CMMC penetration testing: which level requires a pentest

CMMC penetration testing is required at Level 3 and is not named at Level 1 or Level 2. The Level 3 requirement is CA.L3-3.12.1e: conduct penetration testing at least annually or after significant security changes. Level 2 contractors still meet pentest requests, and those come from primes and assessors, not from a CMMC rule.

Which CMMC level requires a penetration test?#

Only Level 3 names one. The table gives the answer by level and the source of each level's requirements.

The rule text sits in 32 CFR 170.14(c). Level 3 adds to Level 2. A contractor that holds CUI for a program that needs Level 3 should read the full Table 1 in the rule and the DoD CIO assessment guides at dodcio.defense.gov.

What does Level 2 say, and why is it not a pentest requirement?#

Level 2 asks for security control assessments, which are broader than a pentest. The Level 2 requirements are "identical to the requirements in NIST SP 800-171 R2", in the words of 32 CFR 170.14(c)(3). That NIST document is a list of 110 controls, and the assessment control is 3.12.1, which asks you to periodically assess the security controls in your systems to see whether they work.

A pentest can serve as evidence for that control, but the control does not name one. A scan, a configuration review, an internal audit or a pentest can each give evidence. The assessor decides what is enough for your scope.

One more date matters. NIST lists SP 800-171 Rev. 2 as withdrawn on 14 May 2024 and superseded by Rev. 3. The CMMC rule still names Rev. 2 for Level 2. Use the version the rule names, and check whether DoD updates it.

What does Level 3 require?#

Level 3 requires penetration testing in CA.L3-3.12.1e. The rule text reads "Conduct penetration testing at least annually or when significant security changes are made to the system." The control adds that the testing combines automated scans with manual, ad hoc testing by subject-matter experts.

Read that wording closely, because it sets two conditions.

• Time: at least once a year.
• Event: after significant security changes to the system, even in the middle of a year.

The Cornell copy of the rule lost the italic marks that DoD uses for values it assigned to organization-defined parameters, so the page alone does not show which words are the assigned value. Check the italics on eCFR. Also check how your assessor reads "significant". Write your own definition into your plan. See how often should you pentest for a trigger list.

NIST's own page for SP 800-172 says it was withdrawn on 13 May 2026 and replaced by SP 800-172 Rev. 3. The CMMC rule names the February 2021 edition. We found no rule text that moves Level 3 to Rev. 3, so treat the rule text as the authority for CMMC. Recheck before an assessment.

Why do primes and assessors still ask for a pentest at Level 2?#

Because a pentest produces stronger evidence than a questionnaire answer. A prime may add it to a subcontract, and your own risk team may add it to your plan. This is a business choice, and the CMMC rule text does not require it at Level 2.

If you are asked, find out four things first:

1. Who asks, and in which document (contract clause, flow-down, questionnaire).
2. Which systems they mean: the CUI environment, a web portal, an API or the whole company.
3. What interval they expect.
4. What evidence they will accept: a full report, a summary or an attestation letter. See pentest attestation letters.

Our security questionnaire pentest questions guide lists the usual wording of these requests.

What should you scope for a web app or API that handles CUI?#

Scope every path an attacker could use to reach CUI, and keep the boundary written. For a web app or API, start from this checklist:

• Login, SSO, MFA and password reset.
• Every role, including admin and support roles.
• Each API route that takes a document, record or user ID.
• File upload and download, and export features.
• Tenant boundaries, if one system serves several programs.
• Session handling and token expiry.
• Logging of access to CUI records, as a check that evidence exists.

Destructive proofs use test accounts and test records only. A test of a system that holds CUI needs a plan for what the tester does if CUI appears in a response: stop, record the location and tell you. Agree that in the written authorization before testing starts. Our web application penetration testing page lists what we test on web apps. For the federal cloud track, see FedRAMP penetration testing.

What evidence should you keep for an assessor?#

Keep the report, the fixes and the retest, with dates. A pentest report is evidence for one control, not a statement of compliance.

Map each item to the control it supports in your system security plan. Ask your assessor which format they prefer.

How do a pentest, a vulnerability scan and an assessment differ?#

A scan finds known issues by pattern, a pentest tries to exploit weaknesses by hand, and an assessment checks whether controls exist and work. The Level 3 text asks for a mix of scanning and manual expert testing. See pentest vs security audit for the difference between a test and an audit.

What should you ask before you scope a CMMC-related pentest?#

• Which level are we targeting, and which requirement text does the contract cite?
• Which systems hold or process CUI, and which sit inside the assessment boundary?
• Does our assessor want the full report or a summary?
• What is our interval, and what counts as a significant change?
• Does the provider test only with written authorization from the system owner?
• Will the provider retest fixed findings?

Excession Labs is a security lab and tests only with written authorization. We make no claim about assessor acceptance.

Need a pentest you can act on?

Tell us what you need tested and why. We reply to agree scope, and testing starts only after written authorization.

Request a testSee the sample report