The two levels are not degrees of the same requirement — they answer to different information, different control sets, and different verification. Level 1 is 15 practices you attest to yourself. Level 2 is 110 practices assessed by a C3PAO. Getting the answer wrong is expensive in both directions: over-scoping buys controls no contract asked for, and under-scoping is discovered at assessment.
Level 1 — FCI. Federal Contract Information: generated for or provided
under a federal contract, not intended for public release.
Level 2 — CUI. Controlled Unclassified Information: categories the
government requires be safeguarded, flowed down by a prime or contracting officer.
Level 1 — 15 practices drawn from FAR 52.204-21 basic safeguarding.
Level 2 — 110 practices from NIST SP 800-171, each with
assessment objectives that have to be evidenced individually.
Level 1 — self-assessment, annually, with an affirmation by a company
official.
Level 2 — a C3PAO in the common CUI case, on a three-year cycle.
C3PAO assessment preparation →
Level 1 — nothing. All 15 practices must be met; there is no deferral.
Level 2 — a limited set, conditionally, with a closeout clock. Not every
practice is eligible, and the ineligible ones are exactly the ones teams try to defer.
Level 1 rarely forces an architecture change.
Level 2 makes every system that touches CUI part of the assessed
boundary — which is why narrowing where CUI lives is the highest-leverage decision available.
How a CUI enclave narrows scope →
Level 1 is usually measured in weeks of tidying and documentation.
Level 2 is measured in quarters, because evidence has to accumulate over
time and implementation cannot be compressed at the end.
CMMC & NIST 800-171 readiness → · Federal cybersecurity support →
Tell us what you receive and from whom. You will get back a written view of which level your contracts point to, where the data that drives it actually lives, and what the readiness path looks like for that level.
