A clearer starting point
CMMC level checker.
Plan your next step.
Answer 10 questions about your work, contract, and current practices. Get a practical summary of what to confirm and where to focus your preparation.
- Free
- No signup
- 10 questions
- Answers stay in this page
This is a self-reported planning aid, not an assessment. Your applicable contract and current program guidance determine your obligations. This tool does not calculate an SPRS score or predict certification.
Your planning summary
What you told us
Items to review
These are suggested discussion points from your answers, not verified findings or a complete list of requirements.
Practices you reported in place
Each item groups several topics. Selecting every item does not establish that all 15, 110, or Level 3 requirements are met.
Recommended next step
Talk through your contract, scope, and support needs with a specialist.
Reach out to a CMMC SpecialistYour checker answers are not sent with this link. Keep requests high-level; do not include CUI, passwords or an SSP.The checker keeps answers only in this open page. It does not send them, save them to browser storage, or include them in links. Hosting providers may process ordinary page-request data. Please do not enter CUI, contract documents, or personal information; this tool has no upload or free-text fields.
How this CMMC checker works
The questions cover your defense work, information types, contract language, and a small set of preparation topics. If you report a named CMMC level, the summary reflects your answer. Otherwise, it points you toward questions to raise with your prime or contracting officer.
Company size does not set your level. A clause, a document marking, or a short questionnaire cannot establish every applicable obligation. Confirm the relevant contract, amendments, flowdowns, information categories, and assessment scope before choosing a route.
There is no readiness percentage. The result organizes your answers into review items. It does not test control implementation, review evidence, calculate an official score, or estimate time to assessment.
CMMC levels at a glance
| Level | Information context | Model requirements | Assessment route in the model |
|---|---|---|---|
| Level 1 | Federal Contract Information (FCI) | 15 safeguarding requirements from FAR 52.204-21 | Self-assessment |
| Level 2 | Controlled Unclassified Information (CUI) | 110 requirements from NIST SP 800-171 Rev. 2 | Self-assessment or C3PAO assessment, as applicable |
| Level 3 | CUI in designated programs | Level 2 plus 24 selected NIST SP 800-172 requirements | Government assessment by DIBCAC, with a qualifying Level 2 C3PAO status |
Source: 32 CFR 170.14, CMMC model. The model does not establish the requirement for a particular contract.
Program status: reviewed October 9, 2026
The Phase 2 rollout is suspended. The July 13, 2026 memo paused that transition. Phase 1 Level 1 and Level 2 self-assessments continue where applicable. Do not treat the previously scheduled November 2026 transition as a current universal certification deadline.
A September 2026 GAO decision reproduces the memo’s direction restricting new designations to Level 1 (Self) or Level 2 (Self) during the suspension and addressing amendments to active solicitations. If your documents still name C3PAO or DIBCAC assessment, ask the contracting officer or prime to confirm the current requirement and any amendments.
Read the GAO discussion of the suspension, pages 32–33 (PDF) and check the official CMMC program page. Existing safeguarding and contract obligations still need review.
CMMC level checker FAQ
Can this checker tell me which CMMC level I need?
It can help organize that conversation. Your actual requirement depends on the applicable solicitation, contract, flowdowns, information, and current program guidance. When no requirement is confirmed, the checker gives questions to investigate rather than assigning a definitive level.
Does DFARS 252.204-7012 automatically mean Level 2 certification?
No. The presence of that safeguarding clause alone is not a determination of your CMMC assessment requirement. Review covered information, scope, the applicable CMMC provisions, and current contract amendments with the contracting officer or prime.
Is this an SPRS score or an assessment result?
No. SPRS records and CMMC assessment results come from their applicable assessment processes. This tool only summarizes selected answers. It cannot validate a reported score, establish Conditional or Final CMMC status, or show that your organization is assessment-ready.
How long will preparation take?
A reliable plan needs a defined scope, an evidence-based review of the applicable requirements, named owners, and the actual contract dates. This checker does not estimate the duration. Use its review items to start that planning conversation.
Does every subcontractor need the same level as the prime?
Do not assume that. Review the actual subcontract flowdowns, information you handle, and current requirements. A prime’s own level does not by itself determine the level applicable to every supplier.
Are my answers stored or shared?
The checker keeps answers in the page’s temporary memory. It has no answer submission, analytics events, browser-storage feature, or answer-bearing links. Restarting or reloading clears the questionnaire. Choosing the contact link does not transfer your answers. Normal website hosting may still process page-request data.
Turn the questions into a plan
Use the checklist to organize scope, responsibilities, evidence, and the questions you need answered before choosing support.
Read the CMMC readiness checklist →General educational information, not legal or compliance advice. Last reviewed October 9, 2026.