Decision guide · 2-minute quiz below
CMMC Level 1 vs Level 2: which do you need?
The decision rule: handle only FCI (Federal Contract Information) and you need Level 1, which is 17 basic safeguards self-assessed annually. Store, process, or transmit CUI and you need Level 2, all 110 NIST SP 800-171 requirements. Third-party C3PAO assessment was to become the default for CUI contracts under Phase 2, but DoD suspended Phase 2 on July 13, 2026 pending a 60-day review — the self-assessment and SPRS score still apply, and primes can still require it.
Side by side
| Level 1 | Level 2 | |
|---|---|---|
| Triggered by | Federal Contract Information (FCI), the non-public information provided or generated under a government contract | Controlled Unclassified Information (CUI), for example controlled technical information under DFARS 252.204-7012 |
| Requirements | 17 basic safeguarding requirements (the FAR 52.204-21 safeguards, as mapped into NIST SP 800-171) | All 110 NIST SP 800-171 Rev 2 requirements |
| Assessment | Annual self-assessment with an affirmation, no third party involved | Self-assessment or C3PAO-assessed. Third-party certification was to become the default for CUI contracts under Phase 2, but DoD suspended Phase 2 on July 13, 2026 pending a 60-day review; the NIST 800-171 self-assessment and SPRS score still apply, and primes can still require certification |
| POA&M allowed | Never. Every requirement must be fully met | Limited: score ≥88 of 110, generally 1-point gaps only, six requirements never eligible, 180-day closeout (32 CFR 170.21) |
| Typical cost | Mostly your own time; free/low-cost self-serve tooling, no consultant required | Readiness $4,995 self-serve to $14,000–40,000 consultant-led, plus the separate C3PAO assessment ($30,000–75,000 published range) |
Sources: FAR 52.204-21; NIST SP 800-171 Rev 2; 32 CFR 170.21 and 170.3(e); published price bands verified June 2026. Full numbers in the Level 2 cost guide.
Which do I need? Four questions.
Answer what you know. The quiz stops as soon as your answers decide it, and "not sure" is a legitimate answer with its own advice.
Question 1 of 4
Do you hold, or plan to bid on, DoD contracts or subcontracts?
Straight answers
Can one company need both CMMC Level 1 and Level 2?
Yes. The level follows the information and the solicitation, not the company. A shop whose contracts involve only FCI self-assesses at Level 1; the moment a contract involves CUI, Level 2 applies to the systems that store, process, or transmit it. Many contractors run both: Level 1 hygiene everywhere, Level 2 scope where CUI lives.
Does CMMC Level 1 allow a POA&M?
No. Level 1 permits no POA&M at all, so each basic safeguarding requirement must be fully met before you self-assess as compliant and affirm it annually. Limited POA&Ms exist only at Level 2, under the 32 CFR 170.21 rules (score of at least 88, generally 1-point items, 180-day closeout).
Who decides which level my contract requires?
The solicitation. DoD applies CMMC requirements per-solicitation under the 32 CFR 170 phase-in: Phase 1 (since November 10, 2025) put self-assessment requirements into new solicitations. Phase 2 was to make C3PAO-assessed Level 2 the default for contracts involving CUI, but as of July 13, 2026 DoD suspended Phase 2 pending a 60-day review — so the Phase 1 self-assessment and SPRS score requirement remains in force, and a prime can still require certification to award.
Is Level 2 always assessed by a C3PAO?
Not always. A Level 2 self-assessment track exists for a subset of contracts. C3PAO-assessed Level 2 was slated to become the default for CUI contracts under Phase 2, but DoD suspended Phase 2 on July 13, 2026 pending a 60-day review; self-assessment and your SPRS score remain required, and primes can still require certification. Because the third-party requirement may return after the review, the conservative plan for any CUI-handling contractor is still to prepare for it.
Related guides
DFARS 252.204-7012 explained
Just got the clause in a contract? The three duties it imposes — safeguard, 72-hour reporting, flow-down — in plain English, plus your first-week action list.
Do I need CMMC certification?
Whether CMMC applies to you, which level, and the part most people miss — self-assessment vs a third-party C3PAO certification — plus four myths that catch contractors out.
CMMC Level 2 requirements (all 110)
Every NIST SP 800-171 Rev 2 requirement grouped by the 14 families, with each control’s SPRS point value, Level 1 membership, and POA&M eligibility — a free, searchable explorer.
DFARS 252.204-7021 explained
The clause that makes CMMC a condition of contract award — what it requires, how it differs from 7012 and 252.240-7997 (formerly 7019/7020), and what to do when a solicitation carries it.
Tools: SPRS score calculator · scoring methodology · CMMC Phase 2 status
Whichever level it is, the next step is your score
The free assessment walks the requirements in plain English and computes your SPRS score with the DoD methodology, so the level question becomes a plan, not a worry.
Start the free assessment