.png)
CMMC Level 1 and Level 2 ask for very different things. Learn what separates them, and how to tell which one a shop actually needs to meet.
------------------------------------------------------------------------------------------------------------------
TL;DR: CMMC Level 1 and Level 2 aren't the same requirement at two different sizes. Level 1 covers 15 practices tied to Federal Contract Information (FCI) and applies to nearly every defense contractor. Level 2 covers 110 practices tied to Controlled Unclassified Information (CUI) and only kicks in once that information shows up. Treating Level 2 as "Level 1 plus a little more" is where shops get caught flat-footed.
------------------------------------------------------------------------------------------------------------------
A house with a solid deadbolt and a doorbell camera has covered most of what it needs. Simple to install, doesn't touch the wiring, keeps the obvious risks out. A house where the owner considers what's inside worth real protection needs something else entirely: a monitored alarm system, motion lights, sensors on every entry point. Nobody gets there by bolting on three more deadbolts. It's a different kind of protection, built for a different kind of risk.
CMMC splits the same way. A shop handling only FCI gets Level 1's 15 practices, the deadbolt-and-camera version of compliance. A shop with CUI in the mix gets Level 2's 110, pulled from NIST SP 800-171, and that jump catches a lot of defense contractors off guard.
It catches them off guard because the assumption is almost always wrong in the same direction. A shop expects Level 2 to feel like a heavier version of what it's already doing for Level 1...a few more policies, a little more paperwork. What actually shows up is a different category of work: network segmentation, access logging, incident response plans, things that don't exist yet if a shop's never needed them before. Finding that out during an assessment, instead of months earlier, is an expensive way to learn it.
Knowing which level actually applies, and what that level really asks for, changes the whole timeline. A shop that scopes this early gets to build toward Level 2 on its own schedule. A shop that finds out late gets to build it under pressure, usually against a deadline it doesn't control.
The gap between CMMC's two lower levels isn't a matter of degree. It's a different set of practices for a different category of risk, and getting that straight from the start is what keeps compliance a plan instead of a scramble.
Table of Contents
- What Level 1 Actually Covers
- Level 2 Isn't Level 1 With Extra Steps
- Why the Jump From 15 to 110 Is as Big as It Sounds
- Who Checks the Work: Self-Assessment vs. Third-Party Assessment
- What Actually Decides Which Level Applies
- Building the Timeline Before a Contract Forces It
- The System Has to Match What's Inside
- Key Takeaways
- Frequently Asked Questions
What Level 1 Actually Covers
Level 1 exists for one reason: keeping Federal Contract Information out of places it doesn't belong. The list itself came from FAR clause 52.204-21, the same rule covered in the FCI and CUI post, and it stays narrow on purpose. Fifteen practices, no more.
Most of them read like things a reasonably careful shop is already doing. Require unique logins instead of shared passwords. Limit who can walk into areas where sensitive information sits. Lock a screen before stepping away from it. Sanitize media before it's reused or tossed. None of it demands new hardware or a rebuilt network.
That's the whole point of Level 1. It's a baseline, not a project. A shop that's never touched a compliance framework before can usually get there with policy changes and a few habit shifts, not a six-month build. The bar sits low because the information it protects, while real, doesn't carry the same weight as what shows up once CUI enters the picture.
Level 2 Isn't Level 1 With Extra Steps
Here's where a lot of shops get tripped up. Level 2 doesn't build on Level 1's 15 practices the way a second floor builds on the first. It's a separate rulebook, pulled from NIST SP 800-171, and it asks a shop to do things that have no equivalent at Level 1 at all.
Here's where a lot of shops get tripped up. Level 2 doesn't build on Level 1's 15 practices the way a second floor builds on a foundation. It's a separate rulebook, pulled from NIST SP 800-171, and it asks a shop to do things that have no equivalent at Level 1 at all.
Access control gets specific instead of general: who can reach what, logged and reviewable, not just "lock the door." Incident response stops being a plan in someone's head and becomes documented steps, tested before they're ever needed. Configuration management means knowing exactly what's allowed to run on a system and catching anything that shouldn't be there. Several of these practices only make sense once there's an actual network boundary to apply them to, which is often where a shop starts talking about carving out a separate, tightly controlled part of the network just for the work that touches CUI, rather than locking down the whole floor.
None of that shows up at Level 1 because none of it needs to. Level 2 isn't Level 1 turned up. It's a different job entirely, built around information that carries real consequences if it leaks.
Why the Jump From 15 to 110 Is as Big as It Sounds
Fifteen practices to 110 isn't a step up. It's closer to comparing Delaware to Texas, technically, both are states; nothing else about the comparison holds.
Level 1 covers ground that mostly already gets covered: passwords, physical access, basic hygiene. Level 2 reaches into categories that don't exist yet for a lot of shops. Audit logging that actually gets reviewed. Formal risk assessments done on a schedule, not once and forgotten. System and communications protection, which usually means rethinking how data moves across the network, not just where it's stored. Personnel security screening before someone gets access to CUI in the first place.
None of that is a checklist a shop knocks out over a weekend. Some of it takes new tools. Some of it takes new policies that need to actually be followed, not just written down. Some of it takes rethinking how the network's laid out entirely.
The size of the jump isn't an exaggeration for effect. It's the actual distance between protecting information that matters and protecting information the government has decided carries real risk if it gets out.
Who Checks the Work: Self-Assessment vs. Third-Party Assessment
Level 1 stays in-house. A shop runs its own annual self-assessment, submits the score to SPRS, and has a senior official sign off that the answers are accurate. No outside auditor walks the floor.
Level 2 splits into two lanes, and which one applies depends on how sensitive the CUI actually is. Some Level 2 requirements can still be self-assessed. The ones tied to national security priorities need a third-party assessment from a certified assessor, a C3PAO, who reviews the evidence directly instead of taking a shop's word for it.
That difference changes what "ready" looks like. Self-assessment rewards a shop that's honest with itself about gaps. A C3PAO assessment rewards a shop that's already closed them, since there's no explaining away a missing control to someone whose job is finding it. Knowing which lane applies well before a contract requires it is what separates a shop that walks into an assessment prepared from one that's scrambling to produce evidence it doesn't have yet.
What Actually Decides Which Level Applies
None of this gets decided by guessing or by company size. It comes down to one question, the same one this series opened with: Does the information flowing through a shop count as FCI, or does it cross into CUI?
A shop that only ever touches Federal Contract Information stays at Level 1, no matter how big the contract is or how long the relationship's been running. A shop that handles CUI, even a small slice of it, gets pulled into Level 2, regardless of how small the shop is otherwise. Size and revenue don't factor into it. The information does.
That's why sorting FCI from CUI has to happen before anything else. Get that wrong, and a shop either builds toward the wrong level entirely or misses that Level 2 applies until a contract or an assessor forces the issue. Get it right, and the rest of this post is a roadmap instead of a surprise.
Building the Timeline Before a Contract Forces It
The worst time to figure out which level applies is after a contract officer asks for proof of it. That happens more often than it should, usually because a shop assumed CMMC was something to deal with "when it came up," and then it came up in the form of a deadline.
Contracts naming DFARS 252.204-7019 or 7020 are the clearest early warning sign, since those clauses spell out exactly what a contractor has to report about its current compliance status before award. Catching that language during contract review, rather than after signing, buys months that a shop won't get any other way.
Building toward Level 2 takes real lead time: policy work, technical changes, sometimes a network rebuild. That's a lot to take on solo, and it's often where bringing in outside help to manage the compliance side makes the difference between a shop that's ready and one that's still catching up. Starting that conversation early is what keeps the timeline in a shop's hands instead of a contract officer's.
The System Has to Match What's Inside
Level 1 and Level 2 were never the same requirement at different sizes. Level 1 covers FCI with 15 practices built for a lower-stakes kind of information. Level 2 covers CUI with 110, pulled from NIST SP 800-171, built for information that the government has decided carries real consequences if it leaks. Which one applies comes down to what's actually flowing through a shop, not its size or how long it's been in the defense supply chain. And figuring that out early, well before a contract or an assessor forces the question, is what keeps a shop building toward compliance on its own schedule instead of someone else's.
That timeline matters because the two levels ask for genuinely different things. A shop expecting Level 2 to feel like Level 1 with a few extra boxes checked ends up scrambling once network segmentation, access logging, and incident response show up as real requirements instead of items on a list. The deadbolt-and-camera setup doesn't scale into a monitored alarm system by installing more deadbolts. It takes planning for a different kind of protection from the start.
That's the kind of planning CNWR does with defense contractors across the Toledo area: sorting out which level actually applies, then building a realistic path toward it instead of a last-minute scramble. It's grounded in real experience with CMMC assessments, not a generic compliance checklist pulled from a template.
If a shop's still not sure whether it's looking at a deadbolt job or an alarm system, get in touch with CNWR. Either way, the sooner that's clear, the less it costs to fix.
Key Takeaways
- Level 1 covers FCI with 15 practices. Level 2 covers CUI with 110, pulled from NIST SP 800-171.
- Level 2 isn't a heavier version of Level 1. It's a different set of requirements built for different information.
- Which level applies depends entirely on whether a shop's data crosses into CUI, not on its size or revenue.
- Level 1 stays self-assessed. Level 2 splits between self-assessment and third-party C3PAO review, depending on how sensitive the CUI is.
- Contracts naming DFARS 252.204-7019 or 7020 are an early signal that compliance status will need to be reported soon.
- Sorting out the timeline early keeps a shop building on its own schedule instead of scrambling against someone else's deadline.
Frequently Asked Questions
1. Can a shop stay at Level 1 forever if it never handles CUI?
Yes. A shop that only ever touches FCI has no reason to move to Level 2. The level required is tied to the information a shop actually handles, not a fixed track every contractor eventually climbs.
2. How does a shop know if it needs a C3PAO assessment instead of self-assessment?
It depends on how sensitive the CUI involved is. Requirements tied to national security priorities need a certified third-party assessor. Others can still be self-assessed. A shop's contract language or a compliance advisor can clarify which lane applies.
3. What happens if a shop assumes Level 2 is just "more" of Level 1?
It usually means discovering the gap late, often during an assessment, when things like network segmentation or incident response plans don't exist yet. That's a far more expensive way to find out than scoping it early.