CMMC Levels determine what your business needs to stay eligible for Department of Defense (DoD) contracts. If you’ve been told you need to be “CMMC compliant,” your next question should be: Which level applies to us?
The Cybersecurity Maturity Model Certification (CMMC) isn’t a blanket requirement. It’s a tiered framework designed to match cybersecurity standards with the sensitivity of information a business handles. In other words, a small manufacturer in Wisconsin won’t have the same requirements as a defense contractor supporting high-level R&D—and that’s the point.
That’s why this guide breaks down the three CMMC levels, what they mean for your business, and most importantly, how to figure out where you fit.
What Are the 3 CMMC Levels?
Altogether, CMMC 2.0 includes three certification levels. Each level is tied to the type of federal data you work with and your role in the Department of Defense (DoD) supply chain.
Level 1: Foundational
- Who it’s for: Companies that only handle Federal Contract Information (FCI)—basic information related to government contracts that isn’t publicly available.
- Requirements: 17 basic cybersecurity practices, including user access controls, software updates, and device tracking.
- Data Type: Federal Contract Information (FCI)
- Assessment: Annual self-assessment.
- Example: A regional logistics provider that ships parts under a DoD contract but does not access sensitive files.
Level 2: Advanced
- Who it’s for: Any business that handles Controlled Unclassified Information (CUI)—confidential but unclassified technical data, drawings, formulas, and more.
- Requirements: 110 practices based on NIST SP 800-171, including stricter encryption, multifactor authentication, and regular audits.
- Data Type: Controlled Unclassified Information (CUI)
- Assessment: In most cases, organizations will require a third-party assessment from a certified C3PAO (Certified Third Party Assessment Organization).
- Example: A machining firm in Marinette receiving CAD files from a prime defense contractor.
Level 3: Expert
- Who it’s for: Businesses that work directly on high-value, mission-critical DoD programs or projects related to national security.
- Requirements: Extensive safeguards aligned with NIST SP 800-172, including advanced continuous monitoring and proactive threat detection.
- Data Type: High-value CUI, national security-related work
- Assessment: Government-led audit.
- Example: A cybersecurity provider supporting intelligence or defense strategy teams.
How to Know Which CMMC Level You Need
CMMC isn’t about the size of your company—it’s about the type of information you handle. Here’s how to start narrowing it down:
- Do you handle Controlled Unclassified Information (CUI)?
If so, you’ll likely fall under Level 2, which requires a third-party audit. - Are you part of a subcontractor chain where others handle CUI?
Even then, if you don’t store or transmit it yourself, you may still fall under Level 2 if your systems interact with those that do. - Do you only access FCI and nothing sensitive?
In that case, level 1 may apply—but you’ll still need to show documentation and follow cybersecurity best practices. - Are you supporting sensitive national security or classified work?
If so, Level 3 may apply, though this is rare among small and mid-sized businesses
Why Getting Your Level Right Matters
Choosing the wrong level—or avoiding it altogether—can lead to real consequences:
- You may be disqualified from submitting bids on future contracts.
- Your existing clients may ask for proof of compliance before renewal.
- You risk exposing sensitive data, resulting in reputational and legal fallout.
Ultimately, understanding your level upfront helps you prepare, plan, and keep opportunities open.
Final Thoughts
Understanding the CMMC levels gives your business the clarity to move forward with confidence. Moreover, it helps ensure you’re bidding on the right contracts, protecting the data you handle, and staying aligned with growing compliance expectations in the defense industry.
For example, smaller teams that fall under Level 1 can prevent unnecessary spending and stress. Meanwhile, companies handling CUI may need to adopt more advanced controls—but knowing where you stand allows you to make smart decisions about time, tools, and budget. Either way, identifying your level early keeps your business competitive and ready.
At M2 Technology, we believe in simplifying complex requirements through real conversations. We’ve helped Wisconsin businesses—from machine shops to managed service providers—understand what’s required, build their System Security Plans, and prepare for audits step by step.
Need support figuring out where your organization stands? No matter your size or industry, we’re here to guide you through it. After all, every successful partnership starts with understanding—and that’s where we come in.