## Who needs Level 2 — and who only needs Level 1
The level you need is decided by the information your systems handle, not by your size or your ambition:
- **FCI only** — information provided by or generated for the government under contract, not intended for public release: **Level 1**.
- **Any CUI** — information requiring safeguarding under law, regulation, or government-wide policy (export-controlled data, controlled technical information, and the rest of the CUI Registry): **at least Level 2**. "At least," because select high-sensitivity programs require Level 3 on top of it.
| Information protected |
FCI |
CUI (and FCI) |
| Requirements |
15, from FAR 52.204-21 |
110, from NIST SP 800-171 Rev. 2 |
| Assessment |
Self-assessment, annually |
Self-assessment; C3PAO certification (paused since Jul 13, 2026) |
| Scoring |
MET / NOT MET in their entirety — no partial credit |
Point-scored against 800-171A objectives (110 max) |
| POA&Ms |
Not permitted at any time (32 CFR § 170.21(a)(1)) |
Limited — a conditional status with a plan of action is possible |
| Annual affirmation in SPRS |
Required |
Required |
Here is the part small contractors consistently miss: **Level 1 is your Level 2 foundation.** Every one of the 15 Level 1 safeguards has a direct counterpart among the 110 — limit system access, authenticate users, sanitize media, control physical access, protect boundaries, remediate flaws. A firm that has honestly implemented and documented Level 1 has already built the habits, the evidence discipline, and the first tranche of controls that Level 2 demands. If you haven't locked that floor down yet, run our [free CMMC Level 1 self-assessment](/cmmc-level-1/) — it walks the 15 requirements objective by objective and generates the document package — before you spend a dollar on Level 2 gap analysis.
## FCI vs. CUI
The distinction that decides your compliance tier — and your cost structure:
| Defined by |
FAR 4.1901 |
Executive Order 13556 (the CUI program) |
| Baseline safeguards |
The 15 basic safeguards of FAR 52.204-21 |
NIST SP 800-171 (110 controls) under DFARS 252.204-7012 |
| CMMC level |
Level 1 |
Level 2 at minimum |
| Verification |
Annual self-assessment in SPRS + annual affirmation |
Self-assessment; the third-party (C3PAO) path is currently suspended |
| Cloud requirement |
None specific in FAR 52.204-21 |
FedRAMP Moderate (authorized or equivalent) per DFARS 252.204-7012(b)(2)(ii)(D) |
| Incident reporting |
None in FAR 52.204-21 |
72-hour cyber incident reporting under DFARS 252.204-7012 |
Two notes on reading that table honestly. First, the categories nest in practice: a contractor handling CUI almost certainly handles FCI too, so the CUI column's obligations sit *on top of* the FCI column's — FAR 52.204-21(b)(2) says explicitly that the clause doesn't relieve you of CUI safeguarding requirements under Executive Order 13556. Second, the CMMC program even encodes the relationship: Level 1 assessment objectives are the NIST SP 800-171A objectives with FCI substituted wherever the objective says CUI (32 CFR § 170.15(c)(1)(i)). Level 1 genuinely is the foundation layer of [CMMC Level 2](/federal/cmmc-level-2/) — the same control families, at basic depth.