CMMC Level 1: requirements, self-assessment, and annual affirmation
A clear explanation of the FCI baseline and the work behind a Level 1 self-assessment.
Three levels. Clearer distinctions.
Understand the information, requirements, and assessment pathways described in the CMMC model. Read current implementation policy alongside this reference.
| Compare | Level 1 / Foundational | Level 2 / Advanced | Level 3 / Expert |
|---|---|---|---|
| Information | FCI | CUI | CUI requiring enhanced protection |
| Requirements | 15 in FAR 52.204-21 | 110 in NIST SP 800-171 Rev. 2 | 24 selected NIST SP 800-172 requirements, plus qualifying Level 2 foundation |
| Assessment | Organization self-assessment | Self-assessment or C3PAO, as required by procurement | DCMA DIBCAC; Final Level 2 C3PAO prerequisite for the relevant scope |
| Assessment cycle | Annual | Every 3 years | Every 3 years, with required Level 2 reassessment |
| Affirmation | After assessment and annually | After applicable assessment events and annually | After applicable assessment events and annually |
| POA&M | Not permitted | Limited conditional pathway under the rule | Limited conditional pathway under the rule |
Model and implementation are different. The Department’s current overview says implementation is paused in Phase 1 following the July 2026 suspension of Phase II. This table explains the codified model; it does not mean all listed pathways are currently required for every procurement. Read the current policy briefing.
CMMC Level 2: 110 requirements and the right assessment pathway
How CUI, NIST SP 800-171 Revision 2, SSPs, and assessment types fit together.
CMMC Level 3: enhanced protection and DIBCAC assessment
What changes at Level 3 and why the Level 2 foundation still matters.