5.1 CMMC Three-Level Architecture, Assessment Types & Affirmation
Key Takeaways
- Level 1 covers FCI with 15 FAR requirements and an annual self-assessment.
- Level 2 covers CUI with 110 NIST SP 800-171 Revision 2 requirements and uses either a triennial self-assessment or triennial C3PAO assessment as specified by the contract.
- Level 3 adds 24 selected NIST SP 800-172 requirements and is assessed triennially by DCMA DIBCAC.
- An annual affirmation is required for every status, but annual affirmation does not make a triennial Level 2 self-assessment annual.
- The assessment scope, required status, assessment date, status period, and affirmation are separate facts.
5.1 CMMC Three-Level Architecture, Assessment Types & Affirmation
CMMC has three levels aligned to the sensitivity of information and procurement risk. The current architecture is defined in 32 CFR part 170 and the CMMC model. Older diagrams showing 17 Level 1 practices or an annual Level 2 self-assessment are obsolete.
Level comparison
| Level | Protected information | Security requirements | Assessment | Status period | POA&M |
|---|---|---|---|---|---|
| Level 1 | Federal Contract Information | 15 FAR 52.204-21 requirements | Annual self-assessment | One year | Not permitted |
| Level 2 (Self) | CUI for solicitations allowing self-assessment | 110 NIST SP 800-171 Rev. 2 requirements | Self-assessment every three years | Three years, with annual affirmation | Limited under §170.21 |
| Level 2 (C3PAO) | CUI for solicitations requiring certification | Same 110 requirements | C3PAO assessment every three years | Three years, with annual affirmation | Limited under §170.21 |
| Level 3 | Highest-priority CUI programs | Level 2 plus 24 selected NIST SP 800-172 requirements | DCMA DIBCAC every three years | Three years, with annual affirmation | Limited under Level 3 rules |
The solicitation or contract identifies the required assessment level and type. “Level 2” alone does not tell the candidate whether a self-assessment or C3PAO certification assessment applies.
Level 1
Level 1 protects FCI on contractor systems. The organization assesses the 15 FAR requirements annually and records the result in SPRS. All requirements must be MET; no conditional status or POA&M is available. The scope consists of assets that process, store, or transmit FCI and the people, technologies, and facilities that provide protection, subject to the Level 1 Scoping Guide.
Level 1 is not a C3PAO certification option. A contractor can obtain assistance in preparing its self-assessment, but it remains responsible for the result and affirmation.
Level 2
Level 2 protects CUI and adopts the 110 requirements of NIST SP 800-171 Revision 2 across 14 families. The two assessment types use the same security baseline but different assessors and status labels.
A Level 2 self-assessment is performed by the organization every three years where permitted by the solicitation or contract. A Level 2 certification assessment is performed by an authorized or accredited C3PAO every three years. The C3PAO team applies the CMMC model, assessment guide, scope, NIST SP 800-171A methods, and CAP. Neither assessment is automatically annual.
After the initial assessment, the Affirming Official submits the required affirmation and repeats the affirmation annually. This continuing attestation does not replace the next triennial assessment and does not authorize scope drift. Material changes must be managed, documented, and evaluated under the applicable requirements.
Level 3
Level 3 addresses advanced persistent threats and adds 24 selected NIST SP 800-172 requirements to the Level 2 baseline. DCMA DIBCAC performs the Level 3 assessment. An organization first needs a current Final Level 2 (C3PAO) status covering the information systems in the proposed Level 3 scope; the Level 3 scope must be equal to or a subset of the Level 2 scope. The government may examine underlying Level 2 implementation during the Level 3 process.
Level 3 does not mean 134 unrelated controls. It layers the selected enhanced requirements onto the Level 2 foundation and applies its own assessment and POA&M restrictions.
Assessment versus affirmation
An assessment evaluates implementation and produces a status for a defined scope. An affirmation is the Affirming Official's attestation that the organization has implemented and will maintain the requirements for all systems in that scope. 32 CFR §170.22 requires affirmation after the relevant assessment, after POA&M closeout when applicable, and annually while status continues.
The official role name is Affirming Official, a senior-level representative with authority to affirm on behalf of the organization. “Senior Company Official” may describe the concept in older materials but is not the current defined title.
Status logic
Final status means all applicable requirements are satisfied. Conditional status is available only under the applicable POA&M rules and expires if closeout is not successfully completed within 180 days. Assessment status is tied to a specific scope, CAGE information, and date. It is not a transferable enterprise badge for every affiliate or network.
For Level 1, the status expires after one year and requires a new self-assessment. For Level 2 and Level 3, final status generally lasts three years, subject to annual affirmation and continuing compliance. A contract can impose additional duties, and an organizational change can affect the represented scope even before the nominal date.
Exam decision tree
First identify FCI versus CUI. Next read the required CMMC level and assessment type. Then identify the assessor: organization, C3PAO, or DIBCAC. Apply the correct cadence. Finally, separate the assessment result from the annual affirmation. This prevents four common errors: using 17 at Level 1, treating all Level 2 work as C3PAO work, calling Level 2 self-assessment annual, and assigning the affirmation to an assessor.
How often is a Level 2 self-assessment performed under the current rule?
Who performs Level 3 certification assessments?
What is the role of the annual affirmation?