The Department of Defense estimates that 8,350 medium and large entities will be required to meet CMMC Level 2 third-party assessment requirements as a condition of contract award. That figure explains why Cybersecurity Maturity Model Certification (CMMC) has become a board-level concern for defense contractors and subcontractors of every size.
CMMC 2.0 sorts contractors into three levels based on the sensitivity of the government information they handle, not company size or revenue. The contract itself determines which level applies, not a company's own judgment. The compliance path moves from an internal self-assessment at the lowest tier to formal evaluation by an outside assessor or by the government itself at the higher tiers. This article covers the three CMMC levels, explains which contracts trigger which level, and lays out the general sequence from first assessment to certification.
What Is CMMC?
CMMC is the Department of Defense's framework for verifying that contractors protect government information to a consistent standard before winning or keeping a contract. The program rule establishing this structure is known as 32 CFR Part 170. It was published October 15, 2024 and became effective December 16, 2024, establishing the CMMC program structure, three certification levels, assessment types, and program roles. A companion rule later added the contract clauses that require contractors to hold a CMMC status before award.
The program exists because routine federal contract information and more sensitive Controlled Unclassified Information (CUI) often pass through small and mid-size subcontractors with uneven security practices. CMMC ties the level of protection a contractor must meet directly to the kind of data that contractor actually touches.
The Three CMMC 2.0 Levels
The three CMMC levels scale in both the number of security practices required and the rigor of the assessment:
- Level 1 (Foundational): Applies to companies that process, store, or transmit Federal Contract Information (FCI) only. Level 1 calls for an annual self-assessment by the organization, and plans of action are not permitted. All 15 practices must be met before submission.
- Level 2 (Advanced): Applies to companies handling CUI. Level 2 draws its 110 security requirements directly from a federal cybersecurity standard. These requirements are identical to those in NIST SP 800-171 Revision 2, published by the National Institute of Standards and Technology (NIST). Depending on the contract, Level 2 is met through a company's own self-assessment or through an assessment by an accredited outside firm.
- Level 3 (Expert): Reserved for the highest-value CUI and the most sensitive programs. Level 3 carries the same 110 requirements from NIST SP 800-171 plus 24 additional controls selected from NIST SP 800-172. A current Level 2 certification for the same assessment scope is a prerequisite before any Level 3 assessment can proceed. A government assessment team, separate from the outside firms used at Level 2, conducts this final review.
Which Contracts Require Which CMMC Level?
The applicable level depends entirely on the type of information named in the solicitation, not on a contractor's preference or size. Companies touching only basic contract administration data generally fall under Level 1. Companies whose systems handle CUI generally fall under Level 2, and the most sensitive CUI tied to high-priority defense programs can trigger Level 3.
Within Level 2, the government distinguishes between acquisitions by risk. Prioritized acquisitions involving critical programs or high-value CUI call for third-party assessments renewed every three years. Non-prioritized acquisitions, where the CUI carries lower risk, may only need an annual self-assessment. Some supply-chain partners need triennial assessments even without directly storing CUI themselves. A prime contractor's own level often flows down to subcontractors, so a small vendor supporting a Level 2 prime may need its own Level 2 status regardless of how little CUI it personally touches.
The Path From Self-Assessment to Certification
The general sequence toward certification follows a consistent order across all three levels:
- Scoping the environment. Companies first identify every asset that touches regulated information. For CUI, this means documenting assets in an asset inventory, recording asset treatment in a written security plan, and mapping them in a network diagram of the assessment scope.
- Gap assessment and remediation. Internal review against the applicable set of practices identifies gaps. Remediation work follows, such as access control changes, encryption upgrades, and logging improvements.
- Self-assessment or third-party certification. Level 1 always uses self-assessment. Level 2 uses self-assessment or an assessment by a Certified Third-Party Assessment Organization (C3PAO). Four distinct paths exist across the levels: Level 1, Level 2 self-assessment, Level 2 third-party assessment, and Level 3. The contract clause sets which path applies.
- Scoring and remediation plans. A limited plan of action is allowed for partial gaps. A score of at least 88 out of 110, or 80%, is the minimum threshold for a conditional Level 2 status, and open items generally must close within 180 days.
- Ongoing affirmation. Companies submit results to a Department of Defense scoring system and affirm continued compliance annually, even between full reassessment cycles.
A CMMC Compliance Checklist for Getting Audit-Ready
Before scheduling any assessment, a basic readiness checklist covers the following ground:
- Confirm which CMMC level the actual contract language requires, rather than assuming based on past contracts.
- Build or update a written security plan covering every system that touches regulated data.
- Map the full assessment scope, including cloud services and remote endpoints.
- Close out known gaps against the applicable practice set before engaging an assessor.
- Prepare documentation evidence auditors will request, including configuration records and access logs.
- Set a schedule for annual affirmations so certification does not lapse between full reassessments.
Where CMMC Implementation Stands Today
Implementation is phased and partially paused as of late 2026. The underlying rule creates the mechanism for CMMC 2.0 to be formally included in solicitations and contracts over a three-year period, with full applicability to all covered contracts by November 2028. A separate contract rule took effect November 10, 2025, opening Phase 1 of the rollout, under which contracting officers could begin requiring Level 1 and Level 2 self-assessments as a condition of award.
The next phase, which would have made third-party Level 2 certification the default for applicable contracts, did not proceed as scheduled. The Department of Defense suspended all pending and future implementation milestones in mid-2026, pending an internal program review. The suspension does not withdraw the underlying rule or change the core safeguarding clause. Level 1 and Level 2 self-assessment obligations, along with required score submissions, remain in force. No replacement date for the next phase has been announced as of this writing.
For companies bidding on defense work now, the practical takeaway stays the same regardless of the pause. Self-assessment obligations are active today, and the long-term direction toward third-party certification for CUI-handling contractors has not changed.
Why Many Contractors Bring in a CMMC Consultant
A CMMC consultant typically helps a contractor interpret contract clauses correctly, scope the assessment boundary, and prioritize remediation before paying for a formal review. Scoping mistakes are common and expensive: an overly broad assessment boundary pulls unrelated systems into scope and inflates both cost and assessment time. An outside advisor familiar with the scoring methodology also helps a company judge, before an assessor ever arrives, whether a gap qualifies for a limited plan of action or needs to be closed first.
Planet 9 is a Bay Area cybersecurity consulting firm specializing in CMMC readiness for small and mid-size businesses in defense contracting and government suppliers. Our vCISOs and compliance managers help organizations choose the right approach, configure governance, risk, and compliance tools if needed, and get audit-ready without wasted time.
