CMMC Model, Levels, and Practice Requirements
Three levels, one on-ramp
CMMC 2.0 has three levels and no maturity processes - the 1.0-era "capability maturity levels" and process maturity scoring are gone. Each level is a set of practices (requirements) that must be implemented.
- Level 1 (Foundational): 17 practices drawn from FAR 52.204-21, protecting Federal Contract Information (FCI). Six domains (access control, identification and authentication, media protection, physical protection, system and communications protection, system and information integrity). Assessed by self-assessment with annual affirmation by a senior official.
- Level 2 (Advanced): 110 requirements aligned with NIST SP 800-171, protecting Controlled Unclassified Information (CUI), across 14 domains. Assessed by self-assessment with annual affirmation OR by a C3PAO certification assessment for prioritized acquisitions; a C3PAO certification is valid for three years.
- Level 3 (Expert): all Level 2 requirements plus a subset of enhanced requirements from NIST SP 800-172; assessed by the government (DIBCAC), not a C3PAO.
Traps
Questions frequently swap the risk driver: FCI drives Level 1, CUI drives Level 2. Remember that Level 2 is not always third-party assessed - self-assessment remains valid for non-prioritized contracts. Do not accept answer choices that describe maturity levels, capability levels, or CMMC 1.0 process scores; that model was retired. Also watch for the false claim that Level 1 requires a POA&M (it does not - all 17 practices must be met).
Rule of thumb
Map the data first, then the level: FCI → L1; CUI → L2; CUI on the most critical programs → L3. If you can identify which information type a question describes, the level usually falls out automatically.