Because it defines three compliance levels, CMMC is more flexible than NIST 800-171, and “right-sizes” a supplier’s compliance footprint based on the data it is handling.