Short answer: It depends on the information you handle. If your contract involves only Federal Contract Information (FCI), you need CMMC Level 1 — 15 basic safeguarding requirements. If you process, store, or transmit Controlled Unclassified Information (CUI), you need CMMC Level 2 — the 110 requirements of NIST SP 800-171 Rev. 2. Your contract specifies the required level.
FCI vs. CUI: the deciding question
- Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release — for example, contract details, schedules, or internal project correspondence.
- Controlled Unclassified Information (CUI) is information the government requires to be safeguarded under law, regulation, or policy — for example, technical drawings, specifications, or export-controlled data. CUI is usually marked, but not always consistently.
If you handle CUI anywhere in your business, Level 2 applies to the systems that touch it.
Side-by-side comparison
| Level 1 — Foundational | Level 2 — Advanced | |
|---|---|---|
| Protects | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Requirements | 15 (from FAR 52.204-21) | 110 (NIST SP 800-171 Rev. 2) |
| Assessment | Annual self-assessment | Self-assessment or third-party (C3PAO) assessment every three years, depending on the contract |
| Affirmation | Annual, by a senior official, in SPRS | Annual, by a senior official, in SPRS |
| POA&Ms allowed? | No — every requirement must be met | Limited — conditional status requires a score of at least 88/110, only 1-point requirements (plus non-FIPS-validated encryption) may stay open, and they must be closed within 180 days |
| System Security Plan | Not formally required (but strongly recommended) | Required |
| Typical effort for a small business | Weeks | Months |
Level 3 exists for the highest-priority programs. It adds requirements from NIST SP 800-172 and is assessed by the government (DIBCAC). Few small businesses need it.
What Level 1 covers
The 15 Level 1 requirements are basic cyber hygiene: limiting system access to authorized users, controlling external connections, identifying and authenticating users, sanitizing media before disposal, controlling physical access, monitoring visitors, protecting communications at system boundaries, separating publicly accessible systems, patching flaws, using malware protection, and keeping it updated with periodic scans.
What Level 2 adds
Level 2 includes everything in Level 1 and expands across 14 families, including audit logging, configuration management, incident response, multi-factor authentication, encryption with FIPS-validated cryptography, security awareness training, risk assessment, and continuous monitoring. Each requirement is weighted 1, 3, or 5 points in the DoD scoring methodology used for your SPRS score.
Common mistakes
- Assuming Level 1 because you’re small. Level is driven by information type, not company size.
- Not knowing where CUI lives. Without a defined boundary, everything is in scope — and costs balloon.
- Self-scoring optimistically. An inaccurate SPRS score or affirmation carries contractual and False Claims Act risk.
- Waiting for the Phase II decision. NIST SP 800-171 obligations under DFARS 252.204-7012 apply today. See CMMC Phase II: what still applies.
How USCIBER can help
Not sure which level applies? Our CMMC Readiness Review starts by confirming your level from your contracts and information flows, then measures your gaps and estimates your SPRS score. Starting at $7,500.
Sources
- 32 CFR Part 170 — Cybersecurity Maturity Model Certification (CMMC) Program
- FAR 52.204-21 — Basic Safeguarding of Covered Contractor Information Systems
- NIST SP 800-171 Rev. 2 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
- DoD CIO — CMMC program information
This article is general information, not legal advice. Your contract determines your requirements.