CMMC Compliance Program

There are 5 levels of maturity expectations, primarily based on contract needs and each participating organization’s potential impact to CUI security. Each maturity level builds upon the previous level, adding additional controls for greater security.

Level 1 is for organizations with the potential to indirectly influence the CUI environment. These may include companies such as landscapers, bookkeepers, HR recruiters, and training consultants. Level 1 calls for basic cyber hygiene. There are 17 basic controls.

Level 2 is for organizations with the potential to directly influence the CUI environment. Cyber security consultants, janitorial services, document shredders, and IT service providers might fall under this category. Level 2 adds 48 NIST 800-171 controls and 7 new CMMC “intermediate” hygiene controls to the Level 1 controls.

Levels 3 and up are for organizations who store, process, or transmit CUI. They are contractually obligated to protect CUI. They administer assets within a CUI environment. Level 3 adds the remainder of NIST 800-171 Rev. 1 controls, as well as 20 CMMC “good” hygiene controls.

Level 4 and 5 require contractors to apply advanced controls to protect against Advanced Persistent Threats (APTs). Level 4 adds 11 NIST 800-171 Rev. B controls and 15 CMMC “proactive” cybersecurity controls. Level 5 adds an additional 4 NIST 800-171 Rev. B controls and 11 CMMC “advanced” cybersecurity controls. In total, Level 5 requires 171 controls.