CMMC Levels and Controls: How Many Each Level Has
By Shaheer Malik · Updated Oct 28, 2026
CMMC has three levels. Level 1 has 15 security requirements, Level 2 has 110, and Level 3 adds 24 more on top of Level 2, for 134 in total.[1]
| Level | Requirements | Source | Domains |
|---|---|---|---|
| Level 1 | 15 | FAR 52.204-21(b)(1)(i)–(xv) | 6 |
| Level 2 | 110 | NIST SP 800-171 Rev. 2 | 14 |
| Level 3 | Level 2 + 24 | Selected from NIST SP 800-172 | 10 for the 24 additions |
The 14 Level 2 domains
CMMC domains map to the 14 security requirement families of NIST SP 800-171 Rev. 2.[1][2] The number of requirements in each:[2]
| Domain | Code | Requirements |
|---|---|---|
| Access Control | AC | 22 |
| Awareness and Training | AT | 3 |
| Audit and Accountability | AU | 9 |
| Configuration Management | CM | 9 |
| Identification and Authentication | IA | 11 |
| Incident Response | IR | 3 |
| Maintenance | MA | 6 |
| Media Protection | MP | 9 |
| Personnel Security | PS | 2 |
| Physical Protection | PE | 6 |
| Risk Assessment | RA | 3 |
| Security Assessment | CA | 4 |
| System and Communications Protection | SC | 16 |
| System and Information Integrity | SI | 7 |
| Total | 110 |
Level 1 and Level 3 domains
Level 1’s 15 requirements fall in six domains: AC, IA, MP, PE, SC and SI.[1] Level 3’s 24 additions fall in ten: AC, AT, CA, CM, IA, IR, PS, RA, SC and SI.[1][3]
How requirements are numbered
Each requirement is written DD.L#-REQ: the two-letter domain, the level, and the source paragraph or requirement number. AC.L2-3.1.1, for example, is NIST SP 800-171 requirement 3.1.1 at Level 2.[1]
Details by level: Level 1, Level 2, Level 3.
Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.
FAQ
How many controls are in CMMC Level 2?
110, the same as the security requirements of NIST SP 800-171 Revision 2, across 14 domains.
How many controls are in CMMC Level 1?
15, the basic safeguarding requirements of FAR 52.204-21, across six domains.
How many CMMC levels are there?
Three. The original program had five; the revised program announced in November 2021 cut them to three.
How many domains does CMMC have?
Fourteen at Level 2, matching the 14 requirement families of NIST SP 800-171 Rev. 2.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- NIST SP 800-171 Revision 2: Protecting Controlled Unclassified Information in Nonfederal Systems (checked Oct 22, 2026)
- NIST SP 800-172: Enhanced Security Requirements for Protecting CUI (checked Oct 28, 2026)
More on levels and requirements
- CMMC Level 1 Self-Assessment: Requirements and Steps
- CMMC Level 2 Self-Assessment vs C3PAO Certification
- CMMC Level 1 Requirements: All 15 Controls Listed
- What Is CMMC Level 2? Requirements, Self vs C3PAO
- What Is CMMC Level 3? Requirements and Who Assesses It
- Which CMMC Level Do I Need? A Quick Way to Decide
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.