CMMC Level 1 vs Level 2 is a data and contract decision, not a company-size decision. A supplier with ten employees can handle CUI and face Level 2 requirements; a larger firm may have an FCI-only scope. Read the solicitation and map where information is processed, stored and transmitted before deciding what applies.
Start with the CMMC readiness checklist. For budget and scheduling decisions, use the separate CMMC deadline and cost guide.
How do Level 1 and Level 2 compare?
| Decision | Level 1 | Level 2 |
|---|---|---|
| Information protected | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Control baseline | FAR 52.204-21 basic safeguarding requirements | 110 NIST SP 800-171 Rev. 2 requirements |
| Assessment route | Annual self-assessment | Self-assessment or C3PAO assessment, as specified |
| Evidence | Demonstrate the applicable safeguards operate | Demonstrate implementation across the CUI boundary |
| Affirmation | Annual affirmation | Annual affirmation; assessment generally every three years |
| Open gaps | No Level 1 POA&M allowance | Conditional status only within applicable rules and limits |
The current FAR baseline has 15 basic safeguarding requirements. Older materials may show different counts; use the current rule and assessment guidance rather than mixing versions.
Metric
Traditional MSP
Core12 MIP
Approach
Reactive break-fix; wait for tickets
Proactive Managed Intelligence; prevent before impact
Speed
SLA-based response (4+ hrs)
24/7 monitoring, <15 min detection
Security
Basic antivirus & firewall
Zero Trust, CMMC-ready, continuous pen testing
AI & Automation
None or ad-hoc scripts
AI ticket triage, workflow automation, predictive analytics
Advisory
Quarterly reviews (maybe)
Embedded vCTO with roadmap tied to business KPIs
Compliance
Paper-based checklists
Continuous monitoring (NIST 800-171, CMMC, HIPAA)
What should you map before choosing a level?
Identify contract information, its source and its designation. Map email, shared drives, endpoints, cloud applications, remote access, backups and service providers that can access the information. Confirm classifications with the prime or contracting officer where unclear; do not label all business records CUI or assume unmarked data is harmless.
| Area | Question to answer | Evidence to retain |
|---|---|---|
| Contract | Which clauses and level apply? | Contract and flow-down requirements |
| Data | Which information is FCI or CUI? | Classification and handling instructions |
| Systems | Where does that data travel? | Current data-flow and boundary records |
| People | Who can access it? | Access approvals and role records |
| Suppliers | Which external services touch it? | Agreements and applicable evidence |
Core12 supports organizations with 10 to 50 employees across the Southeast. A small headcount may simplify administration, but it does not remove contract obligations or substitute for evidence.
What changes when CUI is in scope?
Level 2 calls for a documented and implemented control environment, not a product bundle. Suppliers need to explain how requirements are met across the boundary, retain evidence, and assign operational ownership. An SSP should describe the actual environment and implementation. Logging that is merely enabled but never reviewed is not the same as an operating monitoring process.
Focus on access controls, identity, configuration, audit records, incident response, communications protection and recovery. Technology choices should follow the control requirements and boundary. Buying a tool does not itself establish compliance.
Who performs the assessment?
Level 1 uses self-assessment and affirmation under the rule. Some Level 2 contracts permit self-assessment; others require an authorized C3PAO assessment. Check the solicitation rather than assuming all Level 2 suppliers need the same route. Level 3 is a separate government-assessment route beyond this comparison.
Core12 is a readiness and implementation partner. We help scope systems, document gaps, implement controls and organize evidence. We do not award CMMC certification, act as your contracting officer or guarantee an independent assessment result.
How do you maintain status after assessment?
Assign control owners, review access and system changes, retain operational evidence and meet the applicable affirmation cadence. Assessment scope can change when new systems, vendors or data flows are introduced. Ask who reviews those changes and who signs the affirmation. Treat ongoing operations as a continuing responsibility rather than a one-time checklist exercise.
The CMMC services page explains readiness scope. The deadline and cost guide owns scheduling and proposal-budget questions, so this comparison does not create a second competing cost page.
Use the IT Risk Report for operational risk context and the AIQ Score for a separate AI-readiness baseline. Neither diagnostic establishes CMMC status.
Sources: Level 1 self-assessment and affirmation; CMMC program requirements; DFARS requirements. Not legal advice.