CMMC Level 1 vs. Level 2: What Actually Changes for Your Business
Level 2 isn't Level 1 with more requirements. What changes in effort, scope, scoring and cost when you move from FCI to CUI, using the rule's own numbers and the DoD's own cost estimates.
The difference between CMMC Level 1 and Level 2 starts with the information you handle. Federal Contract Information (FCI) puts you at Level 1, and Controlled Unclassified Information (CUI) puts you at Level 2. CUI vs. FCI covers how to tell which you have. This post is about what happens to your business once you know.
The short answer: Level 2 isn’t Level 1 with more requirements bolted on. It’s a different kind of program, with a written plan, a score, an assessment that may come from outside, and a lot more evidence to keep.
The two levels, side by side
- Who assessesYou, every yearYou or a C3PAO, every three years; the contract decides
- Annual affirmationYesYes
- POA&M allowed?Never: all 15 must be metLimited: 88+ score, 1-point items, six never
- System security planNot required by the ruleRequired, and can’t go on a POA&M
- ScoringMET or NOT MET, all or nothingA 110-point score; items worth 1, 3 or 5
- DoD’s cost estimate, small entity$5,977 a year$37,196 (self) or $104,670 (C3PAO), per three years
The number that hides the real jump
Going from 15 requirements to 110 sounds like a sevenfold increase, and in objectives it’s more than fivefold, from 59 to 320. But the bigger change is in kind. Level 1’s requirements cover six families: access control, identification and authentication, media protection, physical protection, system and communications protection, and system and information integrity. Level 2 adds eight families that don’t appear at Level 1 at all:
Awareness and TrainingAudit and AccountabilityConfiguration ManagementIncident ResponseMaintenancePersonnel SecurityRisk AssessmentSecurity Assessment
Those families are where most of the ongoing work lives: logging and reviewing events, managing configurations and changes, handling incidents, assessing risk, testing your own controls, and training people. Level 1 is mostly about locking things down. Level 2 is about running a security program and being able to show it.
A plan, a score, and less room for error
The system security plan. The rule doesn’t require an SSP at Level 1. At Level 2 it’s the backbone of the assessment: it documents your scope, how each requirement is met, and how special assets are treated. It’s also one of six requirements that can never go on a POA&M (32 CFR § 170.21(a)(2)(iii)), so without one there’s no Conditional status to fall back on.
The score. Level 1 is scored all or nothing: every one of the 15 requirements is MET or the assessment isn’t. Level 2 produces a score out of 110, with each requirement worth 1, 3 or 5 points, and it can go negative (§ 170.24). That score also decides whether you can use a POA&M: you need at least 88, and only 1-point items can stay open. (More in CMMC POA&Ms and the 180-day closeout.)
The scope. At Level 1, the systems that process, store or transmit FCI are in scope, and Specialized Assets such as operational technology are left out entirely (§ 170.19(b)). At Level 2, scope has categories: CUI assets assessed against everything, Security Protection Assets assessed for what they do, Contractor Risk Managed Assets documented and checked if questions arise, and Specialized Assets documented in your inventory, SSP and network diagram.
Who assesses you, and who decides
At Level 1 you assess yourself every year, enter the result in SPRS, and a senior official affirms it. At Level 2 the assessment is every three years, either a self-assessment or one by a C3PAO, with an affirmation every year in between.
You don’t choose which one applies. The rule puts it on the Department: “Program managers and requiring activities are responsible for identifying the CMMC Status that will apply to a procurement” (§ 170.5(b)), and the contracting officer writes it into the clause. While Phase 2 is suspended, new solicitations ask for self-assessments, but that’s a pause, not a change to the rule.
One useful rule cuts the other way. A Level 2 status “also satisfies the requirements for” Level 1 for the same assessment scope, so organizations that will need Level 2 don’t need to do Level 1 separately for the same systems.
What it costs, by the Department’s own math
The DoD estimated the cost of CMMC assessments when it published the rule (89 FR 83092). For a small entity, it put a Level 1 self-assessment and affirmation at $5,977 a year, a Level 2 self-assessment at $37,196 over three years, and a Level 2 C3PAO assessment at $104,670 over three years.
Read those numbers for what they are. They cover the assessment, the reporting and the affirmations, and nothing else: DoD “did not consider the cost of implementing the security requirements themselves because implementation is already required” by FAR 52.204-21 and DFARS 252.204-7012. For most organizations moving up to Level 2, implementation is the larger cost by far, because it’s where those eight new families turn into tools, procedures and people’s time.
What to do with this
If you’re at Level 1 today and expect CUI, start with the parts of Level 2 that take longest to show: the SSP, and the recurring work in those new families, which needs months of dated records before an assessor will believe it. If you’re not sure which level your next contract will carry, our three-question level check takes a minute.
Sources: 32 CFR Part 170, §§ 170.5, 170.14, 170.15–170.17, 170.19, 170.21, 170.22 and 170.24; CMMC Program final rule, 89 FR 83092 (October 15, 2024), regulatory impact analysis; FAR 52.204-21; NIST SP 800-171 Revision 2 and SP 800-171A (June 2018).