Cybersecurity Maturity Model Certification

CMMC Level 1 requires 17 security practices. This includes basic levels of security like Access Control, Identification and Authentication, Media Protection, and Physical Protection. According to the CMMC-AB, by 2025, 60% of contracts will require a level 1 certification.

CMMC Level 2 requires 72 security practices. This builds upon the 17 from Level 1 and adds 55 practices with documentation now being required for each Domain listed as Level 1 and 2. This is listed as a transitional step to Level 3 and must include written policies and procedures.

CMMC Level 3 requires 130 practices which include the 72 from Levels 1 and 2 and an additional 58 practices. At Level 3, an organization needs to prove the cybersecurity program in place is well documented and managed, showing maturity. According to the CMMC-AB, by 2025, 30% of contracts will require a level 3 certification.

CMMC Level 4 requires an additional 26 practices from Levels 1-3. Although the 156 total practices are identified, the CMMC-AB is still working on all the details, such as which companies will require a Level 4 certification.

CMMC Level 5 requires a total of 171 practices. It incorporates all of Levels 1-4, adds 15 more practices, and is listed as Advanced Cybersecurity. This level is reserved only for a limited amount of companies and will make up less than 10% of all contracts.