your score is ≥ 88/110 with remaining gaps in POAM-eligible controls. Valid 180 days. Final CMMC Status requires 110/110 fully implemented. Conditional → Final happens when all POAM items close within the 180-day window. Miss the window and certification is lost (no extensions, DoD policy).