I’m roughly familiar with CMMC and have achieved an ATO on a government network of a custom web app, so I’m onboard with assessments.

But for CMMC - I’m with a small business that operates with the M365 GCC suite. We don’t have our own network nor an office as we are very small. We have users that are remote spread geographically.

For these levels, is it a prerequisite to get the L1 before you get L2?

And because my boss is asking, is it even worth it to then try and go for L3? Heard that L3 assessments aren’t even happening yet.