CMMC Level 1 vs Level 2: Which Do You Need? Complete Comparison

The Two Levels That Matter

CMMC 2.0 streamlined the original five levels into three, but for most defense contractors, the decision comes down to Level 1 or Level 2. Here's the definitive comparison.

Level 1: Federal Contract Information (FCI)

Level 1 applies to contractors who handle Federal Contract Information (FCI): information provided by or generated for the government under contract that isn't intended for public release.

Requirements

• 15 practices derived from FAR 52.204-21
• Self-assessment only; no third-party audit required
• Annual affirmation submitted to SPRS.mil
• Covers the 15 safeguarding requirements in FAR 52.204-21, including access, communications, media, physical, and system protections

Who Needs Level 1

Level 1 may apply when the contract specifies CMMC Level 1 for systems that process FCI but not CUI. Review the actual solicitation and contract rather than inferring the level solely from clause presence. Examples may include contractors who:

• Provide services involving FCI but not CUI
• Perform services that don't involve sensitive technical data
• Handle general contract correspondence but not CUI

Cost and Effort

Preparation time depends on the organization's current safeguards, evidence, and scope. Level 1 covers 15 safeguarding requirements and requires an annual self-assessment and affirmation when contractually required.

Level 2: Controlled Unclassified Information (CUI)

Level 2 is where it gets serious. This level applies to contractors who process, store, or transmit Controlled Unclassified Information (CUI) technical drawings, specifications, test data, source code, and other sensitive-but-unclassified information.

Requirements

• 110 controls from NIST SP 800-171 Rev 2
• Current suspension: Level 2 Self only; the regulatory framework also provides for C3PAO assessments when DOD resumes permitting those designations
• 320 assessment objectives from NIST SP 800-171A
• SPRS score submitted to SPRS.mil
• A current SSP; a POA&M only when unresolved requirements are documented and permitted

Who Needs Level 2

DFARS 252.204-7012 alone does not prove that a contractor receives CUI or establish the CMMC assessment type. Review the contract, CUI markings and guidance, data flows, DFARS 252.204-7021, and flow-down terms. Potentially in-scope organizations include:

• Any contractor receiving technical data or specifications marked as CUI
• Subcontractors with CUI flow-down from primes
• IT providers managing systems that store or process CUI
• Manufacturers with CUI-marked drawings or processes

Cost and Effort

Level 2 preparation time and implementation cost vary widely. DoD's final-rule estimates address assessment and affirmation costs, not the full cost to remediate an organization's environment.

Side-by-Side Comparison

The Subcontractor Question

The most common confusion: do subcontractors need Level 2?

Under 32 CFR 170.23, the prime must flow down the CMMC requirement appropriate to the information and required assessment type and ensure the subcontractor has the required current CMMC status before award. During the current suspension, DOD direction permits only Level 1 Self and Level 2 Self designations. Check the latest prime contract, subcontract, modification, CUI flow, and specified level and assessment type.

Company size does not determine the required level or assessment type. Tools can organize preparation work, but they do not establish applicability, eliminate qualified support needs, or replace a required assessment.

What If You're Not Sure?

1. Check the solicitation and contract for DFARS 252.204-7021 and the specified CMMC level and assessment type.
2. Determine whether the systems process FCI, CUI, or neither using contract and government guidance.
3. Ask your contracting officer or prime contractor directly.
4. When uncertain, seek contract-specific guidance rather than assuming a level.

Start Your Assessment

Whether you need Level 1 or Level 2, the first step is the same: understand your current posture.

Start your free CMMC assessment. Review all 110 requirements and estimate your SPRS score, free forever.