If you have heard about different CMMC levels and want to know which one applies to your company, this article explains the difference in plain terms.
The short answer
The level depends on the type of information your company handles. Level 1 protects Federal Contract Information (FCI) with 15 basic safeguards. Level 2 protects Controlled Unclassified Information (CUI), which is more sensitive, with 110 security requirements. Your contract specifies which level is required.
Side by side
| Level 1 | Level 2 | |
|---|---|---|
| Protects | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Requirements | 15, from FAR 52.204-21 | 110, from NIST SP 800-171 Revision 2 |
| Assessment | Annual self-assessment | Self-assessment or third-party certification assessment by a C3PAO every three years, depending on the contract |
| Affirmation | Annual, by a senior company official | Annual, by a senior company official |
| Open items allowed | No. All 15 requirements must be met. | Limited open items are allowed in some cases and must be closed within 180 days |
| Typical effort for a small business | Manageable with basic safeguards and good records | Significant, usually requiring specialized help |
How to tell if you handle CUI
- Documents or drawings you receive are marked "CUI" or "Controlled" in a banner or footer.
- Your contract includes DFARS 252.204-7012, which covers safeguarding of covered defense information.
- Your contract or prime contractor tells you CMMC Level 2 is required.
If you are unsure, ask your prime contractor or contracting officer. Do not assume your company only handles FCI if any of the signs above apply.
What about Level 3?
Level 3 applies to a small number of contractors working on the most sensitive programs. It adds requirements on top of Level 2 and is assessed by the government. It rarely applies to small subcontractors.
Does AffirmReady cover Level 2?
No. AffirmReady focuses only on CMMC Level 1. If your company handles CUI, you will need resources beyond AffirmReady. AffirmReady's Terms of Service also prohibit entering CUI, classified information, or export-controlled data anywhere in the service.
Important
This article is a plain-language summary, not legal advice. Your specific contracts determine which level applies.
Still need help?
If you have questions about which level applies to you, email support@affirmready.com and include your company name. Our team is available Monday through Friday, 8:00 AM to 5:00 PM Eastern, and replies within one business day.