CMMC Level 1 vs Level 2 vs Level 3: Requirements, Costs, and Timelines
A side-by-side comparison of all three CMMC 2.0 maturity levels. Use this to determine which level your contracts require and what to budget.
Quick Comparison
| Feature | Level 1 | Level 2 | Level 3 |
|---|---|---|---|
| Number of Practices | 17 | 110 | 110 + 800-172 |
| Framework | FAR 52.204-21 | NIST SP 800-171 | NIST SP 800-172 |
| Assessment Type | Self-assessment | C3PAO (third-party) | DIBCAC (government) |
| Assessment Frequency | Annual | Triennial | As determined by DoD |
| MFA Required | Basic | Yes (all privileged + remote) | Yes (all access) |
| SIEM Required | No | Yes | Yes (advanced) |
| Pen Testing Required | No | Recommended | Yes |
| First-Year Cost | $5K - $15K | $50K - $500K | $500K - $3M+ |
| Annual Maintenance | $5K - $15K | $30K - $120K | $150K - $500K |
| Typical Timeline | 2 - 5 months | 9 - 20 months | 24 - 48 months |
| Data Type Protected | FCI | CUI | CUI (high-value) |
| SPRS Score Required | 110 | 110 | 110 + additional |
| POA&M Allowed | No | Yes (180 days) | Limited |
How to Determine Your Required Level
Your required CMMC level is determined by the type of information you handle and the contract requirements:
Check for DFARS 252.204-7021
This is the CMMC clause. If it is present, read the specified level. If the clause is absent, CMMC may not yet apply to your contract (but will as Phase 4 rolls out in 2028).
Identify the data type
FCI only = Level 1. CUI present = Level 2 minimum. Check your contract for CUI markings, DFARS 252.204-7012, and NIST 800-171 references.
Check for Level 3 designation
Level 3 is only required when the DoD explicitly specifies it in the solicitation. If your contract requires Level 2, you do not need Level 3.
When in doubt, ask your contracting officer
The government is responsible for specifying the required CMMC level. If the solicitation is ambiguous, request clarification before investing in certification.
Cost Comparison by Company Size
| Company Size | Level 1 | Level 2 | Level 3 |
|---|---|---|---|
| < 25 employees | $5K - $10K | $50K - $120K | $500K - $1M |
| 25 - 50 employees | $6K - $12K | $80K - $180K | $600K - $1.5M |
| 50 - 100 employees | $8K - $14K | $120K - $250K | $800K - $2M |
| 100 - 250 employees | $10K - $15K | $180K - $350K | $1M - $2.5M |
| 250+ employees | $12K - $15K | $250K - $500K+ | $1.5M - $3M+ |