Which CMMC Level Do I Need? A Quick Way to Decide
By Shaheer Malik · Updated Oct 28, 2026
Your contract sets your CMMC level, and the information you handle drives it. If you will only handle Federal Contract Information, you need Level 1. If you will handle Controlled Unclassified Information, you need Level 2, as a self-assessment or a C3PAO certification depending on the contract. Level 3 is for CUI on DoD’s highest-priority programs.[1]
Decide in three questions
- Does the solicitation name a level? Program managers select the CMMC status for each procurement, and contracting officers put it in the solicitation.[1][2] If it is named, that is your answer.
- Will you handle CUI? Look for CUI markings, controlled technical information or DFARS 252.204-7012 in your contract. CUI points to Level 2. See FCI vs CUI.
- Only FCI? Information provided by or generated for the government under the contract and not meant for public release is FCI; that points to Level 1.[3]
Level by situation
| Your situation | Level |
|---|---|
| You handle only FCI | Level 1 (Self) |
| You handle CUI and the contract asks for a self-assessment | Level 2 (Self) |
| You handle CUI and the contract asks for certification | Level 2 (C3PAO) |
| CUI on a priority program, contract asks for Level 3 | Level 3 (DIBCAC), on top of Level 2 (C3PAO) |
| You are a sub handling CUI under a prime that needs C3PAO or Level 3 | At least Level 2 (C3PAO) |
The subcontractor rules come from 32 CFR 170.23.[1] A higher status covers lower ones for the same scope: Level 2 (C3PAO) also satisfies Level 1 (Self) and Level 2 (Self).[1]
During the Phase 2 suspension
Since September 3, 2026, requiring activities may use Level 1 (Self) or Level 2 (Self) in all procurements, and the move to third-party certification is suspended.[4] If you handle CUI, prepare to the full Level 2 requirements anyway: the self-assessment covers the same 110.
Still unsure? A consultant can confirm your level in a short scoping call. Find one by state or get up to 3 quotes.
FAQ
How do I know what CMMC level I need?
Check the solicitation or contract: it names the level. If it doesn’t yet, FCI only points to Level 1 and CUI points to Level 2.
What is my CMMC level as a subcontractor?
Level 1 (Self) if you handle only FCI; at least Level 2 (Self) if you handle CUI; at least Level 2 (C3PAO) if you handle CUI and the prime contract requires Level 2 (C3PAO) or Level 3.
Is Level 2 the most common CMMC level?
Level 2 applies wherever CUI is involved, which covers a large share of the defense industrial base; Level 1 covers companies that handle only FCI.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- Class Deviation 2026-O0025, Revision 3, Attachment 1: revised DFARS part 240 (Sep 3, 2026) (checked Oct 28, 2026)
- FAR 4.1901, Definitions (Federal contract information) (checked Oct 28, 2026)
- Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)
More on levels and requirements
- CMMC Level 1 Self-Assessment: Requirements and Steps
- CMMC Level 2 Self-Assessment vs C3PAO Certification
- CMMC Levels and Controls: How Many Each Level Has
- CMMC Level 1 Requirements: All 15 Controls Listed
- What Is CMMC Level 2? Requirements, Self vs C3PAO
- What Is CMMC Level 3? Requirements and Who Assesses It
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.