What are the CMMC levels?

The current three (3) CMMC 2.0 levels are:

• CMMC 2.0 Level 1: Basic Safeguarding of FCI
• Annual self-assessment and annual affirmation of compliance with the 15 security requirements in FAR clause 52.204-21.
• CMMC 2.0 Level 2: Broad Protection of CUI
• Either a self-assessment or a C3PAO assessment every three years, as specified in the solicitation.
• Decided by the type of information processed, transmitted, or stored on the contractor or subcontractor information systems.
• Annual affirmation verifying compliance with the 110 security requirements in NIST SP 800-171 Revision 2.
• CMMC 2.0 Level 3: Higher-Level Protection of CUI Against Advanced Persistent Threats
• Successfully demonstrate conformity with CMMC 2.0 Level 2.
• Undergo an assessment every three years by the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).
• Provide an annual affirmation verifying compliance with the 24 identified requirements from NIST SP 800-172.