Level 1 vs Level 2: Which Actually Applies to You

The question I get most often from shops under fifty people is some version of “we’re only Level 1, right?” It is almost always asked hopefully, and it is almost always the wrong question, because the level is not something you pick. It is a consequence of what is in your contracts.

The difference between the two levels is roughly a factor of seven in requirements and, for a small shop, a factor of ten or more in cost. So it is worth about an afternoon to get the answer right.

The short version

	Level 1	Level 2
Triggered by	Federal Contract Information (FCI)	Controlled Unclassified Information (CUI)
Requirements	15	110
Source standard	FAR 52.204-21	NIST SP 800-171 Rev. 2
Assessment	Self, annually	Self or C3PAO, valid 3 years
Affirmation	Annual, by an Affirming Official	Annual, by an Affirming Official
POA&Ms allowed	No — all 15 must be met	Yes, within limits
Scored in SPRS	Met / Not Met	Numeric, 110 down to -203

Everything else is detail hanging off the first row.

FCI is a much wider net than people expect

Here is the definition, straight out of FAR 52.204-21(a):

Information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

Read that carefully and notice what it does not say. It does not say sensitive. It does not say technical. It does not say marked. If the Government gave it to you under a contract, or you produced it under a contract, and it is not public and not an invoice, it is FCI.

That covers the delivery schedule. The email thread with the contracting officer about a slip. The statement of work. The quality plan you wrote for them. Almost every company that has ever held a federal contract has FCI, which is why FAR 52.204-21 flows into essentially everything, including commercial-item buys and micro-purchases, and why Level 1 is the floor rather than an achievement.

CUI is narrower, and it is the Government’s call

CUI, under 32 CFR 2002.4, is information the Government creates or possesses — or that you create or possess for or on behalf of the Government — that a law, regulation or government-wide policy requires be handled with safeguarding or dissemination controls.

The operative difference from FCI is the phrase “a law, regulation, or Government-wide policy.” CUI is not a judgment call about sensitivity. It is a category listed in the CUI Registry with an authority behind it — export-controlled technical data, controlled technical information, critical infrastructure, procurement and acquisition information, and a few dozen others.

And the designation is the Government’s job, not yours. You do not get to decide something is CUI, and you do not get to decide it is not. What you get to decide is what you do when the contract says one thing and the drawings say another — which happens constantly, and which I will take apart properly in a separate post on telling CUI and FCI apart inside your own contract file.

The clauses are the tell

Stop guessing from the nature of the work and go read the contract. Open the clause list and look for these:

If you see	It means
FAR 52.204-21 and nothing else	FCI. Level 1 territory.
DFARS 252.204-7012	The Government expects covered defense information. Level 2 territory, and 110 controls are already contractually required regardless of CMMC.
DFARS 252.204-7021	A CMMC level is a condition of the contract. The level itself is stated in the solicitation.
DFARS 252.204-7025	Notice of the CMMC level required for that solicitation.

One caution on clause numbers. As of early 2026 the DFARS cybersecurity clauses were reorganized into Part 240, and 252.204-7019 was deleted outright. If you are working from a checklist written before then, some of the numbers on it no longer exist. I went through that renumbering in SPRS Scoring Explained.

The presence of 252.204-7012 is the single most useful signal in the whole file. It is the clause that obligates you to NIST SP 800-171 — all 110 requirements — by contract, today, with no reference to CMMC at all. Plenty of companies are contractually on the hook for 800-171 and think they are a Level 1 shop because nobody has said the word CMMC to them.

You can be both, and most people are

Levels attach to information systems, not to companies. A machine shop with two Government customers can perfectly well have a Level 2 enclave holding controlled technical information for one program and a Level 1 environment handling everything else.

That is not a loophole. It is the intended design, and it is the single most effective cost control available to a small contractor — the whole argument in CUI Scoping. Fifteen requirements across the shop and 110 across five people is a very different bill from 110 across the shop.

The price of that design is discipline. The boundary has to be real, it has to be documented, and CUI has to actually stay inside it. A separated enclave that everyone routes around is worse than no enclave, because you have paid for it and you still have CUI on the general network.

What Level 1 actually asks for

The 15 requirements in FAR 52.204-21(b)(1) are basic hygiene, and I mean that descriptively rather than dismissively. They cover limiting system access to authorized users and to the transactions those users are permitted; verifying and controlling connections to external systems; controlling information posted on publicly accessible systems; identifying and authenticating users and devices; sanitizing or destroying media before disposal or reuse; limiting physical access and escorting visitors; monitoring and protecting communications at boundaries; separating public-facing systems from internal ones; keeping systems patched; running current malicious-code protection with periodic and real-time scans.

Two things people underestimate. First, there are no POA&Ms at Level 1 — all 15 must be met, full stop, and you affirm that annually. Second, “limit physical access” and “escort visitors” are requirements a lot of small shops fail on paper because nobody has ever written down that the front door is locked and there is a visitor log at the desk. The control is usually in place; the documentation is not.

What Level 2 adds

The 110 requirements of NIST SP 800-171 Rev. 2 across 14 families. The 15 Level 1 items are a subset, so nothing you did for Level 1 is wasted, but the shape of the work changes entirely. Level 1 is a configuration exercise. Level 2 is a management-system exercise: audit logging you actually review, incident response you have practised, configuration baselines, media protection, FIPS-validated cryptography, security awareness training with records, and — the one that catches everyone — a System Security Plan good enough to assess against.

Level 2 also brings scoring. Your SPRS number starts at 110 and comes down by 1, 3 or 5 points for each requirement not met, and it can go negative. A prime can see whether you have a current score posted. The mechanics are in SPRS Scoring Explained, and the money is in How Much Does CMMC Compliance Actually Cost?

What the July suspension changed, and what it did not

Since 13 July 2026, CMMC Phase 2 is suspended. In practice that means program managers may currently designate Level 1 (Self) or Level 2 (Self) only. Third-party certification through a C3PAO cannot be made a condition of award while the review runs, and the November 2026 Phase 2 date no longer applies.

What did not change:

• FAR 52.204-21 and its 15 requirements
• DFARS 252.204-7012 and all 110 of NIST SP 800-171 Rev. 2
• Self-assessment, SPRS submission and annual affirmation
• 72-hour incident reporting
• Flow-down obligations to your subcontractors
• False Claims Act exposure for an inaccurate score

So the suspension changed who checks your homework. It did not change the homework. And primes are not waiting — flow-down is a private contract obligation between you and them, unaffected by the Department’s enforcement pause, and several large primes have kept supplier deadlines in place. If your customer is a prime rather than the Government directly, the suspension may not have reached you at all.

More on the legal state of play in Is CMMC Cancelled?

How to actually decide, in about an afternoon

• Pull every active contract, subcontract and purchase order. Including the ones from primes. Especially those.
• Search each clause list for 7012. If it is there, you are in Level 2 territory for that contract’s data, regardless of what anyone has told you about CMMC.
• Look at what you actually received. Drawings, specifications, technical data packages, models. Check for CUI banner markings, distribution statements and export control notices.
• Check where that material lives right now. Email, shared drive, ERP, the machine controller, a vendor portal, somebody’s laptop. This is usually the uncomfortable part.
• Ask, in writing, when the answer is unclear. A short note to the contracting officer or the prime’s supply chain contact asking whether CUI is anticipated under the contract, and what the CUI identification and marking guidance is. Keep the reply.

That last step is the one people skip because it feels like admitting ignorance. It is the opposite. A written question and a written answer is the strongest evidence you can hold about what you reasonably believed, and if the answer comes back “no CUI anticipated,” you have just saved yourself a five-figure program.

The failure mode to avoid

It is not being Level 2 and thinking you are Level 1. That one is expensive but it is recoverable, because the gap is visible the moment somebody looks.

The expensive failure is deciding you are Level 2 across the entire company because a single line item on a single contract brought CUI in the door. That decision gets made in an afternoon and costs for years. Scope it first, then pick the level, and expect the answer to be “both, in different places.”

---

Where to go next

• Not sure which level applies to you? The CMMC readiness quiz takes about five minutes.
• Our CMMC guide for small contractors walks through scoping, levels and scoring from the beginning.
• Ready to document either level properly? Start with our CMMC packets.