Which CMMC level do I need?
The level follows the information a contract puts on your systems and the clause that names it. Answer five questions and the finder gives the level 32 CFR 170 and DFARS 252.204-7021 point to, who assesses it, and what binds today while the third-party requirement is suspended. Every rule was read on 2026-10-23.
The tool: Which CMMC level do I need?
CMMC level finder, cuideck.com
Answer for one contract at a time; the answer box updates as you go. Pre-filled with a CNC shop machining parts to a prime's prints. Example only
So farLevel 2 (C3PAO)Suspended for nowThe level the rule points to
Level 2 (C3PAO)
A certification assessment of the same 110 requirements by a C3PAO, an authorized third-party assessor, repeated every three years, with an annual affirmation in SPRS.
Why this level
- CUI flows to you and the prime contract requires Level 2 (C3PAO): Level 2 (C3PAO) is your minimum. 32 CFR 170.23(a)(3)
- Level 2 (Self) on the same scope also satisfies Level 1 (Self). 32 CFR 170.16(a)
- Your contract's 252.204-7021 names Level 2 (C3PAO): you must hold that level, or higher, on every system that touches the FCI or CUI. DFARS 252.204-7021(d)(1)(i)
Check before you build
- NoteDrawings and technical data marked with Distribution Statement B to F are controlled technical information, a CUI category (banner CUI//SP-CTI). DFARS 252.204-7012(a); CUI Registry
The answer box applies this record to your case. It is the one place the program's status is kept, so when it changes, every answer above changes with it.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Contracts may require CMMC Level 1 (Self) or Level 2 (Self): your own assessment, scored and entered in SPRS, with a senior official's affirmation. Class Deviation 2026-O0025 Rev 3; 32 CFR 170.15, 170.16
- The CMMC rule itself, 32 CFR Part 170, is unchanged since it took effect on 2024-12-16. eCFR, 32 CFR Part 170
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Existing contracts that carry CMMC requirements have them removed at the next option period or the next scheduled administrative modification. Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
- DoD's 2026 Regulatory Plan lists an interim final rule amending 32 CFR Part 170 (RIN 0790-AM01) to set a deadline and transition from NIST SP 800-171 Rev 2 to Rev 3. It was timetabled for July 2026 and has not been published as of 2026-10-23. 91 FR 52824
- Class Deviation 2026-O0025, Revision 3 (DFARS part 240), read 2026-10-23
- DFARS 252.204-7012, -7019, -7020, -7021 (acquisition.gov), read 2026-10-23
- 32 CFR Part 170 (eCFR), read 2026-10-23
- Federal Register 2026-16603, 2026 Regulatory Plan (RIN 0790-AM01), read 2026-10-23
- Federal Register: CMMC documents, read 2026-10-23
Who sets your CMMC level
You do not choose a CMMC level, and neither does your consultant. The DoD program office picks one for each contract by the kind of information the work puts on your systems, federal contract information (FCI) or controlled unclassified information (CUI), and the contracting officer writes it into the blank in DFARS 252.204-7021. If you are not sure which of the two you hold, start with FCI vs CUI; the finder asks the same question in shop terms.
Below the prime, Part 170 stops leaving it to judgment. Four sentences decide every subcontractor's minimum, and the prime must flow the right one down to every tier that touches FCI or CUI:
Two things in that text catch shops out. A sub on a Level 3 program is not asked for Level 3: its floor is Level 2 (C3PAO). And the word is minimum: a prime may still write a higher level into your subcontract, and the clause you sign is the one that binds.
How to use the level finder
- 1Pick your seatPrime, sub, service provider or off-the-shelf seller. The rule reads the same facts differently for each.
- 2List what lands on your systemsNot what the company holds in general: what this contract puts on your laptops, shares, email and machines.
- 3Read the clauses, not the cover letterSearch the subcontract or PO for 52.204-21, 7012, 7019, 7020 and 7021. The level is whatever is written in the 7021 blank.
- 4Ask upstream once, in writingA sub's minimum depends on the prime's level. One email to the buyer settles it and gives you a record.
- 5Read the answer with today's dateThe answer box splits the level the rule points to from what applies today, because the two differ while Phase 2 is suspended.
Two cases the questions handle on their own: a service provider gets no level of its own (its services are assessed inside the client's scope), and an order solely for off-the-shelf catalog items falls outside the clause. Then use the scoping worksheet to draw the line around the systems the level applies to.
Five shops, five answers
The same machine shop can need two different levels on two programs, because the level belongs to the contract, not the company. Run through the finder, a typical supply chain comes out like this:
| Shop | What lands on its systems | Paperwork | Level | Today |
|---|---|---|---|---|
| Sheet-metal job shop, subcontractor | Purchase orders and delivery schedules | FAR 52.204-21; 7021 names Level 1 (Self) | Level 1 (Self) | In forceYearly self-assessment and affirmation in SPRS |
| CNC shop, subcontractor | Prints marked Distribution Statement D, plus the POs | 7012, 7019, 7021 names Level 2 (Self); prime at Level 2 (Self) | Level 2 (Self) | In force7012 now, and a current score in SPRS |
| The same CNC shop, second program | The same kind of prints | 7012, 7021 names Level 2 (C3PAO); prime at Level 2 (C3PAO); contract held | Level 2 (C3PAO) | SuspendedRemoved at the next option or administrative modification; 7012 still binds |
| MSP running the CNC shop's firewall and log server | Logs and configuration data only, no CUI | The shop's contract | None of its own | In the shop's scopeAssessed as Security Protection Assets inside the shop's assessment |
| Fastener distributor | Catalog items sold unmodified | Order solely for off-the-shelf items | No CMMC level | Outside the clauseNo CMMC clause on a solely off-the-shelf order |
The third row is the one most shops are living with this autumn: a level written into a signed contract that the rules in force no longer let a contracting officer add. Do not drop the work on the strength of a news story. Ask the contracting officer in writing, keep building to the 110 requirements, and keep your SPRS score current.
Where the level sits in your paperwork
A solicitation that will carry the CMMC clause also carries the notice at 252.204-7025, so you see the level before you bid. In the contract itself, look for paragraph (d)(1)(i) of 252.204-7021. The level is the only blank in it:
The clause then defines seven statuses that can satisfy those four levels. Conditional means you passed with open items on a POA&M, which must close within 180 days of the Conditional status date. Level 1 has no Conditional: award needs a Final Level 1. New to the program? What CMMC compliance means sets out the levels and who assesses each.
- Final Level 1 (Self)
- Conditional Level 2 (Self)
- Final Level 2 (Self)
- Conditional Level 2 (C3PAO)
- Final Level 2 (C3PAO)
- Conditional Level 3 (DIBCAC)
- Final Level 3 (DIBCAC)
Filled square: Final. Open square: Conditional, with a POA&M open. From DFARS 252.204-7021(a).
The clause travels. A prime must put its substance into every subcontract that will hold FCI or CUI, commercial ones included, off-the-shelf orders excepted 7021(f)(1), and check before award that the sub holds a current status at the level its information calls for 7021(f)(2). That check is why a prime's buyer asks you for proof of a current status before it signs your PO. Our guide to entering a score in SPRS covers where the status lives.
What binds whatever CMMC's status
The suspension changes which assessments a contract can demand. It does not touch the safeguarding clauses that sit beside the CMMC clause, and Part 170 says so in terms:
So a shop holding drawings under DFARS 252.204-7012 owes NIST SP 800-171 Rev 2 today, whatever level the finder shows and whatever the Task Force decides. The Level 2 requirements are the same 110 either way; only who checks them is in question.
Questions shops ask about CMMC levels
What are the CMMC levels?
Three levels, which a contract names as one of four statuses. Level 1 is the 15 basic safeguarding requirements of FAR 52.204-21(b)(1)(i)–(xv). Level 2 is the 110 security requirements of NIST SP 800-171 Rev 2, either self-assessed, Level 2 (Self), or certified by a C3PAO, Level 2 (C3PAO). Level 3 adds 24 requirements selected from NIST SP 800-172, assessed by DCMA DIBCAC.
We only machine parts to a print. Do we really need Level 2?
Look at the title block. A drawing marked with Distribution Statement B to F is controlled technical information, a CUI category, and a subcontractor that will hold CUI needs Level 2 (Self) at minimum. If all you receive is the PO and a delivery date, that is FCI and Level 1 (Self). Not sure which you hold? Run a document through Is it CUI?
Our prime flowed down Level 2 (C3PAO), but Phase 2 is suspended. What do we do?
Read the rule and the status separately. Under 32 CFR 170.23(a)(3), a sub holding CUI under a Level 2 (C3PAO) prime needs Level 2 (C3PAO). Under Class Deviation 2026-O0025 Rev 3, that requirement is being taken out of contracts. Ask the prime in writing whether its own contract has been modified, keep meeting DFARS 252.204-7012, and keep your SPRS score current, so you are ready whichever way the Task Force lands. If the prime still wants a certificate anyway, a C3PAO is the only route to one. The Cyber AB said on 2026-07-15 that only the Phase 2 requirements were suspended and that C3PAO Level 2 certification assessments remain available. The class deviation is silent on voluntary assessments, so ask the C3PAO what it is booking now and what status it will enter in eMASS.
Does ITAR data put us at a higher level?
ITAR does not set a CMMC level. But Export Controlled is a CUI category that names the ITAR, so technical data you receive or create for a DoD contract counts as CUI, and Level 2 is your floor. ITAR registration is a separate duty: a manufacturer who does not export must nevertheless register with DDTC. See ITAR registration.
Does our MSP or cloud provider need its own CMMC certification?
Not by itself. A provider that holds your CUI or your security data is assessed inside your scope, at your level; it may volunteer for its own assessment to save its clients effort. A cloud service that holds CUI must be FedRAMP Moderate or equivalent. Compare the options in MSPs that run CMMC for small shops.
Can one company hold two levels?
Yes. The clause asks for the level on the information systems that handle the contract's FCI or CUI, and SPRS gives each assessed system its own identifier. That is how an enclave works: the CUI sits inside a small boundary assessed at Level 2, and the rest of the business stays at Level 1. See CMMC enclaves.
Is there a Conditional Level 1?
No. Level 1 is MET or NOT MET in its entirety; no POA&M is permitted for Level 1, and award needs a Final Level 1 (Self). Conditional statuses exist only at Level 2 and Level 3.
Still unsure which level a bid needs? Most of the answer is in the paperwork: read CMMC requirements for small businesses next, then score yourself with the SPRS score calculator.