Which CMMC level do you actually need?
Primes are sending flow-down letters, consultants are quoting five figures, and half the advice online assumes you already know what CUI is. Answer a few questions and get a straight answer, plus exactly what to do next.
Question 1
Do you sell to the U.S. Department of Defense (as a prime or a subcontractor), or plan to bid?
Subcontractors count. CMMC flows down the supply chain: if your customer's contract has a CMMC requirement, your subcontract will too.
The 30-second version
- Only FCI (contract info, nothing marked) means Level 1: 17 practices, annual self-assessment plus affirmation in SPRS.
- Any CUI (drawings, specs, export-controlled data) means Level 2: all 110 NIST 800-171 requirements, and for most contracts a triennial C3PAO certification with annual affirmations.
- Most critical programs mean Level 3: Level 2 certification plus 24 enhanced requirements, assessed by the government.
- COTS-only suppliers are exempt.
Requirements are phasing into new solicitations now, self-assessments first and certifications next. The worst position in 2026 is bidding with an empty SPRS record while your competitors post scores.
CMMC changes fast, so stay current
One short email when DoD updates rules, timelines, or guidance that changes what small contractors need to do. Nothing else.
Email signup launches soon. Check back shortly.
No spam, unsubscribe anytime. We never see your assessment answers.