Cybersecurity is no longer just a best practice for defense contractors. It is now a contractual requirement. Since the Department of Defense (DoD) began implementing the Cybersecurity Maturity Model Certification (CMMC) in November 2025, organizations bidding on defense contracts must demonstrate the right level of cybersecurity maturity. The next major milestone arrives in November 2026, when more contracts will require third-party CMMC assessments.
Today, more than 220,000 organizations across the Defense Industrial Base (DIB) are expected to comply with CMMC requirements.
The question most contractors ask is simple:
Which CMMC level applies to my business?
This guide explains the three CMMC levels, who needs them, their requirements, and how organizations can prepare for certification.
What Are CMMC Levels?
The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense’s cybersecurity framework designed to protect sensitive government information shared with contractors.
CMMC focuses on protecting two types of information:
- Federal Contract Information (FCI)
- Controlled Unclassified Information (CUI)
CMMC 2.0 simplifies the original five maturity levels into three certification levels, making compliance easier to understand while maintaining strong cybersecurity requirements.
What Are the Three CMMC Levels?
The three CMMC levels represent increasing cybersecurity maturity.
CMMC Level 1: Foundational
Level 1 is designed for organizations that handle Federal Contract Information (FCI) but do not process Controlled Unclassified Information.
Organizations at this level must implement 15 basic cybersecurity practices based on FAR 52.204-21.
These practices include:
- Limiting system access
- Using strong passwords
- Protecting devices
- Applying software updates
- Restricting physical access
Organizations complete an annual self-assessment and submit the results through the Supplier Performance Risk System (SPRS).
Level 1 is common for suppliers, manufacturers, logistics providers, and contractors that support the DoD without handling sensitive, controlled information.
CMMC Level 2: Advanced
Level 2 applies to organizations that create, store, process, or transmit Controlled Unclassified Information (CUI).
This is expected to be the most common certification level across the Defense Industrial Base. Organizations must implement all 110 security controls from NIST SP 800-171.
These controls cover areas such as:
- Multi-factor authentication
- Encryption
- Incident response
- Vulnerability management
- Audit logging
- Risk assessments
- Configuration management
- Security awareness training
Depending on the contract, organizations must either complete an annual self-assessment or undergo an assessment by an authorized C3PAO every three years.
CMMC Level 3: Expert
Level 3 is reserved for contractors supporting the most sensitive national security programs.
Organizations must first achieve Level 2 certification before pursuing Level 3.
In addition to the 110 NIST SP 800-171 controls, Level 3 introduces enhanced security requirements from NIST SP 800-172 to defend against sophisticated cyber threats such as Advanced Persistent Threats (APTs).
Assessments are conducted by the U.S. government through the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).
Only a small percentage of defense contractors are expected to require Level 3 certification.
How Do You Know Which CMMC Level You Need?
Your required CMMC level depends on the type of information your organization handles, not the size of your business.
If your organization handles only Federal Contract Information (FCI), you will typically require Level 1.
If your contracts involve Controlled Unclassified Information (CUI), you will most likely need Level 2.
If you support highly sensitive defense programs identified by the Department of Defense, you may require Level 3.
The DoD determines the required certification level within contract solicitations, so organizations cannot choose their own level.
CMMC Rollout Timeline
The Department of Defense is introducing CMMC through a phased rollout.
Phase 1 (November 2025 to November 2026)
- Level 1 self-assessments begin.
- Eligible Level 2 self-assessments begin.
- CMMC requirements start appearing in contracts.
Phase 2 (Beginning November 2026)
- More contracts require Level 2 third-party certification through authorized C3PAOs.
Phase 3 (Beginning November 2027)
- Level 3 requirements begin appearing in selected high-security contracts.
Phase 4 (Beginning November 2028)
- CMMC becomes fully integrated into applicable DoD contracts.
CMMC Statistics Every Contractor Should Know
CMMC adoption continues to accelerate across the defense sector.
Some notable statistics include:
- More than 220,000 companies are expected to fall under CMMC requirements.
- Over 1,100 organizations have already achieved Level 2 certification.
- More than 100 authorized C3PAOs are currently available to perform assessments.
- Demand for assessments continues to grow as additional contracts include CMMC requirements.
These numbers highlight an important trend. Organizations that wait until contract award may struggle to secure assessment availability before proposal deadlines.
Top CMMC Trends in 2026
Earlier Supply Chain Requirements
Prime contractors are increasingly requiring subcontractors to demonstrate CMMC readiness before official DoD deadlines.
- Increased Assessment Demand: As more organizations pursue certification, scheduling with authorized assessors is becoming more competitive.
- Continuous Compliance: Organizations are shifting from annual compliance projects to continuous monitoring, automated evidence collection, and ongoing security validation.
- Greater Executive Involvement: CMMC is no longer viewed solely as an IT initiative. Executive leadership, legal teams, procurement, and compliance functions are increasingly involved in readiness planning.
Common CMMC Mistakes
Many organizations delay certification because they:
- Assume CMMC only applies to large contractors
- Wait until an RFP requires certification
- Underestimate documentation requirements
- Ignore continuous monitoring
- Confuse self-assessments with third-party certifications
- Delay remediation until just before an assessment
Starting early significantly reduces remediation costs and improves assessment readiness.
Best Practices for Achieving CMMC Compliance
Organizations should begin by identifying the type of federal information they handle.
Next, they should define the systems within the CMMC assessment scope, conduct a gap assessment, implement missing security controls, develop documentation such as the System Security Plan (SSP), remediate identified gaps, and maintain evidence throughout the year.
Organizations pursuing Level 2 certification should also prepare well in advance for a C3PAO assessment, as assessor availability is becoming increasingly competitive.
How Accorian Helps Organizations Achieve CMMC Readiness
Preparing for CMMC requires more than implementing cybersecurity controls. Organizations must also establish governance, maintain documentation, collect evidence, and demonstrate continuous compliance.
Accorian helps organizations:
- Identify the appropriate CMMC level
- Perform readiness and gap assessments
- Implement NIST SP 800-171 security controls
- Develop System Security Plans (SSPs) and Plans of Action and Milestones (POA&Ms)
- Prepare for C3PAO assessments
- Automate evidence collection using GORICO, Accorian’s AI-powered GRC platform
- Maintain continuous compliance across evolving DoD requirements
Whether your organization is pursuing Level 1, Level 2, or preparing for advanced cybersecurity requirements, Accorian provides end-to-end support to accelerate your CMMC journey.
