Which CMMC level a defense contract can ask for
The three CMMC levels in 32 CFR 170: what information each covers, how it is assessed, and who decides which applies.
The Cybersecurity Maturity Model Certification (CMMC) program sets the security a defense contractor must show for the information it handles. The rule is 32 CFR part 170. A contractor does not choose its level: the solicitation or contract names it.
The levels
| Status | Information | Requirements | Assessment | Rule |
|---|---|---|---|---|
| Level 1 (Self) | FCI | The safeguarding requirements in FAR 52.204-21(b)(1)(i) through (xv). | Self-assessment by the contractor. Every requirement must be scored MET; no plan of action is allowed at this level. Every year. | 32 CFR 170.15(a)(1) ↗ |
| Level 2 (Self) | CUI | The security requirements of NIST SP 800-171 Rev 2, which the rule says Level 2 matches exactly. | Self-assessment by the contractor, scored under 170.24. A limited plan of action is allowed (Conditional status) if it is closed within 180 days. Every three years. | 32 CFR 170.16(a)(1) ↗ |
| Level 2 (C3PAO) | CUI | The same NIST SP 800-171 Rev 2 requirements as Level 2 (Self). | Certification assessment by an authorized or accredited C3PAO. A limited plan of action is allowed if a C3PAO closes it out within 180 days. Holding this status also covers Level 1 (Self) and Level 2 (Self) for the same scope. Every three years. | 32 CFR 170.17(a)(1) ↗ |
| Level 3 (DIBCAC) | CUI (DoD says it will generally use it for its most critical programs and technologies) | 24 requirements selected from NIST SP 800-172 (Feb 2021), with DoD-set parameters, listed in table 1 to 170.14(c)(4). | Certification assessment by DCMA DIBCAC on behalf of DoD. A Final Level 2 (C3PAO) status on the same or a larger scope is required first. A limited plan of action is allowed if DIBCAC closes it out within 180 days. Every three years, and a new Level 2 (C3PAO) assessment is also needed every three years to keep Level 3. | 32 CFR 170.18(a)(1) ↗ |
Who decides the level
The contractor does not pick its level. The DoD program manager or requiring activity picks the CMMC status for each solicitation or contract, based on whether FCI or CUI will be on the contractor's systems, and also on factors such as mission criticality and threat (170.5(b)). The solicitation or contract then states it. For subcontractors: FCI only means Level 1 (Self); CUI means at least Level 2 (Self); if the prime needs Level 2 (C3PAO) or Level 3 (DIBCAC), the subcontractor needs at least Level 2 (C3PAO) (170.23(a)). 32 CFR 170.3(d); 170.5(b); 170.23(a) ↗
Plans of action
Level 1: no plan of action is ever allowed. Level 2 (Self or C3PAO): allowed only if the score is at least 80 percent of the 110 requirements, every item on it is worth 1 point (except encryption that is used but not FIPS-validated, worth 3), and six named requirements are left off (AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4 System Security Plan, PE.L2-3.10.3, 3.10.4, 3.10.5). Level 3: allowed only at 80 percent or more of the 24 requirements, with seven named requirements left off (IR.L3-3.6.1e, 3.6.2e, RA.L3-3.11.1e, 3.11.4e, 3.11.6e, 3.11.7e, SI.L3-3.14.3e). A closeout assessment must confirm the plan is closed within 180 days of the Conditional status date, or the Conditional status expires. Closeout is done by the contractor for Level 2 (Self), a C3PAO for Level 2 (C3PAO), and DCMA DIBCAC for Level 3. 32 CFR 170.21(a), (b) ↗
Phase-in
- Phase 1 (On the effective date of the companion 48 CFR part 204 CMMC acquisition final rule. Part 170 does not state a calendar date.): DoD intends to require Level 1 (Self) or Level 2 (Self) as a condition of award in applicable solicitations and contracts. DoD may also require them before exercising an option, and may require Level 2 (C3PAO) instead of Level 2 (Self).
- Phase 2 (One calendar year after Phase 1 starts.): DoD intends to require Level 2 (C3PAO) as a condition of award in applicable contracts, though it may delay this to an option period. DoD may also require Level 3 (DIBCAC).
- Phase 3 (One calendar year after Phase 2 starts.): DoD intends to require Level 2 (C3PAO) in all applicable contracts at award and before exercising an option on contracts awarded after the effective date, and Level 3 (DIBCAC) in all applicable contracts at award (it may delay Level 3 to an option period).
- Phase 4 (One calendar year after Phase 3 starts (full implementation).): CMMC requirements go in all applicable DoD solicitations and contracts, including option periods on contracts awarded before Phase 4.
Part 170 sets the phases relative to the companion acquisition rule in 48 CFR part 204; it does not give calendar dates. See our article on the phase 2 status.
Read from 32 CFR part 170 on eCFR, current as of October 15, 2026. CMMC and NIST SP 800-171 explained.
Get your own answer by email
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.