What small DoD contractors need to know about CMMC Level 1, 2, and 3 — from gap assessment through remediation — without the technical jargon.
If you're a small business contracting with the Department of Defense — or planning to — CMMC is no longer a future consideration. The Cybersecurity Maturity Model Certification (CMMC) 2.0 framework has been phased into DoD contracts, with requirements flowing down to subcontractors. Understanding which level applies to your work, what it requires, and how to get there is now a prerequisite for competing in the DoD market.
This guide explains the three CMMC levels in plain language, walks through the assessment process, and identifies the mistakes small businesses most commonly make when trying to comply. It's not a technical implementation guide — it's an introduction for business owners and BD leaders who need to understand what CMMC means for their pursuit strategy and federal proposals.
The Cybersecurity Maturity Model Certification is a DoD framework that verifies defense contractors have implemented adequate cybersecurity controls to protect sensitive government information. It was created in response to repeated, high-profile data breaches targeting DoD supply chain contractors who were handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) without adequate protections.
CMMC 2.0 (the current version) consolidates five original maturity levels into three, and aligns directly with NIST SP 800-171 cybersecurity standards. The key distinction from previous self-attestation regimes: some levels require third-party certification — you can no longer simply certify your own compliance and check a box on a representation.
Level 1 covers basic cyber hygiene — 17 practices drawn from FAR 52.204-21. These are the fundamentals: use antivirus, require passwords, limit access to company info, don't leave systems unattended in public. If you've been doing basic IT security, you may already meet most Level 1 requirements. Annual self-attestation is submitted to the Supplier Performance Risk System (SPRS).
Level 2 is where most small businesses encounter CMMC as a significant challenge. It requires implementation of all 110 security practices from NIST SP 800-171. This covers access control, audit logging, incident response, system and communications protection, media protection, and more. For most small businesses, achieving Level 2 requires meaningful IT infrastructure changes. Third-party assessments are conducted by CMMC Third-Party Assessment Organizations (C3PAOs) authorized by the CMMC Accreditation Body (Cyber-AB). The cost and timeline for these assessments has moderated since the initial rollout, but significant preparation is required.
Level 3 is the most rigorous tier, required for programs involving particularly sensitive CUI — typically classified or near-classified defense programs. It builds on the full Level 2 requirements and adds additional practices from NIST SP 800-172. Government assessments are conducted by DCSA (Defense Contract Security Agency), not private C3PAOs. Most small businesses do not need Level 3, but if you're pursuing programs that involve highly sensitive defense data, you'll need to understand the requirements early in your pursuit strategy.
The first step for any contractor is a gap assessment — an honest evaluation of where your current cybersecurity posture stands against the requirements of the CMMC level you need. Do not skip this step. Contractors who jump directly to remediation without a gap assessment routinely miss requirements, remediate the wrong controls, and fail assessments because of blind spots they didn't know existed.
Review your existing DoD contracts and target opportunities. If any involve CUI, Level 2 is required. Look for DFARS 252.204-7012 and 252.204-7021 clauses in your contracts.
Not all your IT systems necessarily handle CUI. Scoping your CMMC boundary — identifying exactly which systems, people, and processes touch CUI — dramatically reduces your compliance burden by limiting what must be assessed.
Assess your current controls against all 110 practices (for Level 2). Document what's in place, what's partially implemented, and what's missing. This becomes your System Security Plan (SSP) and Plan of Action and Milestones (POA&M).
Prioritize gaps by risk and assessment impact. Some gaps are quick wins (policy documentation); others require infrastructure investment (multi-factor authentication, encrypted storage). Timeline to full Level 2 readiness for a small business with significant gaps is typically 6–18 months.
Level 1: Complete annual self-assessment and submit score to SPRS. Level 2: Select and engage a C3PAO for your formal assessment. The C3PAO will conduct the assessment and submit results to the CMMC Contractor Verification Database.
CMMC compliance increasingly appears as a proposal requirement — not just a contract clause. Solicitations for DoD work often require offerors to attest to their CMMC level in the proposal itself, and some require documentation of a current SPRS score or C3PAO assessment result. If your competitors are certified and you're not, this gap will appear in the proposal evaluation as a risk factor or a responsiveness issue.
FedBiz Solutions' CMMC advisory services help DoD contractors understand their compliance requirements, conduct gap assessments, and develop remediation plans that get them to the required certification level — with a strategy that also optimizes their federal proposal positioning. We work alongside your technical team (or your MSP) to ensure the business, compliance, and proposal dimensions of CMMC are all addressed together.
Quick answers to common questions about CMMC compliance for small businesses.
FedBiz Solutions' compliance team helps you understand your CMMC level, assess your gaps, and build the remediation plan that gets you to certification — and keeps your proposals competitive.
Schedule a CMMC Consultation