What is the difference between CMMC Level 1 and Level 2?

Short Answer

Level 1 protects Federal Contract Information with fifteen requirements and an annual self-assessment. Level 2 protects Controlled Unclassified Information with far more requirements and, in many cases, a third-party assessment. DoD sets the level in each contract based on the information the work involves.

Level 1

Level 1 covers FCI. It is fifteen requirements and fifty-nine assessment objectives, self-assessed each year and affirmed in SPRS. There is no numeric score and no POA&M. Results are scored MET or NOT MET in their entirety.

Level 2

Level 2 covers CUI. It is the 110 security requirements of NIST SP 800-171, with a numeric score, and it can require a third-party assessment by a C3PAO. It is a substantially larger effort than Level 1.

How the level is decided

DoD selects the level for each contract based on whether the work involves FCI or CUI (32 CFR 170.3(d)), and the contracting officer states it in the solicitation and contract through DFARS 252.204-7025 and 252.204-7021. On a subcontract, the prime flows the level down based on the information shared (32 CFR 170.23). This reference center covers Level 1. Which of your systems handle FCI or CUI is the scoping decision you make.