diff --git a/libwvdrmengine/cdm/core/include/cdm_engine.h b/libwvdrmengine/cdm/core/include/cdm_engine.h
index 6ba8420e..0c2783ad 100644
--- a/libwvdrmengine/cdm/core/include/cdm_engine.h
+++ b/libwvdrmengine/cdm/core/include/cdm_engine.h
@@ -151,6 +151,9 @@ class CdmEngine {
   virtual CdmResponseType QueryKeyStatus(const CdmSessionId& session_id,
                                          CdmQueryMap* query_response);
 
+  // Query security level support
+  static bool IsSecurityLevelSupported(CdmSecurityLevel level);
+
   // Query the types of usage permitted for the specified key.
   virtual CdmResponseType QueryKeyAllowedUsage(const CdmSessionId& session_id,
                                                const std::string& key_id,
diff --git a/libwvdrmengine/cdm/core/src/cdm_engine.cpp b/libwvdrmengine/cdm/core/src/cdm_engine.cpp
index fb26b741..964596d6 100644
--- a/libwvdrmengine/cdm/core/src/cdm_engine.cpp
+++ b/libwvdrmengine/cdm/core/src/cdm_engine.cpp
@@ -815,6 +815,25 @@ CdmResponseType CdmEngine::QueryOemCryptoSessionId(
   return session->QueryOemCryptoSessionId(query_response);
 }
 
+bool CdmEngine::IsSecurityLevelSupported(CdmSecurityLevel level) {
+  LOGI("CdmEngine::IsSecurityLevelSupported");
+  metrics::CryptoMetrics alternate_crypto_metrics;
+  std::unique_ptr<CryptoSession> crypto_session(
+      CryptoSession::MakeCryptoSession(&alternate_crypto_metrics));
+
+  switch (level) {
+    case kSecurityLevelL1:
+      return
+          crypto_session->GetSecurityLevel(kLevelDefault) == kSecurityLevelL1;
+    case kSecurityLevelL3:
+      return crypto_session->GetSecurityLevel(kLevel3) == kSecurityLevelL3;
+    default:
+      LOGE("CdmEngine::IsSecurityLevelSupported: Invalid security level: %d",
+           level);
+      return false;
+  }
+}
+
 /*
  * Composes a device provisioning request and output the request in JSON format
  * in *request. It also returns the default url for the provisioning server
diff --git a/libwvdrmengine/cdm/include/wv_content_decryption_module.h b/libwvdrmengine/cdm/include/wv_content_decryption_module.h
index bfb702b4..d5ade737 100644
--- a/libwvdrmengine/cdm/include/wv_content_decryption_module.h
+++ b/libwvdrmengine/cdm/include/wv_content_decryption_module.h
@@ -80,6 +80,9 @@ class WvContentDecryptionModule : public android::RefBase, public TimerHandler {
   virtual CdmResponseType QueryOemCryptoSessionId(
       const CdmSessionId& session_id, CdmQueryMap* response);
 
+  // Query security level support
+  static bool IsSecurityLevelSupported(CdmSecurityLevel level);
+
   // Provisioning related methods
   virtual CdmResponseType GetProvisioningRequest(
       CdmCertificateType cert_type, const std::string& cert_authority,
diff --git a/libwvdrmengine/cdm/src/wv_content_decryption_module.cpp b/libwvdrmengine/cdm/src/wv_content_decryption_module.cpp
index d68cabab..2cb15525 100644
--- a/libwvdrmengine/cdm/src/wv_content_decryption_module.cpp
+++ b/libwvdrmengine/cdm/src/wv_content_decryption_module.cpp
@@ -213,6 +213,11 @@ CdmResponseType WvContentDecryptionModule::QueryOemCryptoSessionId(
   return cdm_engine->QueryOemCryptoSessionId(session_id, response);
 }
 
+bool WvContentDecryptionModule::IsSecurityLevelSupported(
+    CdmSecurityLevel level) {
+  return CdmEngine::IsSecurityLevelSupported(level);
+}
+
 CdmResponseType WvContentDecryptionModule::GetProvisioningRequest(
     CdmCertificateType cert_type, const std::string& cert_authority,
     const CdmIdentifier& identifier, const std::string& service_certificate,
diff --git a/libwvdrmengine/cdm/test/request_license_test.cpp b/libwvdrmengine/cdm/test/request_license_test.cpp
index f6ec27b8..7295b731 100644
--- a/libwvdrmengine/cdm/test/request_license_test.cpp
+++ b/libwvdrmengine/cdm/test/request_license_test.cpp
@@ -4291,6 +4291,21 @@ TEST_F(WvCdmRequestLicenseTest, QueryOemCryptoSessionId) {
   decryptor_.CloseSession(session_id_);
 }
 
+TEST_F(WvCdmRequestLicenseTest, IsSecurityLevelSupported) {
+  // Level 1 may either be or not be supported. Invoking the method without
+  // imposing any expecations to make sure it completes.
+  bool is_supported = WvContentDecryptionModule::IsSecurityLevelSupported(
+      wvcdm::kSecurityLevelL1);
+  EXPECT_FALSE(WvContentDecryptionModule::IsSecurityLevelSupported(
+      wvcdm::kSecurityLevelL2));
+  EXPECT_TRUE(WvContentDecryptionModule::IsSecurityLevelSupported(
+      wvcdm::kSecurityLevelL3));
+  EXPECT_FALSE(WvContentDecryptionModule::IsSecurityLevelSupported(
+      wvcdm::kSecurityLevelUnknown));
+  EXPECT_FALSE(WvContentDecryptionModule::IsSecurityLevelSupported(
+      wvcdm::kSecurityLevelUninitialized));
+}
+
 TEST_F(WvCdmRequestLicenseTest, DISABLED_OfflineLicenseDecryptionTest) {
   decryptor_.OpenSession(config_.key_system(), NULL, kDefaultCdmIdentifier, NULL,
                          &session_id_);