Insights · Comparison
CMMC Level 1 versus Level 2
CMMC Level 1 applies to contractors handling Federal Contract Information and requires the basic safeguarding practices in FAR 52.204-21, confirmed by annual self-assessment and affirmation. CMMC Level 2 applies to contractors handling Controlled Unclassified Information and requires the 110 security requirements of NIST SP 800-171, confirmed either by self-assessment or, for most CUI contracts, by a certification assessment from an authorized third-party assessment organization. The level is determined by the information in the contract, not by the contractor’s preference. Level 2 is a substantially larger program, and the difference between a self-assessed score and what an assessor finds is where contractors fail.
At a glance
The criteria that decide it.
| Criterion | CMMC Level 1 | CMMC Level 2 |
|---|---|---|
| Information protected | Federal Contract Information | Controlled Unclassified Information |
| Requirements | Basic safeguarding practices from FAR 52.204-21 | NIST SP 800-171 (110 requirements) |
| Assessment | Annual self-assessment and affirmation | Self-assessment, or third-party certification assessment, as the contract specifies |
| Documentation | Minimal | System Security Plan, plan of action, policies, evidence |
| Scope management | Rarely a factor | Enclave design determines what is assessed |
| Effort | Modest | A sustained program with a defined assessment date |
Criteria
Each one, explained.
Which level applies
The contract and the information flow determine the level. A contractor that receives CUI from a prime is at Level 2 regardless of size. Primes flow the requirement down, so subcontractors should expect the same level as the information they handle.
Requirements and documentation
Level 1 is a short list of practices most organizations already perform. Level 2 is the full 800-171 set with a System Security Plan, a plan of action for gaps, policies, and evidence an assessor can sample. The documentation must describe the environment as it is, not as intended.
Assessment
Level 1 is affirmed by the contractor. Level 2 for most CUI contracts is assessed by a C3PAO, and the difference between the contractor’s self-assessed SPRS score and the assessor’s finding decides the outcome. Readiness work exists to close that gap before the assessment date.
Scope
At Level 2, where CUI lives determines what is assessed. An enclave that confines CUI to a defined environment keeps scope manageable; CUI spread across the enterprise puts everything in scope.
Recommendation
Who each option suits.
Determine the level from the contract and the information, not from ambition. If the organization handles or expects to handle CUI, plan for Level 2 as a program: gap assessment, enclave design, documentation written to practice, evidence pack and an assessment date. If only FCI is involved, meet Level 1 properly and keep the affirmation current. Contractors uncertain of the information they hold should resolve that first.
Related
Where this applies.
Sources
Primary references.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days