Assessment posture
Level 1 is explicitly a self-assessment, Level 2 supports both self-assessment and third-party certification, and Level 3 is structured as a certification assessment framework.
Live example · Compare sources
CMMC Level 1 vs Level 2 vs Level 3: what each level adds
Docsie Compare read the three official CMMC assessment guides (version 2.13), 420 pages and about 110,000 words, and compared what each level requires and how it is assessed. Below: the key changes, Docsie's summary, every finding, and the interactive report with evidence from each source.
SourceCMMC Level 1Assessment Guide v2.13, FCI
SourceCMMC Level 2Assessment Guide v2.13, CUI
SourceCMMC Level 3Assessment Guide v2.13, enhanced
420Pages read
~110KWords read
31Findings
31Changed
18 minCompare time
Compared on October 12, 2026. Findings are Docsie Compare’s AI judgments with cited evidence; a reviewer checked them and every correction is labelled. Check findings against the sources before relying on them.
Summary
The short version
Level 1 assesses 15 basic safeguarding requirements for Federal Contract Information. Level 2 assesses the 110 requirements of NIST SP 800-171 Rev. 2 for CUI. Level 3 adds 24 enhanced requirements from NIST SP 800-172, and its assessments are conducted only by DCMA DIBCAC.
Docsie’s summary
For someone deciding or designing against these levels, the main implication is that the required assessment architecture becomes progressively more formal, more evidence-driven, and more tightly scoped as the level increases. A design that is sufficient for Level 1 will not, by itself, satisfy the more fixed baseline, broader certification posture, and more granular scope and evidence handling expected at Levels 2 and 3.
CMMC Level 1, CMMC Level 2, and CMMC Level 3 are three progressively more structured assessment levels. Level 1 is a self-assessment for Federal Contract Information (FCI) using the basic safeguarding requirements; Level 2 is a fixed-baseline assessment for Controlled Unclassified Information (CUI) that can be self-assessed or certified; and Level 3 is a certification-oriented framework for a more advanced baseline with additional scoping and reporting structure. Across the three, the common theme is scope, objectives, and evidence-based judgment, but each level documents a different assessment posture and level of rigor.
Where they differ most
Baseline and target information
Level 1 is tied to the 15 basic safeguarding requirements for FCI, Level 2 uses a fixed NIST SP 800-171 Rev. 2 baseline for CUI, and Level 3 uses a selected set of NIST SP 800-172-derived requirements with DoD-approved parameters where applicable.
Scope and applicability granularity
Level 2 and Level 3 both require formal scope definition, but Level 3 adds more granular applicability handling at both the scope and objective level and references the Level 3 scoping guide.
Assessment output
Level 1 submits results to SPRS, while Level 3 produces a compliance score with a report of findings; Level 2 is described as a requirement-based assessment framework without that Level 3 reporting structure.
Findings
Every finding
Security assessment framework
Assessment scope and applicability
ChangedWhat changed
Level 3 uniquely requires all systems in the desired scope to have already achieved Final Level 2 status before a Level 3 assessment can proceed, and it more explicitly addresses specialized assets by requiring either full assessment against all CMMC requirements or segregation into purpose-specific networks. Level 1 and Level 2 document scope and N/A treatment similarly, but the provided Level 3 material goes further on prerequisite status and specialized-asset scope handling.
Why it matters
Someone planning a Level 3 assessment must account for the prerequisite Final Level 2 status and the special treatment of specialized assets; that affects scoping, readiness planning, and whether a desired assessment can even begin. For Level 1 and Level 2, the main difference is the protected information type and associated requirement set, not a fundamentally different scoping model.
Security assessment framework
Requirement baseline and source criteria
ChangedWhat changed
Level 3 adds a different requirement source and assessment framework (NIST SP 800-172/172A, DoD-selected ODPs, and extra applicability/exception handling), while Levels 1 and 2 use NIST SP 800-171A-based assessment structures tied to FAR 52.204-21 or NIST SP 800-171 Rev. 2 requirements.
Why it matters
A reader would learn that the levels are not identical in source criteria or assessment logic: Level 3 is a distinct, more tailored assessment model with extra parameterization and applicability rules, so evidence and evaluation need to follow a different baseline than Levels 1 and 2.
Security assessment framework
Assessment methods and evidence
ChangedWhat changed
The material differences are in scope and emphasis, not in the basic assessment model: Level 1 is a self-assessment for FCI with NIST 800-171A objectives modified for FCI; Level 2 extends the framework to both self and certification assessments for CMMC Level 2; Level 3 uses NIST 800-172A for certification assessments and states that testing is preferred and most objectives will require it. Level 2 and Level 3 also mention DoD CIO adjudications/alternative measures and enterprise/ESP implementation as evidence-supported paths in similar terms, while Level 1 presents analogous exception handling in its own self-assessment context.
Why it matters
A reader would mainly learn that the assessment evidence model is consistent across the three levels, but the governing standard, assessment context, and strength of testing emphasis change as the level increases. That matters for preparing evidence and planning assessments, because Level 3 is more testing-oriented and uses enhanced requirements, while Level 1 is narrower and self-assessment-focused.
Security assessment framework
Assessment findings, scoring, and status determination
ChangedWhat changed
The main difference is depth of documentation, not a different assessment model. Level 1 documents the self-assessment status path to Final Level 1 (Self) and the MET/NOT MET/N/A logic; Level 2 adds more explicit status variants such as Conditional Level 2 and Final Level 2 for Self and C3PAO assessments; Level 3 adds Conditional Level 3 and Final Level 3, plus a compliance score/report framing. None of the parties shows a materially different scoring principle; they all use objective-based findings and the same MET/NOT MET/N/A roll-up.
Why it matters
A reader would learn that the CMMC assessment mechanics are largely consistent across levels, while the documentation becomes more explicit and complete at higher levels about conditional/final status outcomes and reporting. This matters mainly for understanding what evidence and status artifacts must be prepared for each level, not for choosing between different technical behaviors.
Security assessment framework
Requirement entry structure and assessment content
ChangedWhat changed
The main documented difference is that Level 3 explicitly documents assignment/selection handling and ODP treatment within the requirement entry structure, whereas Level 1 and Level 2, as described here, do not. Level 1 also substitutes FCI-focused language for NIST CUI references, and Level 2 ties the structure to NIST SP 800-171 Rev. 2; otherwise the entry architecture is largely the same.
Why it matters
For someone using these guides, the practical difference is mostly in how much requirement-specific detail and parameter handling is exposed in the documentation, especially for Level 3 enhanced requirements. That affects how assessors interpret objectives and evidence, but not the basic assessment workflow of objectives, methods, objects, and findings.
Access control and identity management
Access control requirements
ChangedWhat changed
Level 1 and Level 2 explicitly document full access-control behavior, while Level 3 only documents a partial subset focused on organizationally controlled assets, mutual authentication, and information-flow restrictions; the provided Level 3 material does not establish transaction/function authorization or public-information controls.
Why it matters
A reader can see that Level 3 is not described here as a full access-control package in the same way as Levels 1 and 2; it appears narrower in the supplied documentation, so comparisons of feature coverage would be misleading unless the missing Level 3 areas are documented elsewhere.
Access control and identity management
Identification and authentication requirements
ChangedWhat changed
Level 2 provides the broadest and most explicit identification/authentication requirements; Level 1 is limited to identification, and Level 3 is partial and centered on mutual authentication and trusted-asset/device controls rather than general IA coverage.
Why it matters
A reader would learn that Level 2 is the reference set for comprehensive IA expectations, while Level 1 and Level 3 do not document the same breadth of requirements. For builders, that means assessment evidence and controls need to be planned very differently depending on level, especially if trying to map general user/account authentication versus device or mutual-authentication controls.
Protective security controls
Media protection requirements
ChangedWhat changed
Level 1 and Level 2 explicitly document media disposal/sanitization requirements, with Level 2 expanding into many surrounding controls for CUI media lifecycle management. The retrieved Level 3 material does not document this concept at all; it only covers adjacent asset and isolation controls.
Why it matters
A reader would learn that Level 2 materially broadens the documented media-protection scope beyond Level 1, while Level 3 cannot be used to infer media disposal/sanitization requirements from the retrieved material. For implementation or assessment planning, only Level 1 and Level 2 provide direct evidence on media sanitization/disposal; Level 3 requires separate documentation.
Protective security controls
Physical protection requirements
ChangedWhat changed
Level 3 is only partially documented and focuses on physical/logical isolation and enclave separation, not on facility physical access controls; Levels 1 and 2 explicitly document physical protection controls over people, visitors, logs, devices, and access points, with Level 2 extending scope to monitoring support infrastructure and alternate work sites.
Why it matters
A reader would learn that Levels 1 and 2 provide concrete physical security control requirements and assessment evidence, while Level 3 in this material cannot be used to infer a comparable facility-access program. For implementation or assessment planning, Level 3’s documented concern is network/system isolation, not badges, escorts, access logs, or key management.
Protective security controls
System and communications protection requirements
ChangedWhat changed
Level 1 is limited to foundational boundary protection and public-facing separation; Level 2 documents a much wider set of communications-protection mechanisms; Level 3 documents the most advanced domain-isolation, trust-verification, and automated enforcement model.
Why it matters
A reader would learn that the levels differ mainly in scope and depth of documented safeguards: Level 1 is a narrow baseline, Level 2 adds many specific controls for communications and cryptography, and Level 3 adds cross-domain isolation, trust gating, and automated quarantine/remediation. This matters for assessing which safeguards must be designed, evidenced, and tested at each level.
Protective security controls
System and information integrity requirements
ChangedWhat changed
Level 1 is limited to the foundational integrity controls; Level 2 documents a broader integrity-and-monitoring control set; Level 3 documents enhanced integrity verification and automated trust/baseline enforcement, but the provided material is partial and does not document the malicious-code-protection/update/scanning aspects stated in the concept.
Why it matters
A reader would learn that the three assessment guides do not present the same scope of system and information integrity. Building to Level 2 or 3 means accounting for more monitoring, alert response, and trusted-state verification evidence, but the Level 3 material supplied here is incomplete for the malware-protection portion, so you could not rely on it as a full description of that subtopic.
Security assessment framework
Assessment purpose, level context, and assessment types
ChangedWhat changed
The main differences are in assessment type and level context: Level 1 is only documented as a self-assessment, Level 2 is documented as both self-assessment and certification assessment plus closeout assessments, and Level 3 is documented as DIBCAC-run certification assessment with self-assessment only as a non-certifying preparatory activity. The scope and evidence methodology are broadly comparable across all three, but the eligible assessment paths and resulting statuses differ by level.
Why it matters
For someone using these guides, the practical distinction is which assessment path applies and what outcome it can produce: self-assessment versus certification, whether POA&M closeout is available, and who is authorized to perform the assessment. That affects planning, evidence collection, and whether the result can support a CMMC status decision.
Security assessment framework
Assessment scope and assessment boundary
ChangedWhat changed
The main difference is documentation depth and framing: Level 2 and especially Level 3 tie scope to more explicit boundary, enclave, segregation, and SSP documentation requirements, while Level 1 gives only partial treatment and does not present a distinct assessment-boundary construct.
Why it matters
A reader would learn more detailed scoping and boundary-documentation expectations at Levels 2 and 3, especially for specialized assets, enclave separation, and how boundaries must be described in the SSP. Level 1 provides enough to identify in-scope assets and system boundaries for protection, but less guidance on formal boundary articulation.
Security governance and operations
Awareness and training requirements
ChangedWhat changed
Level 1 is only partially documented and does not establish separate awareness, role-based training, or insider-threat requirements; Level 2 documents those requirements as a defined control family; Level 3 documents a more advanced, exercise-oriented awareness/training model focused on APTs and practical drills.
Why it matters
A reader would learn that the main distinction is not just the presence of training, but the maturity and specificity of the documented requirements: Level 1 uses training as evidence for other controls, Level 2 formalizes awareness and role-based/intrusion awareness expectations, and Level 3 adds advanced-threat content, scheduled refreshers, logs, and hands-on exercises. This affects what policies, curricula, records, and assessment artifacts you would need to prepare.
Security governance and operations
Audit and accountability requirements
ChangedWhat changed
Level 2 is the only set that documents audit and accountability as a complete, formal control family. Level 1 is limited to physical-access logging and adjacent evidence use, while Level 3 only covers adjacent logging/accountability mechanisms inside other domains.
Why it matters
A reader would learn that only Level 2 provides the requirements and assessment approach needed to design or evaluate a real audit/logging program. Level 1 and Level 3 would not be enough on their own to build or assess a comprehensive AU capability because the necessary scope, record content, review, protection, and management expectations are absent or only partial.
Security governance and operations
Configuration management requirements
ChangedWhat changed
The material differs in how completely configuration management is documented and structured: Level 1 is partial and auxiliary, Level 2 is a full standalone CM program, and Level 3 is a narrower but more automated CM approach built around authoritative source, desired state, quarantine/remediation, and automated inventory. Because Level 1 is only partially documented, the observed difference is documentation rather than a proven product capability difference.
Why it matters
A reader would learn that Level 2 is the clearest source for baseline/change-control/least-functionality/user-software requirements, while Level 3 adds automation and authoritative-repository concepts. For implementation planning, this means Level 1 alone is insufficient to derive a complete CM program, and Level 3 should be understood as an automation-focused extension rather than a general CM checklist.
Security governance and operations
Incident response requirements
ChangedWhat changed
Level 2 is the only set that explicitly documents the full incident response requirement structure (handling, reporting, testing). Level 1 is partial and only covers adjacent response behaviors, and Level 3 is partial by focusing on SOC/CIRT operational response and recovery rather than the full IR requirement set, especially testing.
Why it matters
A reader would learn that the documentation maturity differs substantially: Level 2 provides the clearest, most complete incident-response assessment framework, Level 1 leaves incident response implicit in related controls, and Level 3 emphasizes operational response teams and monitoring rather than the same three-part IR requirement structure. That affects what evidence, processes, and assessment artifacts one should expect to prepare.
Security governance and operations
Maintenance requirements
ChangedWhat changed
Level 2 documents maintenance as a complete, explicit control family with detailed procedural and evidence requirements; Level 1 and Level 3 only document partial, adjacent, or embedded maintenance-related activities rather than a standalone maintenance requirement.
Why it matters
A reader would learn that only Level 2 provides a full maintenance compliance model to implement and assess against. Level 1 and Level 3 do not add that same standalone operational scope, so using them for maintenance design would leave gaps in personnel controls, off-site maintenance, records, and session/tool handling.
Security governance and operations
Personnel security requirements
ChangedWhat changed
Level 2 is the only set that fully documents the Personnel Security concept as stated. Level 1 covers only adjacent access/authorization and account/physical-access change handling, while Level 3 covers only an adjacent adverse-information response practice; both are partial and shallower than Level 2.
Why it matters
A reader would learn that the documentation depth differs substantially: only Level 2 provides the full personnel-security workflow for screening and personnel actions, while Levels 1 and 3 leave gaps if you are trying to implement or assess the concept from the guides alone.
Security governance and operations
Risk assessment and vulnerability management requirements
ChangedWhat changed
Level 2 is the most explicit end-to-end risk assessment and vulnerability management set; Level 1 only covers narrower flaw/malware remediation activities, while Level 3 shifts emphasis to threat-informed risk, supply-chain risk, automated detection/remediation, and threat hunting rather than documenting the same broad scanning/remediation framework.
Why it matters
A reader would learn that the levels are not documenting the same risk-and-vulnerability posture: Level 2 gives the clearest operational workflow for scanning, prioritizing, and remediating vulnerabilities, while Level 3 focuses more on threat-informed and automated response mechanisms. That affects how one would map assessment evidence and program controls across the levels.
Security governance and operations
Security assessment, monitoring, and system security planning requirements
ChangedWhat changed
Level 1 is partial and mostly procedural guidance; Level 2 makes assessment, monitoring, and SSP explicit requirements; Level 3 adds deeper threat-informed monitoring, automated remediation, and more detailed planning traceability and exception handling.
Why it matters
A reader learns that the levels are not just different in how much detail they provide: Level 2 and Level 3 require more formalized assessment and planning artifacts than Level 1, and Level 3 further expects threat-driven monitoring and richer SSP content to support higher-assurance decisions and evidence.
Security assessment framework
Assessment program, certification context, and prerequisites
ChangedWhat changed
The main difference is the certification program structure and prerequisites: Level 1 is self-assessment only; Level 2 supports both self-assessment and third-party certification with POA&M closeout paths; Level 3 is a distinct, higher-tier certification program that is only available after Final Level 2 (C3PAO) is already achieved. Level 2 and Level 3 also differ in who performs the assessment (C3PAO vs DIBCAC) and in the prerequisite status needed to enter Level 3.
Why it matters
This affects which assessment route an organization can use, who may conduct it, and what status must already be in place before eligibility. A builder or compliance team would need to route organizations to the correct guide and workflow, especially because Level 3 cannot be pursued without prior Level 2 certification status.
Security assessment framework
Assessment scope, status categories, and key assessment terminology
ChangedWhat changed
The main differences are in how much status terminology and assessment-path structure each level documents. Level 1 documents only self-assessment status and a simpler findings model; Level 2 documents multiple assessment types and several conditional/final status states for both self and C3PAO; Level 3 documents DIBCAC-only status states and the prerequisite Final Level 2 (C3PAO) gate for scoped systems.
Why it matters
For someone building against these guides, the practical difference is which assessment workflow and status labels must be supported: Level 1 is simplest, Level 2 requires handling self vs third-party assessment and POA&M closeout, and Level 3 adds the DIBCAC-specific certification path and eligibility prerequisite. The underlying assessment terminology is broadly consistent across all three.
Security assessment framework
Assessment methodology, evidence activities, and scoring outcomes
ChangedWhat changed
The main differences are in scope, assessor type, and status/outcome handling: Level 1 is self-assessment only and maps to Final Level 1 (Self); Level 2 adds third-party certification and POA&M closeout paths with compliance score/CMMC Status; Level 3 is exclusively DIBCAC certification for higher-tier requirements, explicitly ties to Final vs Conditional Level 3, and emphasizes that most objectives will require testing. Level 3 also uses SP 800-172A (with some SP 800-171A references), while Levels 1 and 2 are centered on SP 800-171A.
Why it matters
A builder or assessor would need to account for different assessment authorities, different final-status pathways, and different evidentiary expectations by level. The documentation also affects what evidence must be retained and how findings roll up to status, especially where Level 2 and Level 3 introduce certification/closeout and conditional/final distinctions beyond Level 1.
Security assessment framework
Requirement description structure and parameter notation
ChangedWhat changed
Level 3 explicitly documents assignment/selection and ODP notation inside requirement statements and assessment objectives; Level 1 and Level 2 do not document such a notation convention in the retrieved material. Level 1 is partial on this concept, and Level 2 documents adjacent notation but not the specific parameter notation asked about.
Why it matters
A reader can rely on Level 3 guidance to see how parameter placeholders and ODP-related statements are represented, but would need to infer or look elsewhere for Levels 1 and 2. For implementers of assessment content, that means Level 3 is more explicit about how to write and read variable requirement text, while Levels 1 and 2 leave that aspect undocumented in the provided material.
Protective security controls
Asset control, boundary protection, and isolation
ChangedWhat changed
The material differs in scope and depth: Level 1 is centered on boundary/isolation controls for FCI and does not establish asset control; Level 2 documents a broader set of asset, boundary, isolation, physical, and media controls for CUI; Level 3 goes furthest by requiring organization-controlled assets and explicitly describing security-domain isolation, secure information transfer, and specialized-asset containment. The main contrast is therefore how completely each set documents the concept, with Level 1 partial and Levels 2–3 progressively more detailed and expansive.
Why it matters
For a builder, this means Level 1 evidence will support mostly network and physical perimeter designs, while Level 2 and Level 3 require much more comprehensive scoping, authorization, segmentation, transfer-control, and enclave architecture artifacts. If you are mapping controls or preparing assessment evidence, the higher levels demand more documentation of what assets are allowed, how boundaries are enforced, and how isolated domains exchange data.
Security governance and operations
Automated compliance enforcement and remediation
ChangedWhat changed
The main difference is in documentation depth and specificity: Level 1 is partial and scattered, Level 2 is broader but still does not establish automation of remediation as such, while Level 3 explicitly documents baseline-driven automated detection, quarantine, restoration, and automated response workflows.
Why it matters
A reader would learn that the later assessment guides provide much clearer, more operationally detailed support for automated compliance enforcement and remediation. For implementation planning, Level 3 is the only one that clearly describes an authoritative-baseline plus ACMS-style enforcement and quarantine/remediation workflow; Level 1 and Level 2 should not be treated as documenting that same end-to-end automated capability.
Access control and identity management
Mutual authentication and trusted asset admission
ChangedWhat changed
Level 3 is the only set that clearly documents mutual/bidirectional authentication as a core requirement and ties trusted asset admission to attestation, known operating state, trust profiles, and blocking untrusted assets. Level 2 documents mutual authentication only in limited contexts and as an implementation/common approach, while Level 1 documents only basic identification and authorization controls.
Why it matters
A reader would learn that Level 3 provides the strongest and most explicit guidance for building systems that must verify both endpoints and admit only trusted devices or components. Level 2 suggests similar protections in some access paths but leaves the broader bidirectional-authentication requirement less explicit, and Level 1 is limited to foundational access control and verification.
Security governance and operations
Security solution rationale and effectiveness evaluation
ChangedWhat changed
The material difference is that Level 3 documents a full threat-informed rationale for selecting security solutions and reassessing their effectiveness, while Levels 1 and 2 only document implementation/effectiveness testing and do not establish that selection rationale; Level 1 is also much more indirect and example-based.
Why it matters
For someone using these guides, Level 3 provides the evidence and decision trail needed to justify why a solution was chosen and how it remains effective against evolving threats. Levels 1 and 2 support proving controls are in place and functioning, but they do not give the same documented basis for architecture or solution selection decisions.
Security governance and operations
Supply chain risk management planning and response
ChangedWhat changed
Level 3 is the only set that clearly documents supply chain risk management as a dedicated, organization-wide planning and response capability; Levels 1 and 2 only cover partial, adjacent, or indirect pieces of it.
Why it matters
A reader would learn that a complete SCRM planning-and-response program is expected at Level 3, while Levels 1 and 2 require related controls and evidence but not the same explicit supply-chain framework. That matters for scoping assessments, selecting evidence, and understanding which artifacts must exist as dedicated SCRM documents versus being covered through general flaw, incident, or risk-management processes.
Protective security controls
Security validation through penetration and integrity testing
ChangedWhat changed
Level 3 is the only set that documents a distinct penetration-testing capability and a standalone integrity-verification approach for boot and security-critical code. Level 1 and Level 2 document testing of controls and integrity-related protections, but nothing found in the provided evidence establishes penetration testing; Level 2 also does not document a dedicated integrity-testing discipline for boot/authenticity verification.
Why it matters
For a builder or assessor, Level 3 requires planning for adversarial testing workflows and cryptographic boot/software integrity verification, while Levels 1 and 2 mainly require evidence that control implementations are tested, monitored, and functioning as intended. The difference affects assessment preparation, tooling, and the kind of evidence that must be produced.
Interactive report
Explore the full report
The report as Docsie shows it: drill from architectural areas to technical areas to findings, search and filter, and open the evidence from each source.
About this example
How it was made
The three guides were imported into Docsie. Compare discovered the topics they cover, researched every topic in each guide, and wrote the summary and findings. Some scope and assessment-method findings overlap. Run on a self-hosted Docsie deployment using OpenAI GPT-5.4 models (Docsie cloud runs Compare on Claude).
Sources
- CMMC Assessment Guide, Level 1 (v2.13) — Source: U.S. Department of Defense, Office of the DoD Chief Information Officer, CMMC Assessment Guide – Level 1, Version 2.13 (September 2024). DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited. Use does not imply DoD endorsement.
- CMMC Assessment Guide, Level 2 (v2.13) — Source: U.S. Department of Defense, Office of the DoD Chief Information Officer, CMMC Assessment Guide – Level 2, Version 2.13 (September 2024). DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited. Use does not imply DoD endorsement.
- CMMC Assessment Guide, Level 3 (v2.13) — Source: U.S. Department of Defense, Office of the DoD Chief Information Officer, CMMC Assessment Guide – Level 3, Version 2.13 (September 2024). DISTRIBUTION STATEMENT A. Approved for public release. Distribution is unlimited. Use does not imply DoD endorsement.
US Department of Defense documents, Distribution Statement A: approved for public release. The CMMC Program rule (32 CFR Part 170) governs; the assessment guides are supplementary. Use does not imply DoD endorsement. Changes made: the summaries and comparisons on this page were generated by Docsie Compare.
Docsie Compare
Moving up a CMMC level?
Upload your current controls, SSP and evidence. Docsie Compare checks them against the next level's requirements and shows what's missing before your assessment.