Question 1

Not sure which CMMC level applies to you?

Accepted Answer

Use the if/then rules below: if your organization handles Federal Contract Information (FCI) but NOT Controlled Unclassified Information (CUI), you need CMMC Level 1 (15 basic safeguarding practices, annual self-assessment). If your organization handles Controlled Unclassified Information (CUI) — e.g., technical specs, export-controlled data, sensitive program info — you need CMMC Level 2 (110 practices aligned to NIST SP 800-171, third-party assessment required for critical programs). If your organization handles CUI on high-priority DoD programs and has been explicitly identified by your contracting officer as requiring Level 3, you need CMMC Level 3 (24 additional practices on top of Level 2, government-led assessment, reserved for the most sensitive programs).

Question 2

Not sure where you land?

Accepted Answer

Book a consultation and we'll map your exposure to the right level in 30 minutes — you'll leave the call knowing exactly which CMMC level applies and what your next step is.

Which CMMC Level Applies to You?

Not sure where you land? We'll tell you.