Home - Blank Rome LLP

Register to receive insights and analyses on breaking news and trends across varying industries.
<a class="link-primary mt-4" href="/subscribe">Subscribe</a>

Philadelphia, PA

New York, NY

Wilmington, DE

Cincinnati, OH

Princeton, NJ

Los Angeles, CA

Houston, TX

Tampa, FL

Shanghai

South Florida

Pittsburgh, PA

Washington, D.C.

Chicago, IL

Orange County, CA

Dallas, TX

Boston, MA

The Department of Defense (“DOD”) recently issued new guidance outlining how it will determine Cybersecurity Maturity Model Certification (“CMMC”) levels for its solicitations and contracts. Prior to this guidance, contractors generally understood that contracts with only Federal Contract Information (“FCI”) would require a CMMC Level 1 self-assessment; contracts with Controlled Unclassified Information (“CUI”) would require either a CMMC Level 2 self-assessment or a CMMC Level 2 certification; and DOD contracts “supporting its most critical programs and technologies” would require a CMMC Level 3 certification. DOD’s new guidance provides additional information contractors can use to help them determine which CMMC Level they should achieve.

core/paragraph

core/heading

DOD’s CMMC Level 1 guidance confirms what contractors have already understood: A contract will require a CMMC Level 1 self-assessment if it requires the contractor to process, store, or transmit&nbsp;only&nbsp;FCI on the contractor’s information system. Stated another way, if the contractor does not receive CUI in connection with the contract, then the contractor will only need a CMMC Level 1 self-assessment to perform the contract. Thus, contractors that have not historically received CUI when supporting DOD may be able to continue their DOD work with only a CMMC Level 1 self-assessment.&nbsp;

To read the full post, visit our&nbsp;<a href="https://governmentcontractsnavigator.com/2025/02/18/what-cmmc-level-do-i-need-the-department-of-defense-issues-new-guidance-for-determining-appropriate-cmmc-compliance-level/">Government Contracts Navigator</a>&nbsp;blog.

Cybersecurity

ADG Cybersecurity & Data Privacy

Michael J. Montalbano

Government Contracts

Regulatory Compliance

Blog Post

Publications

What CMMC Level Do I Need? The Department of Defense Issues New Guidance for Determining Appropriate CMMC Compliance Level

What CMMC Level Do I Need? The Department of Defense Issues New Guidance for Determining Appropriate CMMC Compliance Level

Offices

Stay Connected

Slide Menu

Slide Search

What CMMC Level Do I Need? The Department of Defense Issues New Guidance for Determining Appropriate CMMC Compliance Level

Offices

Stay Connected