CMMC Level 1 vs Level 2: make the decision from the work

The useful first question is not which CMMC level sounds more impressive. It is what information your business will handle for a particular piece of work, where that information will go, and what the operative procurement requires. A company label such as “small manufacturer” does not answer those questions. Neither does the fact that a competitor bought a particular software package.

This is a decision framework for management discussion. It does not assign a level or determine eligibility. Read the actual solicitation, contract or subcontract and its amendments, then resolve unclear requirements with the authorized contracting contact. Keep separate records when different systems or work packages have different information flows.

Distinguish the two decisions

First, determine what safeguarding obligations apply to the information and the work. Second, identify the required assessment status and route. Those decisions are connected, but a technical safeguard, an assessment result and a procurement condition are not interchangeable. A readiness project can improve your environment without creating an official CMMC status.

Level 1 addresses the 15 basic safeguarding requirements associated with FAR 52.204-21. Where required, it involves an annual self-assessment and annual affirmation. All 15 must be MET; a Level 1 POA&M cannot substitute for a missing requirement. Level 2 uses the 110 requirements in NIST SP 800-171 Revision 2. Do not assume every Level 2 opportunity currently calls for a third-party assessment.

A fictional supplier with two different jobs

Harbor Fixtures, a fictional business, receives a nonpublic delivery schedule for one order and expects detailed controlled engineering files for another. Its owner initially wants one answer for the entire company. The better discussion begins by separating the two jobs and asking what each file is, who identified it, and which systems will process, store or transmit it.

The table does not decide that the schedule is FCI or that every technical file is CUI. It tells the team what to verify. Publicly available information and simple payment transaction information are excluded from the FAR definition of FCI. CUI requires a law, regulation or governmentwide policy basis; business sensitivity alone is not a CUI designation.

Do not use yesterday’s rollout slide as today’s answer

At our 25 October 2026 source review, the DoD CIO program page reports that Phase II was suspended on 13 July 2026 while Phase I self-assessment requirements continue. That is a reason to check current policy and applicable deviations, not a reason to disregard safeguarding or to assume a specific live contract has changed. Seek written clarification when the acquisition documents and current policy appear inconsistent.

Leave the meeting with a bounded record

Also ask what management is deciding today. It may be authorizing discovery, selecting an implementation option or approving a question to the customer. Those are legitimate outcomes. Keep them separate from a final determination that every applicable requirement has been met. Record the assumptions behind the decision so a later reviewer can see which new fact would change it.

• Name the opportunity or work package, rather than writing “all government work.”
• List information types, their sources and unresolved classifications.
• Identify the systems and service providers involved.
• Record the required level and assessment route exactly as verified, including the document version.
• Assign an owner and review date for each unknown.

Use the decision record to capture that reasoning. A good result may be “awaiting clarification,” accompanied by a precise question. That is more useful than treating an untested assumption as a certification claim. Revisit the record when the work, information, system boundary or acquisition terms change.