Determine required CMMC level
determine_cmmc_levelDetermine which CMMC level (1, 2, or 3) applies to a defense contractor based on the data they handle and the clauses in their contracts, and - separately - which assessment type may actually be designated today. Those are not the same question: CMMC Phase II was suspended on 13 July 2026, so C3PAO and DIBCAC assessments cannot currently be designated even where the level calls for one. Call this when the user asks "what CMMC level do I need", whether FCI-only work needs CMMC, or what DFARS 252.204-7012/7019/7020/7021 imply.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| handles_cui | Yes | Does the organization store, process, or transmit Controlled Unclassified Information (CUI) - e.g. technical data, drawings, specs above general descriptive material? | |
| contract_clauses | No | FAR/DFARS clauses present in their contracts, if known |