CMMC 2.0 cleared up some of the confusion, but plenty of organizations still mix up the levels. Know what each one means, and you'll put the right cybersecurity controls in the right places.

• Level 1: Basic controls to safeguard Federal Contract Information (FCI), with annual self-assessments.

• Level 2: Protects Controlled Unclassified Information (CUI). Self-assessments during the phased rollout, with select contracts requiring a third-party assessment from a certified CMMC Third Party Assessor Organization (C3PAO).

• Level 3: Required when the DoD decides the work or the risk to national security calls for advanced protection.

Here's the mistake we see most. People assume every contractor with a lean team lands at Level 1, or that any contract under a certain dollar amount is Level 1. Not true.

Level 1 is the starting floor for everybody. But the level you need depends on one thing: whether you process CUI. It doesn't matter if you make $1 million a year or a billion. Process CUI? You need Level 2. A large contractor that only works with FCI? Level 1 may be all you need.

Level 1 means annual self-assessments. Level 2 works differently. During the phased rollout, Level 2 uses self-attestation—unless your contracts require a formal assessment from a C3PAO. Either way, Level 2 means you've implemented all 110 security controls from NIST SP 800-171 to protect CUI, documented your policies and procedures, and completed a self-attestation or a C3PAO assessment, depending on your contract.

Ask these questions when scoping your environment:

What data do you work with?

• Do you store, process, or transmit CUI? If yes, you need at least Level 2 controls.

• Do you handle FCI? FCI alone may only require Level 1 controls, but adding CUI increases requirements.

Which systems touch DoD data?

Document all systems that store, process, or transmit CUI, including third-party vendors. Servers, workstations, laptops, and cloud environments—all systems that "touch" CUI

are in scope.

Do third-party vendors access that data?

If subcontractors handle CUI on your behalf, you're responsible for their compliance.  You are required to flow down the appropriate clauses for the level of information you need to share with these subcontractors, and to validate their compliance yourself.

Don't make this mistake: Organizations often under-scope their environments, only to discover missing systems or users during the assessment. 

Once you list all systems and users that handle CUI, begin your CMMC self-assessment.

Step 1: Review your data

Categorize your data clearly as FCI or CUI.

Step 2: Inventory systems and users

Document every system, endpoint, and user that processes FCI or CUI. Include vendors who may indirectly access this data.

Step 3: Perform a gap analysis

Compare your current security practices to the required controls for your desired CMMC level.

For example, Level 2 requires organizations to enable multi-factor authentication (MFA), implement access control policies, and maintain an incident response plan.

Step 4: Document everything

Document policies, procedures, and technical controls so that assessors can verify your compliance.

Completing these steps gives you a clear view of the CMMC assessment process and highlights where your organization already meets requirements and where it needs improvement.

Knowing your required level is only half the battle. Follow these steps to achieve compliance:

• Implement missing controls: Address any gaps, whether through improved endpoint protection, identity and access management, or logging and monitoring. Tools like Huntress Managed Endpoint Detection and Response (EDR) and Identity Threat Detection and Response (ITDR) protect your endpoints and identities and support CMMC requirements.

• Validate your environment: Perform tabletop exercises or internal assessments to confirm that all controls work as intended. 

• Hunt for weaknesses: Use a third-party assessor for formal assessments (required for Level 2). They validate that your processes meet CMMC standards.

• Guides: Learn how to perform a CMMC self-assessment (Level 1,Level 2,Level 3) and take practical steps to improve your security posture.

• PDFs: Download the officialDoD model overview and implementation policy.

• Tools: Use security tools like SIEM for centralized logging, ITDR for identity monitoring, and EDR for endpoint protection.

Ready to get moving? Start here: 

1. Run a data classification assessment to find out whether you process, store, or transmit FCI or CUI. 

2. Do a control gap analysis to measure your current security posture against the CMMC level you need. 

3. Put Huntress Managed EDR, SIEM,  and ITDR in place to support your CMMC compliance requirements, 

Huntress covers 55 of the 110 controls you'll face in a CMMC Level 2 Assessment, and we back it up with assessor-ready documentation. See how Huntress helps with CMMC Level 2 and start your CMMC journey with confidence. 

Know your level. Scope it right. Then go earn that contract.