Which MINIMUM Level of certification must a contractor successfully achieve to receive a contract award requiring the handling of CUI?

The Cybersecurity Maturity Model Certification (CMMC) framework is structured in three levels. Level 2 (Advanced) is the minimum certification level required for contractors who handle Controlled Unclassified Information (CUI). This level's requirements are directly aligned with the 110 security controls specified in NIST SP 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations." Level 1 is designed only for protecting Federal Contract Information (FCI), which has less stringent safeguarding requirements than CUI. Therefore, to be awarded a contract involving CUI, an organization must demonstrate compliance with at least Level 2.

A. Level 1: This level is for the protection of Federal Contract Information (FCI) only and does not meet the requirements for safeguarding CUI.

C. Level 3: While a Level 3 certified contractor can handle CUI, it is not the minimum required level. Level 3 includes enhanced controls against Advanced Persistent Threats (APTs).

D. Any level: This is incorrect because Level 1 is insufficient for handling CUI, which requires the specific controls found starting at Level 2.

1. U.S. Department of Defense (DoD). (2021

November). Cybersecurity Maturity Model Certification (CMMC) Model Overview

Version 2.0.

Page 3

Table 1 "CMMC Model Structure": This table explicitly states the focus of Level 1 is "FCI" and the focus of Level 2 is "CUI". It also notes that Level 2 requirements are aligned with NIST SP 800-171.

2. National Institute of Standards and Technology (NIST). (2020

February). Special Publication (SP) 800-171 Rev. 2: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Section 1.1

Page 1

Paragraph 2: "The requirements apply to all CUI... on nonfederal systems." This document forms the basis of CMMC Level 2

establishing it as the standard for CUI protection.

3. Georgia Tech Research Institute (GTRI). (2022). CMMC 2.0: What It Is and How to Prepare.

Section "CMMC 2.0 Levels"

Page 2: "Level 2 (Advanced) is for companies that work with Controlled Unclassified Information (CUI)... This level is comparable to the old CMMC Level 3 and mirrors NIST SP 800-171." This university-affiliated research institute publication confirms Level 2 as the requirement for CUI.