The level of CMMC certification your organization needs is determined by the type of information in your contracts, not by company size, revenue, or preference. This page breaks down the differences so you can identify which level applies and what it requires.
| Level 1 | Level 2 | |
|---|---|---|
| Information Type | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Security Requirements | 15 basic safeguarding practices from FAR 52.204-21 | 110 security requirements from NIST SP 800-171 Rev 2 |
| Assessment Method | Annual self-attestation | Third-party assessment by a certified C3PAO (triennial) |
| Documentation | Basic compliance affirmation | System Security Plan (SSP), Plan of Action and Milestones (POA&M), policies, procedures, and evidence artifacts |
| SPRS Score | Not applicable | Required, posted to SPRS, score range of -203 to 110 |
| Typical Cost | Minimal for most organizations | $50,000 to $250,000+ for preparation, plus C3PAO assessment fee |
| Timeline to Achieve | Weeks to a few months | 12 to 18 months for most organizations |
| Enforcement Start | Phase 1 (Nov 2025) | Phase 2 (Nov 10, 2026) |
| Applies When | Contract includes FAR 52.204-21 | Contract includes DFARS 252.204-7012 and/or DFARS 252.204-7021 |
The most common misconception about CMMC levels is that they correspond to company size or contract value. They do not. The level is determined entirely by whether your contract involves Federal Contract Information or Controlled Unclassified Information. A small machine shop processing CUI needs Level 2 just as a large prime contractor does. A large company handling only FCI needs only Level 1.
The practical question for most defense contractors is whether CUI enters their environment. If you receive technical drawings marked with CUI banners, if your contract includes a DD Form 254, or if DFARS 252.204-7012 appears in your contract clauses, Level 2 is almost certainly what applies.
Federal Contract Information is information provided by or generated for the government under contract that is not intended for public release. It is a broad category that covers most non-public contract-related information. Controlled Unclassified Information is a more specific, more sensitive category that the government has determined requires safeguarding and dissemination controls. CUI includes technical data, export-controlled information, and dozens of other categories listed in the National Archives CUI Registry.
The distinction matters because it determines not just which CMMC level applies, but the entire scope of your security obligations, documentation requirements, and assessment process. For a deeper analysis of this distinction and its implications for scoping, the CUI classification white papers in the research library address common edge cases.
Level 2 is not simply Level 1 with additional controls. It represents a fundamentally different security program. The 110 requirements in NIST SP 800-171 span 14 control families covering access control, awareness and training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, risk assessment, security assessment, system and communications protection, and system and information integrity.
Each requirement must be documented in a System Security Plan that describes how the control is implemented in your specific environment. The SSP must be supported by policies, procedures, and evidence artifacts that demonstrate operational implementation, not just intent. The CMMC Controls Library provides individual reference cards for all 110 requirements.
Level 1 verification is straightforward: an authorized company representative completes an annual self-attestation affirming that the 15 practices are in place. Level 2 requires an on-site assessment by a C3PAO, a CMMC Third-Party Assessment Organization certified by the CyberAB. The assessment is conducted against all 110 requirements and results in a certification that is valid for three years.
The C3PAO assessment pipeline is finite. The number of certified assessment organizations and qualified assessors is limited, and demand is growing as enforcement milestones approach. Contractors who begin the process early have a meaningful advantage in scheduling their assessment within the enforcement timeline.
The CMMC Decision covers the strategic and executive-level decisions involved in preparing for Level 2 certification. The white paper library includes detailed research on assessment capacity, CUI scope reduction, and the enforcement timeline. For contractors wondering how CMMC requirements apply to small businesses, a dedicated guide addresses the specific challenges facing small manufacturers.
A brief conversation to review your contract clauses and determine whether your obligations point to Level 1, Level 2, or both.
Schedule a Consultation →