Information
Level 1: FCI.
Level 2: CUI. The information flow and contractual markings determine the protection requirement, not company size.
CMMC levels
Level 1 or Level 2? The information you handle determines the level. Your contract determines the assessment requirement.
Level 1 protects Federal Contract Information (FCI) using 15 FAR 52.204-21 safeguarding requirements. Level 2 protects Controlled Unclassified Information (CUI) using the 110 security requirements in NIST SP 800-171 Revision 2. Under the current Phase 1 implementation, Level 1 Self and Level 2 Self may be required; mandatory Phase II C3PAO requirements are suspended.
Current status · August 2026
Level 2 does not automatically mean a C3PAO assessment.
The CMMC regulation defines both Level 2 (Self) and Level 2 (C3PAO). The Department's current implementation is paused in Phase 1, and its current guidance says procurements may require Level 1 Self or Level 2 Self. The Phase II rollout of mandatory Level 2 C3PAO requirements was suspended July 13, 2026.
Review the solicitation, contract, order and prime flow-down that applies to your organization. The CMMC level and the CMMC assessment type are related but distinct requirements.
Side by side
Key differences in requirements, assessment, and scope.
Requirements
Level 1: 15 safeguarding requirements from FAR 52.204-21.
Level 2: 110 security requirements from NIST SP 800-171 Rev. 2.
Current assessment path
Level 1: annual self-assessment plus annual affirmation.
Level 2 Self: self-assessment every three years plus annual affirmation. Level 2 C3PAO remains in the model but mandatory Phase II use is currently suspended.
POA&M
Level 1: no POA&M; all requirements must be MET.
Level 2: limited POA&M use is permitted under 32 CFR Part 170, with conditional status requirements and a 180-day closeout window.
Scope
Level 1: the Level 1 self-assessment scope is tied to the contractor information systems that process, store or transmit FCI.
Level 2: 32 CFR 170.19 defines specific asset categories including CUI Assets and Security Protection Assets.
Architecture
Level 2 architecture can materially affect cost. Keeping CUI in a deliberately constrained workflow can minimize unnecessary assessment scope. An enclave can help, but it does not automatically make every surrounding asset out of scope.
If you handle FCI only
- Confirm no CUI is present.
- Implement all 15 Level 1 requirements.
- Conduct the annual self-assessment.
- Enter the assessment result in SPRS.
- Complete the annual affirmation.
If you handle CUI
- Confirm the required CMMC level and assessment type.
- Define the Level 2 assessment boundary.
- Implement all 110 Rev. 2 requirements.
- Build the SSP and final evidence.
- Prepare for Level 2 Self when that is the contract requirement while maintaining evidence suitable for independent or government review.
Scope and architecture
A smaller CUI footprint can reduce the implementation burden.
Where the business workflow allows it, a secure CUI enclave can confine CUI email and file sharing to a smaller protected environment instead of allowing CUI to spread through normal corporate collaboration systems. That can reduce unnecessary CMMC scope and cost.
PreVeil is one available enclave approach. It publishes FedRAMP Moderate Equivalency and FIPS 140-3-validated cryptography information and is designed to work alongside existing Microsoft 365 or Google Workspace workflows. Cyberneza can scope, deploy and document a PreVeil enclave when it fits the contract and information flow.
Need to determine which level or assessment type applies?
Send us the applicable clauses and describe the information your organization receives, stores and transmits. Cyberneza can help identify the applicable CMMC level and assessment type, define the preliminary boundary, and sequence the required implementation, documentation and evidence activities.