CMMC Model and Assessment Levels
The Model and Assessment Levels domain tests the three levels, what each one requires, how each is assessed, and how long results last. Most items ask you to match a scenario to the correct level and the correct assessment method.
The three levels
- Level 1 (Foundational): 17 practices drawn from FAR 52.204-21, protecting Federal Contract Information (FCI). Assessed by annual self-assessment plus an annual affirmation by a senior official.
- Level 2 (Advanced): all 110 requirements of NIST SP 800-171, protecting Controlled Unclassified Information (CUI). Cumulative - it includes the Level 1 practices. Two paths: annual self-assessment for non-prioritized acquisitions, or a C3PAO certification assessment every three years for prioritized acquisitions, with annual affirmation in between.
- Level 3 (Expert): Level 2 plus a selected subset of the enhanced requirements in NIST SP 800-172 (24 requirements in the final rule), for the most critical programs. Assessed by DIBCAC every three years with annual affirmation.
Rules that decide answers
- DoD, not the contractor, specifies the required level in the solicitation.
- Certification is entity-wide for the defined assessment scope, not issued per contract.
- Affirmation is an annual, binding statement by a senior official recorded in SPRS.
- A limited POA&M can support a conditional Level 2 certification, with open items closed inside a defined window (180 days). Level 3 offers no such path.
Worked example
A company handles CUI on a contract DoD designated non-prioritized. Required level: Level 2. Assessment method: annual self-assessment with affirmation, no C3PAO. If the same work sat on a prioritized contract, the identical 110 requirements would apply, but a C3PAO would have to certify every three years. Prioritization changes the assessment method, never the requirement count.
Traps that cost marks
- Believing Level 2 covers only CUI and skips the Level 1 practices.
- Substituting a self-assessment where the clause demands certification.
- Forgetting the annual affirmation between triennial assessments.
- Confusing FCI (Level 1) with CUI (Level 2 and above).
- Assuming an open POA&M is ever acceptable at Level 3.