Don’t budget for CMMC Level 2 just because your company works in the Defense Industrial Base. Your required level depends on the DoD solicitation, contract, or subcontract flow-down. It also depends on whether you handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Some opportunities require Level 1. Some require Level 2. Some do not yet include an applicable CMMC clause.
What Is CMMC? CMMC means Cybersecurity Maturity Model Certification. It is the DoD framework for checking that contractors protect FCI and CUI. It is not one universal certification. Level 1 includes 17 practices. Level 2 aligns with 110 NIST SP 800-171 controls. Start by mapping your data, systems, and contract clauses. Then define scope and fund a compliance program.
Does CMMC apply to your DoD opportunity?
CMMC applies when a DoD solicitation, contract, or subcontract flow-down requires it. The requirement applies to the information your company handles.
Start with three possible answers: no FCI or CUI and no applicable clause, FCI only, or CUI. Discuss Level 1, Level 2, assessment dates, or security tools only after this review.
A company may fall outside the immediate requirement if it does not receive, create, store, or process FCI or CUI and has no applicable CMMC clause.
This can happen when a subcontractor sells commercial off-the-shelf goods and lacks access to contract files, drawings, schedules, or technical data.
FCI only versus actual CUI
FCI is information created for the government or given by the government under a contract. It is not meant for public release.
CUI is more sensitive unclassified government information. Laws, rules, or government policy require safeguards or handling controls for it. CUI usually triggers the Level 2 discussion.
The data type drives the first CMMC decision.
CMMC levels link data to assessments
CMMC levels link protected data to a security baseline and assessment method. Level 1 covers FCI. Level 2 covers CUI. Level 3 applies to selected higher-priority programs.
| Level | Protected data | Baseline | Assessment route | Who assesses |
|---|
| Level 1 | FCI | 17 practices aligned to FAR 52.204-21 | Annual self-assessment and affirmation | The contractor |
| Level 2 | CUI | 110 NIST SP 800-171 requirements | Self-assessment or third-party assessment | Contractor or authorized C3PAO |
| Level 3 | Selected high-priority CUI | Level 2 plus selected NIST SP 800-172 controls | Government assessment | DoD assessors |
The Supplier Performance Risk System, or SPRS, records certain contractor assessment information. An NIST SP 800-171 score may be submitted under DFARS 252.204-7019 and DFARS 252.204-7020. That score is not a CMMC certification.
Level 3 serves selected acquisitions with greater risk from advanced threats. The DoD decides when those extra safeguards are needed, and DoD assessors conduct the assessment.
Assessment routes differ by level and procurement.
CMMC becomes an obligation through acquisition language. It does not become mandatory through a sales presentation or customer conversation.
A contract review sequence that works
- Find the stated CMMC level and assessment type in the solicitation or contract.
- Identify clauses in the prime contract and each subcontract flow-down.
- List every FCI and CUI data flow. Include portals, email, cloud storage, backups, and managed services.
- Ask the contracting contact or prime contractor to clarify unclear data markings in writing.
A formal assessment may be too early if the opportunity lacks a confirmed CMMC clause or if the company cannot identify whether it will receive CUI.
Conduct a limited readiness review first. Do not book an assessment based on an assumption.
CMMC enters DoD acquisitions through contract clauses in phases. Do not assume every current opportunity has the same requirement. The CMMC program rule in 32 CFR Part 170 took effect on December 16, 2024.
DoD uses a phased contract rollout. For each bid, review solicitation instructions and evaluation sections, along with applicable DFARS clauses and every subcontract flow-down.
Then identify the required Level 1, Level 2, or Level 3 route.
The specific procurement controls the answer. DIB membership, an SPRS score, or an informal customer statement does not control it. Get written clarification from the contracting office or prime contractor when requirements remain unclear.
The clause language sets the scope. The next task is proving that your systems meet it.
Limit the CUI enclave and prove control
A smaller, well-documented CUI enclave can lower CMMC costs and disruption. Fewer assets then fall inside the assessment boundary.
Evidence assessors can verify
- An asset inventory identifies each in-scope endpoint, server, cloud service, and protection asset.
- A CUI data-flow diagram and a network boundary diagram show where protected data moves.
- A System Security Plan (SSP) explains how each NIST SP 800-171 requirement is met.
- Access reviews, vulnerability scans, patch records, training records, and test results show controls in use.
- Plans of Action and Milestones, or POA&Ms, apply only where assessment rules permit them.
Budget ranges for early scoping
For a small U.S. Contractor, initial scoping and a gap review often cost $10,000 to $35,000. This range assumes a contained enclave and outside help.
Remediation can cost $25,000 to $150,000 or more. Identity changes, managed endpoints, logging, cloud redesign, and staff time drive that range.
Level 2 C3PAO assessments often add about $20,000 to $60,000. This excludes travel and complex work across multiple sites.
A narrow CUI boundary can reduce both remediation and assessment costs.
Do not start a CMMC certification project only because your company belongs to the Defense Industrial Base. A formal assessment may not matter yet without a DoD contract, subcontract, FCI, CUI, or applicable flowed-down clause. Confirm the opportunity and data flow first.
If your team is preparing a bid, collect the clause set, data map, and current SSP before asking consultants or C3PAOs for proposals.
Your questions answered
What is the difference between NIST and CMMC?
NIST publishes cybersecurity guidance. CMMC is the DoD contract program that assesses specified requirements.
Who needs CMMC certification?
Organizations need the applicable CMMC level when a DoD contract or subcontract includes the requirement.
What is CMMC level 1?
CMMC Level 1 protects FCI through 17 practices aligned with FAR 52.204-21.
Does every level 2 contractor need a C3PAO?
No. Some Level 2 acquisitions allow self-assessments. Others require a C3PAO assessment.
How much does CMMC level 2 cost?
A limited CUI environment may need $10,000 to $35,000 for scoping. Remediation may cost $25,000 to $150,000. Add assessment fees when required.
Can we use a POA&M for missing controls?
A POA&M can document permitted gaps. It cannot replace controls forever.
How do we get CMMC certification?
Confirm the contract level and classify FCI or CUI. Define the boundary, close gaps, and complete the required assessment route.
Build a contract-led CMMC plan
CMMC planning should start with contract proof and data mapping. Do not start with a Level 2 purchase decision.
What matters most:- CMMC level follows protected data and contract clauses. It does not follow company size or DIB membership.
- Level 1 covers FCI with 17 practices. Level 2 aligns with 110 NIST SP 800-171 requirements for CUI.
- An SPRS score, self-assessment, and C3PAO certification are different evidence types.
- A tightly bounded CUI enclave can reduce remediation scope and assessment cost.
- Collect clause language and map data flows before buying tools or scheduling an assessment.
Learn more
Here are some additional resources on this subject:
