---
title: "CMMC 2.0 overview: levels, assessments and what primes expect"
canonical: "https://teamingindex.com/knowledge/cmmc-2-0-overview"
lastReviewed: "2026-11-08"
markdown_url: "https://teamingindex.com/knowledge/cmmc-2-0-overview.md"
topic: "CMMC & cybersecurity"
summary: "What each CMMC level requires, who performs the assessment, how long a status lasts, and how CMMC flows down to subcontractors under 32 CFR Part 170."
---
# CMMC 2.0 overview: levels, assessments and what primes expect

> What each CMMC level requires, who performs the assessment, how long a status lasts, and how CMMC flows down to subcontractors under 32 CFR Part 170.

- Topic: CMMC & cybersecurity
- Last reviewed: 2026-11-08
- Canonical URL: https://teamingindex.com/knowledge/cmmc-2-0-overview

The Cybersecurity Maturity Model Certification (CMMC) program is how the Department of Defense verifies that contractors actually protect the information it shares with them. The program rule is **32 CFR Part 170**. A separate DFARS rule, effective November 10, 2025, puts CMMC requirements into solicitations and contracts through the clause at **DFARS 252.204-7021** and the solicitation provision at **DFARS 252.204-7025**. The level a contract requires is stated in the solicitation, and the requirements are being phased in over four annual phases (see the [CMMC phase-in timeline](https://teamingindex.com/knowledge/cmmc-phase-in-timeline)).

CMMC protects two kinds of information. **Federal Contract Information (FCI)** is information not intended for public release that is provided by or generated for the Government under a contract (FAR 52.204-21). **Controlled Unclassified Information (CUI)** is information that a law, regulation or Government-wide policy requires to be safeguarded (32 CFR Part 2002). The more sensitive the information, the higher the level.

## The three levels at a glance

| Level | Protects | Requirements | Assessment | How often |
| --- | --- | --- | --- | --- |
| Level 1 | FCI | The 15 basic safeguarding requirements of FAR 52.204-21 | Self-assessment | Every year, with an annual affirmation |
| Level 2 | CUI | The 110 requirements of NIST SP 800-171 Revision 2 | Self-assessment or a certification assessment by a C3PAO, as the solicitation specifies | Every 3 years, with annual affirmations |
| Level 3 | CUI in the highest-priority programs | Level 2 plus 24 selected requirements from NIST SP 800-172 | Government assessment by DCMA's DIBCAC, after a Final Level 2 (C3PAO) status | Every 3 years, with annual affirmations |

Two details trip people up. First, CMMC Level 2 is built on **Revision 2** of NIST SP 800-171 (32 CFR 170.14), even though NIST published Revision 3 in 2024. Second, "Level 2" alone is incomplete: a solicitation asks for either **Level 2 (Self)** or **Level 2 (C3PAO)**, and only the second is a third-party certification.

## Who does the assessing

- **The contractor** performs Level 1 and Level 2 self-assessments and enters the results in the Supplier Performance Risk System (SPRS).
- **A C3PAO** (CMMC Third-Party Assessment Organization) performs Level 2 certification assessments. C3PAOs are authorized by the Cyber AB, the accreditation body DoD recognizes under 32 CFR Part 170.
- **DIBCAC**, the Defense Industrial Base Cybersecurity Assessment Center within the Defense Contract Management Agency, performs Level 3 assessments.

Every assessment is followed by an **affirmation** from a senior official of the company (the Affirming Official) that the company meets and will keep meeting the requirements (32 CFR 170.22). Affirmations are repeated every year and after any POA&M closeout.

## Final and Conditional status

An assessment can end in **Final** status (all requirements met) or, at Levels 2 and 3, **Conditional** status: the score cleared the minimum and the few remaining gaps are allowed on a Plan of Action and Milestones (POA&M) that must be closed within 180 days (32 CFR 170.21). Level 1 never allows a POA&M. The details matter for teaming, so they have [their own guide](https://teamingindex.com/knowledge/cmmc-final-vs-conditional-status).

## How CMMC flows down to subcontractors

Primes must flow CMMC requirements to subcontractors whose work involves FCI or CUI (32 CFR 170.23). The minimum depends on the information the subcontractor handles and on the prime's own requirement:

| The subcontractor will handle | The prime's requirement is | Minimum status for the subcontractor |
| --- | --- | --- |
| FCI only | Any level | Level 1 (Self) |
| CUI | Level 2 (Self) | Level 2 (Self) |
| CUI | Level 2 (C3PAO) | Level 2 (C3PAO) |
| CUI | Level 3 (DIBCAC) | Level 2 (C3PAO) |

That last row surprises many teams: a Level 3 prime does not automatically need Level 3 subcontractors, but every subcontractor that touches CUI needs a third-party Level 2 certification.

## What primes expect from partners

When a prime vets you for a DoD pursuit, expect questions that go beyond "are you CMMC compliant?":

- [ ] Which of your information systems will process FCI or CUI (your assessment scope), and do they match the work you are bidding?
- [ ] Your exact status: level, assessment type, Final or Conditional, status date and expiration date
- [ ] The CMMC Unique Identifier (UID) recorded in SPRS for each assessed system
- [ ] When your last affirmation was filed and when the next one is due
- [ ] Whether cloud services that store CUI meet the FedRAMP Moderate baseline or equivalent required by DFARS 252.204-7012
- [ ] A current system security plan (SSP) for Level 2 scopes, which you describe but never hand over in a teaming portal

> **Pitfall:** Calling a self-assessment a "certification." Only C3PAO and DIBCAC assessments are certification assessments. Primes, contracting officers and your own representations treat the two very differently.

## Common pitfalls

- **Scoping by accident.** Systems that store, process or transmit CUI, and the systems that protect them, are in scope. Moving CUI into an unassessed system breaks your status for that work.
- **Letting affirmations lapse.** The annual affirmation is part of keeping a status current. Put it on the same calendar as your SAM.gov renewal.
- **Waiting for the solicitation.** A C3PAO assessment takes planning and scheduling. If the target contract will require Level 2 (C3PAO), start readiness work well before the RFP.
- **Assuming commercial work is exempt.** Contracts and orders solely for commercially available off-the-shelf (COTS) items are excluded, but commercial services and modified commercial items are not.

## How TeamingIndex helps

- Filter partners by minimum level and assessment type: [CMMC Level 2 (C3PAO) partners](https://teamingindex.com/directory?cmmc=L2C3PAO), or add [verified credentials only](https://teamingindex.com/directory?cmmc=L2C3PAO&verified=1).
- Every CMMC badge shows Final or Conditional status, the closeout and expiration dates, and who vouches for it (self-attested or verified by TeamingIndex).
- The [Team Builder](https://teamingindex.com/teams) checks each partner against the CMMC gate you set for a pursuit, using the flowdown rules above: on a Level 3 pursuit, subcontractors are checked for Final Level 2 (C3PAO). It assumes every subcontractor will handle CUI; one that handles FCI only needs just Level 1 (Self), so read a CMMC gate result for that partner with this in mind.
- Record your own status, affirmation dates and CMMC UID on your [compliance dashboard](https://teamingindex.com/dashboard/compliance). Your UID is shown only to you, platform admins and partners with a recorded mutual NDA.

## Official sources

- [32 CFR Part 170: Cybersecurity Maturity Model Certification (CMMC) Program](https://www.ecfr.gov/current/title-32/part-170)
- [DoD CIO: Cybersecurity Maturity Model Certification](https://dodcio.defense.gov/CMMC/)
- [DFARS 252.204-7021: Contractor Compliance with the CMMC Level Requirements](https://www.ecfr.gov/current/title-48/section-252.204-7021)
- [DFARS 252.204-7025: Notice of CMMC Level Requirements](https://www.ecfr.gov/current/title-48/section-252.204-7025)
- [FAR 52.204-21: Basic Safeguarding of Covered Contractor Information Systems](https://www.acquisition.gov/far/52.204-21)

Not legal advice. TeamingIndex guides are general information to help you plan, not legal advice. Regulations, clauses and program rules change and solicitations can tailor them: always work from the current regulation and the clauses in your solicitation, and confirm decisions with your contracting officer or counsel.