CMMC 2.0 Level 2 vs. Level 3: Which Penetration Testing Requirements Apply to You?

Key Takeaways

• CMMC Level 3 mandates annual penetration testing under NIST SP 800-172 control CA.L3-3.12.1e. Level 2 requires periodic vulnerability scanning under NIST SP 800-171. It does not require pen testing outright. Still, most experts urge Level 2 firms that handle Controlled Unclassified Information (CUI) to test.
• Only 1% of defense contractors report full readiness for CMMC 2.0 assessments. About 80,000 firms need Level 2 certification. Just 270 hold a certificate today. That gap makes early pen testing a real edge when contracts are on the line.
• Cyberattacks on the aerospace and defense sector are up 300% since 2018. The average breach in the defense sector now costs $5.46 million. Penetration testing is a business need, not just a compliance box.

Are you a defense contractor weighing your CMMC 2.0 plan? One question matters more than most. Does my company need penetration testing? The answer turns on one thing: whether your contracts call for Level 2 or Level 3. That split shapes your security work, your budget, and your shot at DoD contracts.

The Cybersecurity Maturity Model Certification (CMMC) 2.0 framework became mandatory in DoD solicitations in November 2025. It changed the rules for the defense industrial base (DIB). Self-attestation and trust-based compliance are gone. Proof took their place. You now have to show that your controls work, either by self-assessment or by third-party audit.

Penetration testing sits at the heart of that shift. At Level 3 it is a hard rule you cannot skip. At Level 2 the picture is softer, but it still matters in practice. Know where you land. That tells you what testing you owe, and it keeps a costly surprise from pushing you out of the defense supply chain.

This guide breaks down the penetration testing rules at both CMMC 2.0 levels. It explains the NIST standards behind them. It also shows how to build a testing program that satisfies assessors and truly hardens your defenses.

You may build defense parts, write military software, or run a services firm that supports DoD programs. Either way, this guide helps you learn what applies to you and what to do next. For a wider view of how penetration testing fits into the CMMC framework, start with our primer on that topic.

A Quick Primer on the CMMC 2.0 Framework

First, some ground work. The three levels shape every testing rule that follows. Knowing how the DoD built them makes the rest much clearer.

Three Levels, Three Risk Profiles

CMMC 2.0 folded the old five-tier model into three levels. Each level maps to the type and sensitivity of the data you handle. The goal is right-sized security. You spend in step with real risk.

Level 1 (Foundational) covers firms that handle only Federal Contract Information (FCI). That means contract terms, pricing, delivery dates, and similar business data. These firms follow 15 basic security practices from FAR 52.204-21. They check their own work through a yearly self-assessment. Penetration testing is not a factor here.

Level 2 (Advanced) covers most of the defense industrial base. It applies to any firm that handles, stores, or sends CUI. Level 2 calls for all 110 security controls in NIST SP 800-171. Most firms face a third-party audit every three years by a CMMC Third Party Assessment Organization (C3PAO). Roughly 78% of all CMMC assessments will happen here. This is where the penetration testing question gets interesting.

Level 3 (Expert) is for firms on critical national security programs, or those holding CUI tied to high-value assets. Level 3 keeps the full Level 2 baseline. On top of it, Level 3 adds 24 enhanced security rules from NIST SP 800-172. The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) runs the audit. Fewer than 5% of contractors are expected to need this level. Here, penetration testing is a flat rule.

The Readiness Reality

The clock matters. Industry data shows a defense base that is far from ready. The 2025 State of the DIB Report found that just 1% of defense contractors feel fully prepared for CMMC assessments. The median Supplier Performance Risk System (SPRS) score sits at 60. Level 2 needs 110. And while 69% of contractors claim compliance through self-assessment, only 30% have finished the kind of medium or high assessment that would prove it.

These gaps are more than red tape. They are real business risk. Over 80% of aerospace and defense firms have had a breach in the past 12 months. The average defense sector breach now costs $5.46 million. Miss the mark and you risk more than a failed audit. You risk your share of the $849 billion DoD contract market.

CMMC Level 2: Penetration Testing Requirements Explained

Level 2 is where most of the defense base will spend its effort. So it pays to know what this level asks of you, and what it does not. Essendis offers full CMMC 2.0 Level 2 compliance services to help contractors work through these rules.

What NIST SP 800-171 Actually Says About Testing

Level 2 maps to the 110 controls in NIST SP 800-171. Four of them drive security testing and vulnerability management.

• Requirement 3.11.2 (RA.L2-3.11.2): "Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified." This is the baseline scan rule. It covers every system that creates, handles, stores, or sends CUI. That means networks, servers, desktops, databases, apps, and cloud. The rule sets no fixed pace. Most C3PAOs expect quarterly vulnerability scanning at least.
• Requirement 3.11.3 (RA.L2-3.11.3): "Remediate vulnerabilities in accordance with risk assessments." Scanning without fixes is compliance theater. You have to set fix deadlines by severity. You have to add other controls when no patch exists yet. And you have to log each risk you choose to accept.
• Requirement 3.12.1 (CA.L2-3.12.1): "Periodically assess the security controls in organizational systems to determine if the controls are effective in their application." Here it gets subtle. The words “penetration testing” never appear. But proving controls are “effective in their application” points past automated scans. Many advisors read this as a soft mandate to pen test. That is doubly true if your setup is complex or your apps are custom.
• Requirement 3.12.3 (CA.L2-3.12.3): "Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls." This sets the bar at steady checks, not one-off audits. Scans cover part of it. The strongest posture pairs those scans with manual pen tests.

The Bottom Line for Level 2: Not Mandatory, but Strongly Advisable

Here is the plain answer. CMMC Level 2 does not explicitly mandate penetration testing. Read NIST SP 800-171 word for word and scanning is the stated rule for finding weak spots.

Real life is messier. C3PAOs want to see that your controls work, not just that they exist on paper. Vulnerability management by scanner finds known flaws. It cannot find business logic bugs, broken access rules, lateral movement paths, or long attack chains. A human tester can.

NIST grants as much. Firms that build their own software to handle CUI need more than a basic scan. NIST SP 800-171 says custom apps call for static, dynamic, binary, or hybrid analysis. All of that work sits squarely in the pen testing craft. So if custom code touches your CUI, testing is more than wise. It is close to required to meet the spirit of the vulnerability management rules.

Five Practical Reasons Level 2 Organizations Should Conduct Penetration Testing

1. Prime contractor flow-down rules. Big primes such as Lockheed Martin, Boeing, Raytheon, and Northrop Grumman now write pen testing into flow-down clauses. That happens at any CMMC level. Sell to a Tier 1 prime and you may owe tests beyond the CMMC floor.
2. Audit prep and less risk. Test before your C3PAO audit and you find weak spots on your own clock. Fix the worst ones early. You then face far less risk of a failed audit or a rushed fix under time pressure. You also avoid a Plan of Action and Milestones (POA&M) that caps your certification status.
3. An edge in bidding. Only 1% of contractors feel fully ready for CMMC. Proven rigor stands out. Hand a contracting officer your pen test reports next to your CMMC certificate and you signal that security is more than the bare minimum.
4. Proof that your enclave holds. Many Level 2 firms build a CUI enclave to shrink their scope. Penetration testing is the best way to prove those walls hold under real pressure. A scanner can confirm a firewall rule exists. A tester proves it stops someone who is trying hard to get around it.
5. Money saved. The math is simple. The average defense sector breach costs $5.46 million. A full penetration test costs between $25,000 and $100,000. Stop one incident and the return tops 50:1. Next to your total CMMC spend, testing is a small add-on that cuts a lot of risk.

CMMC Level 3: Penetration Testing as a Non-Negotiable Requirement

Level 2 leaves room to argue. Level 3 does not. Here penetration testing is neither a nice-to-have nor a hint. It is a flat rule, and DIBCAC assessors will check it during your audit.

The NIST SP 800-172 Foundation

Level 3 adds 24 enhanced security rules from NIST SP 800-172. They sit on top of the full Level 2 baseline of 110 NIST SP 800-171 controls. All 24 rest on three pillars, each aimed at Advanced Persistent Threats (APTs):

• Penetration-Resistant Architecture (PRA): Use tech and process to limit an attacker's chance to break in and stay. Build systems that are hard to crack, not just walled at the edge.
• Damage-Limiting Operations (DLO): Spot a breach, box it in, and hold down the blast radius. This pillar assumes breaches happen. It leans on compartments, fast detection, and containment.
• Cyber Resiliency and Survivability (CRS): Keep core work running during and after an attack. Even under fire, key jobs go on and recovery is quick.

The Critical Penetration Testing Control: CA.L3-3.12.1e

One control makes testing a must at Level 3: CA.L3-3.12.1e. This enhanced control tells you to:

"Employ penetration testing to validate the effectiveness of security controls."

That is not a hint or a best practice. It is a hard control, and DIBCAC will grade it during Level 3 certification. To earn a MET finding, show that your testing does all of the following:

• Runs on a set schedule. Yearly is the accepted floor. Many Level 3 firms test more often. Write the cadence down and match it to your risk and to the tempo of your systems.
• Covers the whole scope. Test every system inside the CMMC Level 3 boundary. That means CUI systems, support gear, network edges, apps, and links to outside systems.
• Uses qualified testers. DIBCAC expects skilled pros: your own red team or an outside pen testing firm. Given what is at stake, testers may need to be U.S. citizens or hold clearances. It depends on the CUI in scope.
• Yields findings you can act on. Reports must log the flaws found, how they were exploited, proof of compromise, business impact, and clear fixes. These reports become the evidence DIBCAC reviews.
• Drives fixes. You must show that findings get closed. Track the work, retest to confirm the fix, and log any risk that stays open.

Beyond Basic Penetration Testing: What Level 3 Really Demands

Level 3 asks for more than the routine yearly test many firms are used to. The enhanced rules assume you face nation-state crews with deep skill, patience, and money.

• Threat-informed testing. Skip the generic sweep. Level 3 wants tests that mimic the tactics, techniques, and procedures (TTPs) APTs use against defense data. Map the work to the MITRE ATT&CK framework. Focus on the threat actors who care about your mission and your data.
• Red team exercises. A standard pen test hunts and exploits flaws. A red team runs a full campaign end to end. Rules of engagement are thin on purpose. The team probes your controls, your detection, your response plan, and your people.
• Purple team work. The most mature Level 3 firms put attackers and defenders in the same room. Purple teaming shows detection gaps as they happen. It proves your tools raise the right alerts and your response steps work as written.
• Architecture checks. NIST SP 800-172 control 3.13.2e tells you to build and prove a penetration-resistant architecture. That goes past single flaws. It asks whether the design itself blocks an attacker from getting in and staying in. Testers should probe segmentation, privilege paths, lateral movement, and persistence.
• Assumed breach tests. Some Level 3 testing should start inside. Assume the attacker already has a foothold. Then ask hard questions. Can they raise privileges? Reach CUI stores? Steal data unseen? Keep that foothold? Those answers test the DLO pillar of the NIST SP 800-172 strategy head on.

Level 2 vs. Level 3: A Side-by-Side Comparison of Penetration Testing Requirements

This list sets the two levels side by side on the points that drive planning.

• Governing standard. Level 2: NIST SP 800-171 (110 controls). Level 3: NIST SP 800-171 plus 24 controls from NIST SP 800-172.
• Pen testing requirement. Level 2: not explicitly required. Level 3: explicitly required (CA.L3-3.12.1e).
• Vulnerability scanning. Level 2: required, periodic and event-driven. Level 3: required, inherits the Level 2 baseline.
• Testing frequency. Level 2: quarterly scanning recommended. Level 3: annual pen testing minimum, quarterly scanning baseline.
• Assessment body. Level 2: C3PAO (third-party). Level 3: DIBCAC (government-led).
• Testing scope. Level 2: all CUI-processing systems. Level 3: all Level 3 boundary systems, including APT-focused scenarios.
• Threat model. Level 2: general cybersecurity threats. Level 3: Advanced Persistent Threats, meaning nation-state actors.
• Testing depth. Level 2: automated scanning plus optional manual testing. Level 3: mandatory manual pen testing, with red team exercises recommended.
• Architecture validation. Level 2: not required. Level 3: penetration-resistant architecture validation required.
• Share of contractors. Level 2: ~78% of all CMMC assessments. Level 3: less than 5% of contractors.
• Typical cost range. Level 2: $50K–$200K for a full compliance program. Level 3: $150K–$400K+ for a full compliance program.

That split reflects two views of proof. Level 2 trusts that solid controls, checked by scans and a third-party audit, keep CUI safe. Level 3 assumes skilled foes will attack those controls on purpose. So it demands proof, through penetration testing, that they hold up in the real world.

Determining Which Level Applies to Your Organization

Firms often get stuck here. Do you need Level 2 or Level 3? You do not pick based on ambition. Your contracts and your data decide.

You Likely Need Level 2 If:

Your contracts have you handle, store, or send CUI. That covers most makers, software shops, engineering firms, services firms, and subcontractors in the defense supply chain. Does your contract include DFARS 252.204-7012? Then you handle CUI and Level 2 applies. That is the bulk of the field, an estimated 80,000 firms that need Level 2 certification.

You Likely Need Level 3 If:

The DoD's guidance limits Level 3 to a few narrow cases:

• a) You handle CUI tied to a breakthrough, unique, or advanced technology.
• b) A large amount of CUI sits together in one system or IT setup at your firm.
• c) An attack on that system or setup would open a broad hole across DoD operations.

In practice, Level 3 lands on primes and key subcontractors. Their programs cover cutting-edge weapons, intelligence platforms, critical command-and-control gear, and the like. The DoD says fewer than 5% of contractors will need Level 3 certification.

Key Decision Factor: It’s Not Your Choice

One nuance matters. You do not choose your CMMC level. The contract solicitation names it. The contracting officer sets the level based on how sensitive the data is and how critical the program is. Your job is to get certified at that level, and to do the prep before the solicitation drops.

So start early. A CMMC readiness assessment well ahead of the bid gives you time to find gaps and put controls in place. If testing is warranted, it also gives you time to run it and fix what it finds before your formal audit.

Building a Penetration Testing Program That Satisfies CMMC Requirements

Level 2 or Level 3, plan your testing early. A last-minute scramble gives worse results. The steps below fit both levels. Level 3 firms simply add depth on top. Need hands-on help? Essendis runs network penetration testing and application penetration testing aligned to CMMC needs.

Step 1: Define Your CUI Boundary and Assessment Scope

Test the systems that count for CMMC. Start by mapping how CUI moves. Every system that creates, handles, stores, or sends CUI is in scope. That includes:

• File servers and databases
• Email and collaboration tools
• Backup and disaster recovery gear
• Dev and staging systems, if they touch CUI data
• Cloud services and SaaS apps
• Network gear that carries CUI
• Remote access and VPN endpoints

Built a CUI enclave to handle controlled data? Test the enclave itself and the boundary controls that wall it off from the rest of your network. Essendis’s Secure Enclave is built with that in mind. The design is both compliant and easy to prove through pen testing.

Step 2: Select the Right Testing Methodology

Match the method to your CMMC level, your threat model, and your maturity. Start by learning the split between black box, white box, and gray box testing.

• For Level 2 firms: Gray box or white box usually gives the best value. Hand testers your network diagrams, design docs, and logins. They then cover more ground in the same time. External network tests prove your perimeter. Internal tests prove your segmentation and access rules. Add app testing if custom software handles CUI.
• For Level 3 firms: Mix methods. Pair structured pen testing with threat-informed red team work that uses MITRE ATT&CK TTPs. Add assumed breach runs, privilege escalation, lateral movement, and data theft drills. Purple team work should prove your monitoring catches the activity live.

Step 3: Establish Testing Frequency and Triggers

• Level 2 baseline: Run vulnerability scanning quarterly at a minimum. Add a yearly pen test as best practice. Test again after big system changes, major software rollouts, new high-severity flaws in your tech stack, or any security incident.
• Level 3 baseline: Run a full pen test each year. That one is mandatory. Run vulnerability scanning quarterly. Validate all year with automated tools. Run red team drills at least yearly. Test again after any change inside the Level 3 boundary, fresh threat intel for your sector, or monitoring that hints a control is slipping.

Step 4: Choose the Right Testing Partner

Raw skill is not enough for CMMC work. Weigh these points too:

• Look for real CMMC depth. Your partner should know NIST SP 800-171 and SP 800-172 cold.
• Check that testers meet any U.S. citizenship or clearance rules your CUI categories demand.
• Confirm broad coverage across network, app, wireless, and cloud testing.
• Pick firms like Essendis whose reports meet CMMC evidence standards. The output has to satisfy assessors, not just list flaws.

Step 5: Integrate Testing into Your Broader Security Program

Testing should not sit off to the side. The best CMMC programs feed results into a steady improvement loop.

• Send findings to your managed cybersecurity team to tune monitoring and detection.
• Use the fixes to update your System Security Plan (SSP).
• Track fix metrics so assessors can see steady gains.
• Let test insights steer your security spend to where it moves the needle most.

Common Mistakes to Avoid in CMMC Penetration Testing

Across the compliance spectrum, the same errors trip up good testing programs.

• Calling a scan a pen test. The two do different jobs. A scanner finds known flaws from a signature database. A pen test proves whether those flaws, and unknown ones, can really be exploited. A C3PAO or DIBCAC assessor knows the difference. Recent studies show manual penetration testing finds nearly 2,000 times more unique vulnerabilities than automated scanning alone.
• Scoping too narrow. Test the edge but skip internal networks, cloud, or the app layer and you leave blind spots. Attackers do not stop at the firewall, and assessors know it. Match your test scope to your CMMC assessment boundary.
• Testing without fixing. A pen test report left in a drawer is worse than no report. It proves you knew and did nothing. NIST SP 800-171 (Requirement 3.11.3) and SP 800-172 both demand fixes. Assessors will ask for proof that the findings were closed.
• Waiting until the last minute. Test a few weeks before your CMMC audit and you have no time to fix what turns up. Test at least six months out. Retest three months out to confirm the fixes. CMMC prep takes 6-18 months on average, so build testing into the early plan.
• Hiring testers with no CMMC context. A generic firm may do sound technical work that misses what CMMC wants. Your partner should know which NIST controls are in play, how findings map to CMMC assessment objectives, and what report format assessors expect.
• Skipping the cloud. More defense contractors move to cloud each year. Testing must reach cloud configs, API security, identity and access rules, and data protection in the cloud. Under shared responsibility, the provider secures the infrastructure. You secure your setup and your data, and you prove it by testing.

The CMMC Compliance Timeline: Where Penetration Testing Fits

The CMMC 2.0 rollout is phased. Plan your testing around it.

• Phase 1 (active as of November 2025): Level 1 and Level 2 self-assessment rules appear in some contracts. If yours has CMMC clauses, you must comply now.
• Phase 2 (expected November 2026): Level 2 C3PAO certification audits show up in contracts. Third-party proof becomes a must for most CUI handlers.
• Phase 3 (expected November 2027): Level 3 DIBCAC audit rules enter applicable contracts.
• Phase 4 (expected by 2028): Full rollout across all applicable DoD contracts.

Level 2 firms: run your first pen test now. Close the gaps before Phase 2 C3PAO audits start. Then put testing on your yearly security calendar. Firms that start early are the ones with clean results when the certification window opens.

Level 3 firms: your program should already be running. Yearly pen tests, red team drills, and steady validation need to be in place well before the Phase 3 DIBCAC rule bites. DIBCAC has limited capacity and Level 3 reviews are complex. Early prep is essential.

The Strategic Value of Penetration Testing Beyond CMMC Compliance

Compliance drives the budget for most firms. The payoff runs wider than that.

• Supply chain resilience. The defense supply chain is only as strong as its weakest link. Nearly 90% of defense contractors report money, brand, or business losses from cyber incidents. Penetration testing finds your weak points first and lifts the whole chain.
• Insurance and risk. Cyber insurers now ask defense firms for proof of security testing. Regular pen test results can earn better rates and show due care if you ever file a claim.
• Investor and partner trust. Chasing growth through M&A, joint ventures, or new prime contractor ties? A documented testing program signals maturity that beats checkbox compliance.
• Operational awareness. Penetration testing gives you ground truth about your security posture. What a skilled tester learns about your defenses under fire is nothing like what a control list tells you.
• Talent and culture. Firms that test tend to sharpen their own IT and security teams. Debriefs and joint fix work expose staff to real attack methods. That knowledge stays in house and compounds over time.

Taking the Next Step

The penetration testing rules in CMMC 2.0 point to a larger truth. The threat has outgrown what basic controls and automated scans can catch. Level 2 or Level 3, penetration testing is what turns paper compliance into proven security.

At Level 2, the real question is not whether you can skip testing. It is whether you can afford to. Most contractors are still scrambling toward compliance. The ones who test early will be the ones with clean audits, happy primes, and steady access to DoD work.

At Level 3, the path is plain. Testing is mandatory and the bar is high. A mature program of threat-informed tests, red team drills, and steady validation is about more than passing your DIBCAC audit. It is about defending the national security data in your care.

The defense industrial base stands at a turning point. Firms that invest in strong penetration testing now, driven by Level 2 prudence or Level 3 mandate, will thrive in the next era of defense work. Those who wait risk joining the 99% still scrambling to catch up. Essendis delivers the full range of CMMC compliance solutions, from readiness assessments through pen testing to managed security. We help defense contractors earn and keep certification at every level. Contact our team to talk through your penetration testing and CMMC needs.

Frequently Asked Questions

Does CMMC Level 2 require penetration testing?

No. CMMC Level 2 does not explicitly mandate penetration testing. NIST SP 800-171 calls for periodic vulnerability scanning and control assessment. The words “penetration testing” never appear as a requirement. Even so, most experts urge Level 2 firms to test. Here is why:

• It proves controls work far better than a scan alone.
• It surfaces gaps before your C3PAO audit.
• It meets prime contractor flow-down rules that often exceed the CMMC floor.
• It proves your CUI enclave walls and segmentation hold.

And if custom software handles your CUI, testing is close to required to meet the spirit of the vulnerability management rules.

What specific NIST control requires penetration testing at Level 3?

It is CA.L3-3.12.1e from NIST SP 800-172. It tells firms to “employ penetration testing to validate the effectiveness of security controls.” DIBCAC assessors grade it during Level 3 certification. Unlike Level 2, there is no gray area. You must test, and you must show evidence of both the tests and the fixes that followed.

How often should penetration testing be conducted for CMMC compliance?

Level 2 firms that test by choice should aim for a yearly pen test plus quarterly vulnerability scanning. Level 3 firms should treat a yearly full pen test as the floor. Add quarterly vulnerability scanning, continuous validation, and periodic red team drills. Test again after big system changes, new high-severity flaws, security incidents, or major software rollouts.

What’s the difference between vulnerability scanning and penetration testing for CMMC purposes?

A scanner uses automated tools to spot known weak points from a signature database. Think of it as a checkup for known problems. A pen test puts skilled people to work. They try to exploit flaws, chain findings together, test business logic, and prove whether a weak spot can really be used.

CMMC Level 2 requires vulnerability scanning. Level 3 requires scanning, which it inherits from the Level 2 baseline, plus penetration testing. Assessors at both levels know the difference. Present scan results as a pen test and they will push back.

Can we conduct penetration testing internally, or do we need an external firm?

Either can satisfy CMMC, as long as testers are qualified and the work is rigorous. In-house red teams know your systems and can test often. They may also miss what familiarity hides. Outside firms bring fresh eyes, deep skill, and independence that assessors tend to favor. Many Level 3 firms blend the two. They hire an outside firm for the yearly full test and use in-house staff for steady validation and purple team drills. What counts is skill, independence, and thoroughness.

What happens if a penetration test finds a critical vulnerability right before our CMMC assessment?

Finding it early is good news. You get the chance to fix it. CMMC assessors generally do not ask for pen test reports, and they will not ding you for issues you already fixed.

Cannot close it in time? You may handle it through a Plan of Action and Milestones (POA&M). That can leave you with conditional rather than final certification. Under CMMC 2.0, firms may hold some minor POA&Ms at certification. But you must score at least 80% on Level 3-specific controls and close every POA&M item within 180 days. That is why you should test well ahead, at least six months before your planned audit.

How much does CMMC-compliant penetration testing cost?

Cost tracks scope, complexity, and depth. Level 2 firms running basic network and application penetration testing usually pay $25,000 to $75,000 per engagement. Level 3 firms need more: threat-informed scenarios, red team drills, and architecture validation. That work runs $75,000 to $200,000 or more per yearly cycle. Set that against the $5.46 million average defense sector breach and the risk of losing DoD contract revenue. Testing is a high-return security investment.