CMMC FAQ

CMMC FAQ: Levels, CUI, POA&Ms and the System Security Plan

Short, sourced answers to the questions contractors ask most about the CMMC Program, as set out in 32 CFR Part 170. Follow the links for full guides.

By Doug Majewski, President, Athena Consulting Group, LLC · Last reviewed: October 21, 2026

Free CMMC self-assessment Free CMMC scoping tool

CMMC levels

CMMC has three levels. Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21(b)(1) and protects Federal Contract Information (FCI). Level 2 covers the 110 requirements of NIST SP 800-171 Rev. 2 and protects CUI. Level 3 adds selected requirements from NIST SP 800-172 and is assessed by DCMA DIBCAC (32 CFR 170.18).

See CMMC levels explained.

Controlled Unclassified Information (CUI)

CUI is government information that law, regulation or policy requires you to safeguard, defined in 32 CFR Part 2002 and listed in the CUI Registry. If you handle CUI, you generally need Level 2. See What is CUI?

POA&Ms

A Plan of Action and Milestones records unmet requirements and how you will close them. For Level 2, 32 CFR 170.21 allows a POA&M only with a score of at least 88, and only for eligible items; it must be closed within 180 days of the Conditional CMMC Status Date. See What is a POA&M?

System Security Plan (SSP)

The SSP describes your system boundary, environment and how each requirement is implemented. It is required by NIST SP 800-171 requirement 3.12.4, which is never POA&M-eligible, so a Level 2 assessment cannot be completed without one. See System Security Plan guide.

Frequently asked questions

How many CMMC levels are there?

Three. Level 1 (15 FAR 52.204-21 requirements), Level 2 (110 NIST SP 800-171 Rev. 2 requirements) and Level 3 (Level 2 plus selected NIST SP 800-172 requirements).

Which CMMC level do I need?

Your contract decides. FCI only generally means Level 1; CUI generally means Level 2, either self-assessment or C3PAO assessment as the solicitation specifies. Level 3 is required only for selected programs.

Can Level 1 use a POA&M?

No. Level 1 requires all 15 requirements to be met; POA&Ms are not permitted for Level 1.

What is CUI?

Controlled Unclassified Information is information the government creates or possesses, or that a contractor handles for it, that requires safeguarding under law, regulation or government-wide policy, as defined in 32 CFR Part 2002.

Is FCI the same as CUI?

No. FCI is information provided by or generated for the government under a contract and not intended for public release. CUI is a narrower category with specific safeguarding requirements. FCI is protected at Level 1; CUI at Level 2.

When is a POA&M allowed at Level 2?

Under 32 CFR 170.21 the score must be at least 88 of 110, only 1-point requirements may be on the POA&M (plus 3.13.11 when encryption is used but not FIPS-validated), and 3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4 and 3.10.5 are never eligible.

How long do I have to close a POA&M?

180 days from the Conditional CMMC Status Date. A closeout assessment must confirm the items are met.

Do I need a System Security Plan?

Yes for Level 2. Requirement 3.12.4 requires an SSP, and it cannot be placed on a POA&M.

What goes in an SSP?

The system boundary, environment of operation, how each requirement is implemented, and connections to other systems. Keep it current and consistent with your evidence.

Can Athena certify me?

No. Athena Consulting Group helps you prepare. Level 2 certification assessments are performed by authorized C3PAOs and Level 3 by DCMA DIBCAC.