CMMC Levels

CMMC Level 1 vs Level 2: Which One Applies to Your Contract?

The fastest way to scope a CMMC program wrong is to misidentify the level. Level 1 and Level 2 sit on completely different control baselines, completely different assessment regimes, and completely different cost curves. This page walks the legal trigger (FCI vs CUI), the requirement delta (15 vs 110), the assessment delta (self-assessment vs C3PAO, and what the 2026 suspension changed), and how to read a DFARS clause to know which level your contract actually requires.

By Doug Majewski, President, Athena Consulting Group, LLC · Last reviewed: October 17, 2026

Free CMMC Quick Score Check your CUI scope

The legal trigger: FCI vs CUI

Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Almost every federal contract creates FCI. The contract clause that triggers FCI handling is FAR 52.204-21. FAR 52.204-21 + FCI = CMMC Level 1.

Controlled Unclassified Information (CUI) is a defined category of unclassified information that requires safeguarding under federal law, regulation, or government-wide policy. CUI handling is required by DFARS 252.204-7012 (the safeguarding clause) and assessed under DFARS 252.204-7021 (the CMMC clause). DFARS 7012 + CUI = CMMC Level 2.

Requirements: 15 vs 110

Level 1: the 15 basic safeguarding requirements in FAR 52.204-21(b)(1): access control, identification and authentication, media sanitization, physical protection, boundary protection, flaw remediation and malicious-code protection. You self-assess every year and the Affirming Official affirms the result in SPRS. No POA&M is allowed.
Level 2: all 110 controls from NIST SP 800-171 Rev. 2, assessed against the ~320 objectives in 800-171A. Full SSP, full POA&M, full evidence package.
110 vs 15 is about 7x the requirements, and the evidence burden grows faster than the count. Level 2 adds an SSP (3.12.4), POA&M rules and objective-level evidence that Level 1 doesn't require.

Assessment: self vs C3PAO

Level 1 is an annual self-assessment with an affirmation submitted to SPRS. No external assessor.

Level 2 has two forms: Level 2 (Self) and Level 2 (C3PAO). Both run on a three-year cycle with an annual affirmation (32 CFR 170.16, 170.17, 170.22). The solicitation sets which one applies. On July 13, 2026, DoD suspended the CMMC Phase 2 transition, which was to make C3PAO assessments a standard condition of award. While the suspension lasts, solicitations can designate only Level 2 (Self). NIST SP 800-171 Rev. 2 obligations under DFARS 252.204-7012 still apply. See current CMMC status. There is also a Level 3, assessed by DCMA DIBCAC, which adds 24 selected requirements from NIST SP 800-172 and requires a Final Level 2 (C3PAO) status first. During the suspension it isn't designated in new solicitations either.

How to read your contract

FAR 52.204-21 only → Level 1.
DFARS 252.204-7012 + 7019 + 7020 → you must implement NIST SP 800-171 and keep a current assessment score in SPRS. A CMMC level applies only if the contract also includes 252.204-7021 and names a level.
DFARS 252.204-7021 → a CMMC status is required at the level the solicitation names. During the suspension that is Level 1 (Self) or Level 2 (Self).
Covered defense information (CDI) → 7012 safeguarding applies. The CMMC level is whatever the contract designates.
Subcontractor flow-down: the level depends on what the prime flows down to you. FCI only → Level 1 (Self). CUI → at least Level 2 (Self), or Level 2 (C3PAO) where the prime's contract requires it (32 CFR 170.23). Ask the prime in writing.

Frequently asked questions

Can I be Level 1 on one contract and Level 2 on another?

Yes. CMMC level is set per contract, not per company. Many contractors run both — a Level 1 attestation for FCI-only work and a Level 2 enclave for CUI work. The risk is letting CUI leak into the Level 1 environment; that requires the whole environment to be assessed at Level 2.

How do I know if my data is CUI?

Look for explicit CUI markings on the documents the government provides. If unmarked but the contract is for defense work (engineering data, technical data, source selection information, export-controlled), assume CUI and ask the contracting officer in writing to confirm. The CUI Registry at archives.gov/cui lists all categories.

Is Level 2 always a C3PAO assessment?

No. 32 CFR Part 170 has two Level 2 statuses, Level 2 (Self) and Level 2 (C3PAO), and the solicitation names one. Since DoD suspended the Phase 2 transition on July 13, 2026, solicitations designate only Level 2 (Self). If an existing contract still names Level 2 (C3PAO), check with the contracting officer.

What drives the cost difference?

The requirement count (15 vs 110), the SSP and evidence you must keep for Level 2, and remediation of any gaps. Level 1 is mostly internal time plus the annual SPRS entry. Level 2 cost depends on your CUI scope, so scope first.