What Is CMMC Certification? Levels, Costs and Who Needs It
By Shaheer Malik · Updated Oct 22, 2026
CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense program that checks whether contractors protect Federal Contract Information and Controlled Unclassified Information. It has three levels: Level 1 is an annual self-assessment, Level 2 is a self-assessment or a certification by a C3PAO every three years, and Level 3 is a certification by the government’s DIBCAC.[1][2]
The three levels
| Level | Requirements | Who assesses | How often |
|---|---|---|---|
| Level 1 (Self) | 15 basic safeguarding requirements (FAR 52.204-21) | You | Every year, plus an affirmation |
| Level 2 (Self) | The 110 requirements of NIST SP 800-171 Rev. 2 | You | Every three years, with annual affirmations |
| Level 2 (C3PAO) | The same 110 requirements | An authorized or accredited C3PAO | Every three years, with annual affirmations |
| Level 3 (DIBCAC) | 24 requirements selected from NIST SP 800-172, on top of Level 2 | DCMA DIBCAC | Every three years; needs a Final Level 2 (C3PAO) first |
Results go into the Supplier Performance Risk System (SPRS). For Level 2 (C3PAO), the assessor enters them into the CMMC instance of eMASS, which passes them to SPRS.[2]
Who needs it
Any company whose DoD contract or subcontract includes a CMMC requirement must hold the required status, and affirm it, before award.[2] The level depends on the information you handle: Federal Contract Information alone points to Level 1; Controlled Unclassified Information points to Level 2. Phase 1 has applied since November 10, 2025. Phase 2, which would have made Level 2 (C3PAO) a routine condition of award, was suspended on July 13, 2026; a contract can still require it under Phase 1.[3][4] See the CMMC timeline.
Passing, conditionally passing, failing
Level 1 must be fully met; no Plan of Action and Milestones (POA&M) is allowed.[2] At Level 2 you can receive a Conditional status if you score at least 80 percent and the open items are on the short list the rule allows; you then have 180 days to close them out or the status expires.[2] The Level 2 assessment guide walks through scoring.
What it costs
DoD estimates a small business spends about $104,670 over three years on a Level 2 certification assessment and the yearly affirmations, not counting the work to become compliant.[1] See CMMC certification cost.
Who helps
CMMC consultants (RPOs) help you prepare; only a C3PAO can certify you at Level 2. Read C3PAO vs RPO, or get quotes from up to 3 matching firms.
FAQ
Is CMMC certification mandatory?
Only when a DoD contract or subcontract includes a CMMC requirement. Phase 1 self-assessments have applied since November 10, 2025; the Phase 2 requirement for C3PAO certification was suspended on July 13, 2026.
How long does a CMMC status last?
Level 1 (Self) is renewed every year. Level 2 and Level 3 statuses last three years, with an affirmation of continued compliance every year.
What is the difference between CMMC Level 1 and Level 2?
Level 1 covers 15 basic safeguarding requirements for Federal Contract Information and is always a self-assessment. Level 2 covers the 110 requirements of NIST SP 800-171 Rev. 2 for Controlled Unclassified Information and can require a C3PAO certification.
What is CMMC 2.0?
CMMC 2.0 was the name for the revised, three-level program DoD announced in 2021. It became the CMMC Program rule, 32 CFR part 170, effective December 16, 2024.
Sources
- Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)
- 32 CFR part 170, CMMC Program (eCFR, text current as of Aug 17, 2026) (checked Oct 22, 2026)
- Holland & Knight: DOW Suspends CMMC Phase II Requirements (July 2026) (checked Oct 16, 2026)
- WilmerHale: Pentagon Suspends CMMC Phase 2 Requirements and Launches Review (July 20, 2026) (checked Oct 16, 2026)
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.