CMMC Levels 1 & 2.

The three levels

• Level 1 (Foundational) — 17 controls protecting Federal Contract Information (FCI). Annual self-assessment.
• Level 2 (Advanced) — 110 controls protecting Controlled Unclassified Information (CUI). Triennial C3PAO assessment for most contracts.
• Level 3 (Expert) — Level 2 + advanced threat protection. DIBCAC assessment.

Who needs which level

If your DoD contract clauses include only FAR 52.204-21, Level 1 likely covers you. If your contract includes DFARS 252.204-7012 and you handle CUI, you are looking at Level 2.

Most DoD-adjacent SaaS we work with land at Level 2 — and the lift between Level 1 and Level 2 is significant. We help you scope honestly before you commit.

Our CMMC engagement

• NIST SP 800-171 control mapping against your current implementation.
• CUI scoping & enclave design (often the most expensive decision in the engagement).
• System Security Plan (SSP) authoring — the document the assessor reads first.
• Plan of Actions & Milestones (POA&M) for permitted exceptions.
• Pre-assessment readiness review and C3PAO coordination.

A note on CUI enclaves

The single biggest cost driver in a CMMC L2 engagement is whether your CUI lives in your production environment or in a purpose-built enclave (GCC High, AWS GovCloud, etc.). We scope this decision in week one — getting it wrong costs six-figure remediation later.