1st Defense CMMC, a Shadowscape company
Talk to an Assessor
§01 · CMMC LEVEL CHECK

Which CMMC Level Do You Need?

Answer up to three questions about the information you handle, and see whether Level 1 or Level 2 likely applies, and what it takes.

Free, no email required. Built by CMMC Certified Assessors.

CMMC LEVEL CHECK · QUESTION 1 OF UP TO 3
Do you hold, or plan to bid on, a Department of Defense contract or subcontract?

Count subcontracts and purchase orders from a prime or another defense supplier, not just direct DoD contracts.

3 QUESTIONS · NO EMAILA GUIDE, NOT A DETERMINATION
§02
THE TWO LEVELS

What decides your level.

Your level follows the information you handle, not the size of your company.

FCI

Level 1 (Foundational)

  • For organizations that handle Federal Contract Information only
  • 15 basic safeguarding requirements (FAR 52.204-21)
  • A self-assessment every year, submitted in SPRS, with an annual affirmation
  • POA&Ms are not permitted
What Level 1 takes
CUI

Level 2 (Advanced)

  • For organizations that handle Controlled Unclassified Information
  • 110 requirements of NIST SP 800-171 Rev 2
  • A self-assessment or C3PAO certification every three years, as your contract specifies, with annual affirmations
  • Limited POA&Ms, closed within 180 days
Level 2 assessments

Requirements are defined in 32 CFR §§ 170.15, 170.16, and 170.17.

COMMON QUESTIONS

01What’s the difference between FCI and CUI?
Federal Contract Information (FCI) is non-public information the government provides or that you create for it under a contract. Controlled Unclassified Information (CUI) is more sensitive information that requires safeguarding, such as controlled technical data. FCI points to Level 1; CUI points to Level 2.
02Does CMMC apply to subcontractors?
Yes. CMMC requirements flow down to subcontractors that handle FCI or CUI, and the required level follows the information you handle, not the size of your company.
03Is CMMC still required while Phase 2 is suspended?
Yes. Phase 2, the requirement for C3PAO certification, was suspended on July 13, 2026. Phase 1 did not pause: Level 1 and Level 2 self-assessments, SPRS scores, annual affirmations, and the safeguarding requirements in DFARS 252.204-7012 still apply.
04Is this check a formal determination?
No. It’s a quick guide based on the information you handle. Your contract, or your prime, sets the required level, and a scoping conversation with a Certified Assessor can confirm it.
§03
NEXT STEP

Confirm your level with an assessor.

Tell us about your contracts and the information you handle, and a Certified Assessor will confirm your level and what it takes to get there.

Thirty minutes. No obligation.

CONSULTATION REQUEST · FORM 01A