The three levels at a glance
Level 1
FCI only
17 practices · annual self-assessment
Level 2
CUI
110 NIST 800-171 controls · self or C3PAO assessment
Level 3
Critical programs
Level 2 + selected NIST 800-172 · government-led
The 14 control families
NIST SP 800-171 Rev. 2 groups its 110 requirements into 14 families:
- Access Control (22)
- Awareness & Training (3)
- Audit & Accountability (9)
- Configuration Management (9)
- Identification & Authentication (11)
- Incident Response (3)
- Maintenance (6)
- Media Protection (9)
- Personnel Security (2)
- Physical Protection (6)
- Risk Assessment (3)
- Security Assessment (4)
- System & Communications Protection (16)
- System & Information Integrity (7)
Frequently asked questions
What is CMMC?
The Cybersecurity Maturity Model Certification is the Department of Defense program that checks whether contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
Which CMMC level do I need?
Level 1 applies if you only handle FCI (17 basic practices, annual self-assessment). Level 2 applies if you handle CUI (all 110 NIST SP 800-171 controls, self-assessment or third-party C3PAO assessment). Level 3 covers a small number of high-priority programs.
What is a SPRS score?
Your NIST SP 800-171 self-assessment score, posted in the Supplier Performance Risk System. It ranges from 110 (everything implemented) down to −203.
What's the status of CMMC Phase II?
DoD suspended the Phase II rollout on July 13, 2026. Phase I requirements — self-assessments and SPRS posting — still apply. Check your contract clauses (DFARS 252.204-7012, -7019, -7020, -7021) for what applies to you.
Do I need an SSP and POA&M?
Yes. A System Security Plan describes how you meet each control; a Plan of Action & Milestones lists the gaps and when you'll close them. Both are expected at assessment.
Can CMMC Agent certify me?
No. CMMC Agent is a readiness and compliance management tool. Certification at Level 2 (where required) comes only from an authorized C3PAO.
Find your SPRS score in an afternoon
Answer plain-English questions for all 110 controls. CMMC Agent calculates your score and builds your SSP and POA&M.
Start a free self-assessmentReadiness tool — not a C3PAO. CMMC Agent does not certify compliance.