CMMC Level 1 vs Level 2: Which One Applies to You?
The simplest distinction is the information and security requirements in scope: CMMC Level 1 is the 15 basic safeguarding requirements in FAR 52.204-21 for FCI; Level 2 addresses CUI under the applicable CMMC framework and contract requirements. The DoD small-business CMMC page describes the levels and advises contractors to confirm the required level with their contracting officer.
At a glance
| Question | Level 1 | Level 2 |
|---|---|---|
| Information focus | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) under applicable requirements |
| Requirement set | 15 FAR 52.204-21 safeguards | The Level 2 security requirements defined by the applicable CMMC rule and contract |
| Assessment basis | Annual Level 1 self-assessment, results submitted in SPRS, and an Affirming Official's affirmation | Assessment method and status depend on the applicable Level 2 contract requirement and rule |
| What determines applicability? | Contract language, FCI handling, and defined assessment scope | Contract language, CUI handling, assessment scope, and the applicable CMMC requirement |
These are framework distinctions, not a self-diagnosis. FCI is nonpublic information provided by or generated for the Government under a contract, with exclusions described in FAR 52.204-21(a). CUI has its own definition and handling rules. A system's actual information flows, contract clauses, and prime-contractor flow-downs matter; one organization may need help understanding more than one contract or system boundary.
How to find the right direction
- Review the exact solicitation and contract clauses, including any CMMC requirement and information-handling clauses.
- Ask which data is FCI or CUI and identify the systems that process, store, or transmit it. Do not rely only on labels used informally by staff.
- Confirm the assessment scope and required CMMC status with the contracting officer or prime. The scope is not necessarily every system in the company, nor can this page define it for you.
- Use the official 32 CFR Part 170 rule and DoD small-business CMMC resources for the current program requirements.
If Level 1 is specified for your scope, the free Readiness Check offers a starting point for reviewing the 15 safeguards. CyberSure's Level 1 kit provides preparation and documentation materials; it is not a route to or substitute for Level 2 status.
Important limits: CyberSure is a private company, not affiliated with or endorsed by DoD/DoW, the U.S. Army, or any government agency. This guide is general information, not legal advice, certification, or an official assessment. It cannot determine what applies to a particular contract, organization, or information system.