> ## Content Index
> Fetch the complete content index at: https://www.cmmcoperator.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CMMC Level 1 vs Level 2 vs Level 3
- URL: https://www.cmmcoperator.com/cmmc-levels/
- Published: 2026-08-15T14:18:47.000Z
- Updated: 2026-08-18T17:04:49.000Z
- Description: Compare CMMC certification levels, controls, assessment types, scoring methods, costs, and contract applicability.
- Author: HydratedSec
- Tags: CMMC, CMMC Levels

# CMMC Level 1 vs Level 2 vs Level 3: Complete Comparison

The Cybersecurity Maturity Model Certification (CMMC) organizes cybersecurity requirements into three progressive levels. Each level builds on the previous one, increasing in rigor, control count, and assessment complexity. Understanding which level applies to your organization is the first step toward contract eligibility within the Defense Industrial Base.

## Quick Facts by Level

Level 1Foundational17 controls, 59 objectivesPass / Fail (binary)Annual self-assessmentContractors handling Federal Contract Information (FCI)Level 2Advanced110 controls, 320 objectivesSPRS score (-203 to 110)Self or C3PAO assessmentContractors handling Controlled Unclassified Information (CUI)Level 3Expert24 controls, 83 objectives1 pt per control (20/24 threshold)DIBCAC assessment onlyContractors protecting critical CUI against advanced persistent threats

## Detailed Side-by-Side Comparison

| Feature               | Level 1                            | Level 2                                   | Level 3                                 |
| --------------------- | ---------------------------------- | ----------------------------------------- | --------------------------------------- |
| Source Document       | FAR 52.204-21                      | NIST SP 800-171 R2                        | NIST SP 800-172                         |
| Controls              | 15 practices                       | 110 controls                              | 24 additional controls                  |
| Assessment Objectives | 59                                 | 320                                       | 83                                      |
| Scoring Method        | Pass/Fail binary (MET or NOT MET)  | SPRS deduction (-203 to 110)              | 1 pt per control, 20/24 threshold       |
| Assessment Type       | Annual self-assessment             | Self-assessment or C3PAO                  | DIBCAC only                             |
| Data Protected        | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) | CUI against Advanced Persistent Threats |
| POA&M Allowed         | No                                 | Yes, with 180-day close-out limit         | Yes, except 7 prohibited controls       |
| Estimated Cost Range  | Low: $5K - $15K                    | Medium: $50K - $200K                      | High: $200K - $500K+                    |
| Timeline to Ready     | 1 - 3 months                       | 6 - 18 months                             | 12 - 24 months                          |
| DFARS Clause          | 52.204-21                          | 252.204-7012, 252.204-7021                | Same as L2 + enhanced requirements      |

## Which Level Do I Need?

The CMMC level required for your organization depends entirely on the type of information you handle under your defense contracts. Review your contract language and the guidance below to determine your required level.

Your contract mentions FCI only

If your contract references FAR 52.204-21 and you only handle Federal Contract Information, Level 1 foundational practices are sufficient. You will perform an annual self-assessment with pass/fail results. The FAR overhaul model text renumbers this clause 52.240-93, but the renumbering is not codified and 32 CFR 170.14(c)(2) still cites 52.204-21.

Recommended: Level 1Your contract references DFARS 7012 or involves CUI

Any contract that flows down DFARS clause 252.204-7012 or requires you to store, process, or transmit CUI mandates Level 2\. Depending on the contract criticality, you may need a third-party C3PAO assessment.

Recommended: Level 2You handle critical or high-value CUI, or support intelligence community programs

Level 3 applies to a small subset of defense contractors protecting the most sensitive unclassified information against nation-state adversaries. This level adds 24 enhanced security requirements from NIST SP 800-172 and requires a DIBCAC-led assessment.

Recommended: Level 3

## Key Differences Between CMMC Levels

The most fundamental difference between the three levels is scope. Level 1 encompasses 15 basic cyber hygiene practices drawn directly from FAR 52.204-21\. These are the baseline security behaviors most organizations already follow: using antivirus software, limiting physical access, and requiring authenticated users. Level 2 expands that baseline dramatically to 110 controls from NIST SP 800-171 Revision 2, covering 14 security domains including access control, incident response, risk assessment, and system integrity. Level 3 layers on 24 enhanced controls from NIST SP 800-172, specifically designed to counter sophisticated adversaries.

Assessment rigor also escalates sharply. Level 1 organizations perform their own annual self-assessments and affirm their status in the Supplier Performance Risk System (SPRS). Level 2 contractors may self-assess for certain contracts, but the majority of CUI-handling contracts will require a formal assessment by a CMMC Third-Party Assessment Organization (C3PAO). Level 3 goes further still, with assessments conducted exclusively by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), a government-led body.

Scoring mechanics differ significantly as well. Level 1 operates on a simple pass/fail basis: every practice either meets the standard or it does not, and no Plan of Action and Milestones (POA&M) entries are permitted. Level 2 uses the SPRS deduction model, starting at a perfect 110 and subtracting weighted values (1, 3, or 5 points) for each unmet control, with a theoretical floor of -203\. Level 3 assigns one point per control and requires a minimum threshold of 20 out of 24, though seven specific controls are prohibited from being deferred via POA&M.

From a cost and timeline perspective, the gap between levels is substantial. A small contractor pursuing Level 1 might invest $5,000 to $15,000 and achieve readiness in one to three months. Level 2 preparation commonly requires six to eighteen months of work and $50,000 to $200,000 in technology, process, and consulting costs. Level 3, reserved for the most critical programs, can take twelve to twenty-four months and $200,000 to over $500,000, reflecting both the technical depth of the requirements and the government-led assessment process.

## Ready to assess your compliance readiness?

Start your free CMMC Operator assessment to understand where you stand across CMMC Level 1, Level 2, or Level 3\. Get a quantified score, identify gaps, and build a prioritized remediation plan.

CMMC Operator publishes documentation templates and planning resources for informational purposes only. Planning estimates are based on self-reported inputs and do not constitute a compliance determination, certification, or legal opinion.

## Turn this guide into a readiness plan

Start with the free tools: the [Mac scope classifier](https://www.cmmcoperator.com/mac-cmmc-scope-classifier/) and the [POA&M eligibility checker](https://www.cmmcoperator.com/cmmc-poam-eligibility-checker/) turn control status into a prioritized plan. Do not enter CUI, FCI, credentials, or system evidence into any web tool.

[Run the free CMMC readiness check](https://cmmcoperator.com/cmmc-readiness-score?ref=cmmcoperator.com)