Per the DoD CIO's CMMC Level Determination guidance and 32 CFR §§ 170.15–170.18, your CMMC level is determined by the type of information your contract requires you to handle. Your size, your preference, and your IT maturity do not change which level applies.
The decision flow
- Does your contract require you to process, store, or transmit CUI? If no → Level 1 (assuming you handle Federal Contract Information).
- If yes — is the CUI in the NARA CUI Registry's Defense Organizational Index Grouping (OIG)?
- No (CUI is in the NARA Registry but not in the Defense OIG) → Level 2 (Self-Assessment) is the minimum.
- Yes → Level 2 (Certification) by a C3PAO is the minimum.
- Does the DoD Program Manager identify the CUI as especially critical, requiring NIST SP 800-172 protections? If yes → Level 3 (Certification) by DCMA DIBCAC is required, in addition to maintaining Final Level 2 (C3PAO) status for the same scope.
Side-by-side comparison
| Item | Level 1 | Level 2 (Self-Assessment) | Level 2 (Certification) | Level 3 (Certification) |
|---|---|---|---|---|
| Triggered by | FCI handling | CUI in NARA Registry, not in Defense OIG | CUI in NARA Registry's Defense OIG | DoD-designated critical CUI; NIST 800-172 applies |
| Standard | FAR 52.204-21 (17 practices) | NIST SP 800-171 Rev 2 (110 practices) | NIST SP 800-171 Rev 2 (110 practices) | 110 NIST 800-171 practices + 24 enhanced practices from NIST SP 800-172 |
| Conducted by | OSA (self) | OSA (self) | C3PAO (independent) | DCMA DIBCAC |
| Affirmation required | Yes, annually by senior official, in SPRS | Yes, annually by senior official, in SPRS | Yes, annually after certification, in SPRS | Yes, annually after certification, in SPRS |
| Prerequisite | None | None | None | Final Level 2 (C3PAO) status for the same scope, with all POA&M items closed |
| Asset categories in scope | L1 scope per L1 Scoping Guidance | 5 categories per L2 Scoping Guide | 5 categories per L2 Scoping Guide | 4 categories per L3 Scoping Guide (no CRMAs) |
Where Phase 1 implementation matters
Per the DoD CIO CMMC page (current as of May 2026), CMMC Phase 1 Implementation runs from Nov 10, 2025 through Nov 9, 2026 and focuses primarily on CMMC Level 1 and Level 2 self-assessments. Contractors should not interpret "Phase 1" as a grace period — the requirement to know your level, perform the assessment, and affirm in SPRS applies now where the relevant DFARS clauses are in the contract.
How to actually determine your level
- Read the DFARS clauses in your contract. 252.204-7012 indicates CUI handling; 252.204-7019 / 7020 / 7021 are CMMC-related clauses signaling level requirements.
- Identify the specific CUI categories. Ask your contracting officer or program manager to confirm whether the information falls in the NARA CUI Registry, and whether it is in the Defense OIG.
- Check for L3 designation. L3 is identified on the contract by the DoD Program Manager based on criticality.
- Document the determination. The level determination decision should be part of your SSP, with the contractual basis cited.
Common errors
- Self-selecting a lower level to reduce cost. If your CUI is in the Defense OIG, L2 Self-Assessment is not sufficient regardless of contractor preference.
- Treating Phase 1 as a deferral. Phase 1 sequences the rollout; it does not waive the requirement for contracts that already include CMMC clauses.
- Confusing FCI handling with CUI handling. FCI is broader (any non-public contract information); CUI is narrower (categories defined in the NARA Registry). Level 1 covers the FCI floor; CUI requires Level 2.