The three levels side by side
| Level | Protects | Requirements | Assessment | POA&M |
|---|---|---|---|---|
| Level 1 | FCI | 15 from FAR 52.204-21(b)(1) | Annual self-assessment (170.15) | Not allowed |
| Level 2 | CUI | 110 from NIST SP 800-171 Rev. 2 | Self-assessment or C3PAO assessment every 3 years, as the contract states (170.16, 170.17) | Allowed for eligible items (170.21) |
| Level 3 | CUI on highest-priority programs | Final Level 2 (C3PAO) status plus 24 from NIST SP 800-172 | DCMA DIBCAC every 3 years (170.18) | Allowed for eligible items (170.21) |
Which level do I need?
Look at the contract. If you only handle FCI, it is Level 1. If you handle CUI, it is Level 2. Level 3 applies only when DoD designates it for a program. See Level 1 vs Level 2.
Current status
DoD suspended the Phase 2 transition on 13 July 2026. During the suspension, requirements may designate only Level 1 (Self) or Level 2 (Self). See current CMMC status.