Adam Kangiser, Iviry’s Compliance Analyst
For defense contractors, compliance with the Cybersecurity Maturity Model Certification (CMMC) is no longer optional—it’s a necessity for securing and maintaining Department of Defense (DoD) contracts. With CMMC 2.0 now in effect, companies handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) must meet specific security requirements.
But not all contractors require the same level of certification. CMMC is divided into three levels, with Level 1 and Level 2 being the most relevant for small and mid-sized businesses in the defense industrial base (DIB). Understanding the difference between these two levels is critical to determining your organization’s compliance requirements.
CMMC Level 1: Basic Cyber Hygiene
Who Needs It?
CMMC Level 1 applies to contractors that only handle Federal Contract Information (FCI)—information that is not intended for public release but also does not contain sensitive or classified content. This typically includes basic contract-related data such as project deadlines, pricing, or general communications with the DoD.
Key Requirements:
- Organizations must implement 17 basic cybersecurity practices aligned with the Federal Acquisition Regulation (FAR) 52.204-21.
- These practices focus on basic cyber hygiene, such as:
- Using strong passwords and access controls.
- Installing security updates and patches.
- Limiting access to sensitive systems.
- Conducting basic employee cybersecurity awareness training.
Assessment Process:
Self-assessment is allowed for Level 1 compliance, meaning contractors do not need an external third-party audit. However, they must annually attest that they are meeting these requirements.
Bottom Line:
CMMC Level 1 is considered the entry-level cybersecurity standard for government contractors. While these requirements improve overall security, they do not provide sufficient protection for more sensitive government data.
CMMC Level 2: Advanced Cybersecurity for CUI
Who Needs It?
CMMC Level 2 is required for contractors that store, process, or transmit Controlled Unclassified Information (CUI)—which includes sensitive government data that, while not classified, requires additional safeguards to prevent unauthorized access.
Key Requirements:
- Contractors must implement 110 security controls aligned with the NIST SP 800-171 framework, covering areas such as:
- Multi-factor authentication (MFA) for system access.
- Encryption of sensitive data in transit and at rest.
- Regular security monitoring and incident reporting.
- Strict access controls and user permissions.
Assessment Process:
- Third-party assessments (C3PAO audits) are required for most organizations handling CUI, ensuring they meet security standards before contract awards.
- However, some contractors can self-attest if they handle only low-risk CUI—though this comes with additional scrutiny due to the potential risk of supply chain vulnerabilities.
Bottom Line:
CMMC Level 2 is significantly more complex than Level 1 and is meant to align defense contractors with DoD cybersecurity expectations. The extra security controls help protect sensitive government data and reduce risks associated with cyber threats.
Key Differences at a Glance
| Feature | CMMC Level 1 | CMMC Level 2 |
| Who Needs It? | Contractors handling only FCI | Contractors handling CUI |
| Number of Controls | 17 controls (FAR 52.204-21) | 110 controls (NIST SP 800-171) |
| Assessment | Self-assessment (annual) | Third-party audit (C3PAO) for most; some may self-attest |
| Focus Areas | Basic cyber hygiene (passwords, updates, access control) | Advanced cybersecurity (MFA, encryption, continuous monitoring) |
| Security Risk | Low-risk data | Higher sensitivity, requires stricter protections |
What This Means for Defense Contractors
- If you only handle FCI, you need Level 1 compliance, which requires basic cybersecurity practices and an annual self-assessment.
- If you store, process, or transmit CUI, you must meet Level 2 compliance, which includes significantly more security controls and an official assessment by a third-party auditor (unless eligible for self-attestation).
Failing to meet the appropriate CMMC level could result in lost contract opportunities or non-compliance penalties. Given the DoD’s increased focus on cybersecurity and the rising threat of cyberattacks against defense contractors, it’s crucial to evaluate your organization’s security posture and ensure you’re aligned with the right CMMC requirements.
