Compare

CMMC vs DoW IL2 / IL4: how they differ, side by side

How CMMC and DoW IL2 / IL4 differ: what each is, who owes it, when it applies and who enforces it.

CMMCBinding on DoD contractors through contract

DoW IL2 / IL4Binding on DoD components; applies to cloud providers through DISA authorization and contracts

Checked21 Oct 2026

01 / Side by side

CMMC and DoW IL2 / IL4, side by side

	CMMC	DoW IL2 / IL4
What it is	regulation	federal standard
Jurisdiction	United States (federal)	United States (federal)
Legal force	Binding on DoD contractors through contract	Binding on DoD components; applies to cloud providers through DISA authorization and contracts
Status	Partly in force	In force
Who owes it	Defense contractors and subcontractors that process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) on contractor systems.	Commercial cloud service providers seeking a DoD Provisional Authorization, and DoD mission owners hosting DoD data in commercial cloud.
Enforcement	DoD contracting officers (no award without required status); false affirmations can bring False Claims Act liability (treble damages plus per-claim penalties) and suspension or debarment.	DISA Authorizing Official (PA issuance, conditions, revocation) and DoD component authorizing officials; contract remedies. No fines.

02 / CMMC

What CMMC requires

Applies to AI systems as to any system: AI tools, models or cloud AI services that process FCI or CUI fall inside the assessed boundary and must meet the same controls.

01Level 1: annually self-assess against the 15 FAR 52.204-21 safeguarding requirements and affirm in SPRS.
02Level 2: meet the 110 NIST SP 800-171 Rev. 2 requirements, by self-assessment or C3PAO assessment every three years.
03Level 3: hold Level 2 certification plus a government (DIBCAC) assessment of 24 NIST SP 800-172 requirements.
04Post results in SPRS and have a senior official affirm compliance annually.
05Give the contracting officer the CMMC unique identifiers (UIDs) for systems handling FCI or CUI and report any changes to them during performance (DFARS 252.204-7021(e), NOV 2025).
06Flow down the required CMMC level to subcontractors handling FCI or CUI.

03 / DoW IL2 / IL4

What DoW IL2 / IL4 requires

Applies to AI systems as to any system: commercial AI services handling DoD CUI need at least an IL4 Provisional Authorization, and IL2 only suits public or non-critical data.

01IL2: hold a FedRAMP Moderate or High authorization for the cloud service offering.
02IL4: implement FedRAMP Moderate controls plus DISA parameters and the SRG's FedRAMP+ controls (Table D-1).
03IL4: connect through a DoD-approved Boundary Cloud Access Point and use DoD PKI authentication.
04Obtain a DoD Provisional Authorization from the DISA Authorizing Official, then the mission owner's ATO.
05Maintain continuous monitoring, including 30/90/180-day vulnerability remediation and annual assessments.

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES