Resources / CMMC Level 1 vs Level 2
CMMC Level 1 vs Level 2:What Is the Difference?
Last reviewed: October 14, 2026
Level 1 is for companies that handle only federal contract information (FCI) and requires 15 basic safeguarding practices. Level 2 is for companies that handle controlled unclassified information (CUI) and requires 110 security requirements taken from NIST SP 800-171 Revision 2. Level 2 is a much larger effort, and for many contracts it is verified by an outside assessor.
Current status, October 15, 2026
DoD suspended CMMC Phase 2 on July 13, 2026, so third-party (C3PAO) assessments are not being required in new or existing contracts while a reform task force reviews the program. Level 1 and Level 2 self-assessments, SPRS scores, annual affirmations, and DFARS 7012 with NIST SP 800-171 still apply, and voluntary C3PAO assessments remain available. Which level verifies you is set by your contract, so confirm with your prime or contracting officer. See the details.
Side by side
| Level 1 | Level 2 | Level 3 | |
|---|---|---|---|
| Protects | Federal contract information | Controlled unclassified information | CUI for the highest-priority programs |
| Requirements | 15, from FAR 52.204-21 | 110, identical to NIST SP 800-171 Rev 2 | 24 selected from NIST SP 800-172, added to Level 2 |
| Who verifies | Self-assessment | Self-assessment or third-party (C3PAO), set by the contract | Government assessment by DoD (DIBCAC) |
| How often | Annually | Every three years | Every three years |
| Affirmation | Annual | Annual | Annual |
Requirement counts and sources come from 32 CFR 170.14. Assessment frequency and affirmation come from 32 CFR 170.15 through 170.18. A Level 3 status also requires a current Level 2 (C3PAO) certification.
What each level feels like
Level 1 is basic cyber hygiene: limiting who can access your systems, keeping software patched, protecting against malware, and controlling physical access. Many small businesses already do most of it. The work is documenting it and making the annual affirmation honestly.
Level 2 is a full security program. It covers 14 areas, including access control, audit logging, incident response, risk assessment, configuration management and system protection. It requires a system security plan, written policies, evidence for each requirement, and people who can explain how the controls work. Most organizations need months of preparation. See typical timelines.
How do I know which level my contract requires?
The contract says. DoD sets the required level in the solicitation, and primes flow it down to you. If you handle CUI, expect Level 2. Whether it is a self-assessment or a third-party assessment depends on the contract. See do subcontractors need CMMC.
Can I fix gaps after the assessment?
In a limited way. For Level 2, you can achieve a conditional status if your score is at least 80 percent of the 110 requirements (88 points) and your open items fit the rules for a plan of action and milestones. You then have 180 days to close them. Six requirements cannot be left open, including the system security plan, and open items generally must be low-weighted (32 CFR 170.21). Do not plan on relying on this. Aim to meet the requirements before assessment.
Frequently asked questions
Can I start with Level 1 and move up later?
Only if your contracts allow it. If you handle CUI, Level 1 does not satisfy the requirement.
Is Level 2 the same as NIST 800-171?
The requirements are identical, but CMMC adds the assessment process, status reporting in SPRS and annual affirmation. See NIST 800-171 and DFARS 7012.
Does Level 3 apply to me?
Only if your contract requires it, which is limited to the highest-priority programs.
Want help working out where you stand?
Call 877-855-CMMC or email [email protected]. Related: CMMC Level 2, CMMC readiness.