One question
What does your business handle?
Your CMMC level is not a choice or a tier. It is set by the data your contracts put on your systems. Pick the line that describes you and land on the right path. As your contracts grow, your work here carries forward to the next level.
Federal Contract Information only
Contract documents, invoices, delivery schedules. No controlled technical data.
Level 1. 15 safeguarding requirements, self assessed once a year, filed in SPRS. Most contractors live here, and this is our 30 day flagship.
Start Level 1Controlled Unclassified Information
Controlled drawings, specs, technical data marked CUI in your contracts.
Level 2. 110 practices, valid three years with an annual affirmation. Some contracts allow a self assessment, others require certification by an independent C3PAO, your solicitation sets the track. Your Level 1 work is a head start, and we hand your assessor a ready packet.
See your Level 2 head startCUI on the highest priority programs
Programs the DoD designates as APT exposed or highest priority.
Level 3. 24 enhanced requirements assessed by the government's own DIBCAC team. Level 3 requires a Final Level 2 certification first; Levels 1 and 2 are the prerequisites, not alternatives.
Build the prerequisitesNot sure what you handle? Take the free eight question check and we will place you from your answers.