MAD Security Blog | Cybersecurity For Defense Contractors

CMMC Level 1 vs Level 2 Explained: Requirements, Costs, and Assessments

Written by MAD Security | February 3, 2026


The
Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense framework used to verify that contractors can protect sensitive information within the defense supply chain. Whether your organization handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), understanding the difference between CMMC Level 1 and CMMC Level 2 is essential for maintaining contract eligibility and building a strong cybersecurity foundation. 

This blog breaks down the key distinctions between these two levels so you can prepare with clarity, avoid costly missteps, and confidently align your cybersecurity program with Department of Defense expectations. 

What this means for you: Choosing the correct CMMC level affects your contract opportunities, budget, timeline, and required cybersecurity maturity. 

Overview of CMMC Level 1: Basic Cyber Hygiene for FCI

CMMC Level 1 establishes the foundational cybersecurity practices necessary to protect Federal Contract Information. These requirements come from the Federal Acquisition Regulation 52.204-21 and include 15 essential practices that most organizations already perform. 

Level 1 practices are performed rather than formally managed or documented. Contractors validate compliance through an annual self-assessment and submit the results through the Supplier Performance Risk System. 

CMMC Level 1 typically includes: 

Basic safeguards such as strong passwords and regular software updates 
Access controls that limit who can view or modify systems 
No requirement for formal policies or a third-party assessment 

Because Level 1 is straightforward and low in complexity, many organizations can achieve compliance in a matter of days or weeks. It is the minimum requirement for working with the Department of Defense and the starting point for more advanced cybersecurity expectations. 

 

Overview of CMMC Level 2: Safeguarding CUI with NIST SP 800 171

CMMC Level 2 applies to contractors that create, store, transmit, or process Controlled Unclassified Information. It requires implementation of all 110 security requirements from National Institute of Standards and Technology Special Publication 800 171. These controls represent a fully developed cybersecurity program that is documented, repeatable, and consistently applied. 

A mature Level 2 environment includes: 

Written policies, procedures, and plans for all 14 National Institute of Standards and Technology control families 
Technical safeguards designed to prevent, detect, and respond to cyber threats 
Documentation that demonstrates consistent and repeatable security practices 
A commitment to training, continuous monitoring, and ongoing improvement 

Many contractors pursuing Level 2 must undergo a third-party assessment performed by a Certified Third -Party Assessor Organization. Some non-prioritized programs may qualify for an annual self-assessment, but the requirements themselves do not change. 

Achieving Level 2 typically requires 6 to 18 months. This includes gap analysis, remediation, documentation, training, and preparation for assessment. Costs generally range from $20,000 to more than $100,000 depending on an organization’s cybersecurity maturity. 

 

CMMC Level 1 vs CMMC Level 2: Key Differences at a Glance

The differences between CMMC Level 1 and CMMC Level 2 become much clearer once you compare them side by side. Level 1 focuses on basic protections for Federal Contract Information. Level 2 is a fully developed cybersecurity program designed to protect Controlled Unclassified Information and often requires third party validation.


What this means for you: If your organization handles Controlled Unclassified Information, even occasionally, you will almost certainly require CMMC Level 2. 

 

How to Determine Which Level Applies to Your Contract

Determining your required CMMC level starts with identifying the type of information your organization handles. If your work involves Controlled Unclassified Information in any form, Level 2 is usually required. 

Look for these indicators: 

Presence of Defense Federal Acquisition Regulation Supplement clauses such as 252.204- 7012, 252.204- 7019, 252.204- 7020, or 252.204- 7021 
Work involving technical data, specifications, diagrams, engineering information, or mission related data 
Confirmation from your contracting officer that Controlled Unclassified Information requirements apply 

If you only handle basic administrative contract information, Level 1 may be appropriate. 

Tip: When in doubt, assume Level 2 and confirm with your contracting officer. It is easier to scale requirements down than to start remediation late in the process. 

 

Costs, Resources, and Timelines: What to Expect

Once your required level is clear, the next step is understanding the level of effort involved. 

CMMC Level 1 usually requires: 

Existing basic cyber hygiene practices 
Minimal documentation updates 
A quick annual self-assessment and Supplier Performance Risk System submission 
A typical timeline of days to weeks 
Low overall cost 

CMMC Level 2 usually requires: 

A comprehensive gap analysis 
Technical, procedural, and administrative remediation 
Written policies, procedures, and system security plans 
Security awareness and role-based training 
Preparation and coordination for a Certified Third-Party Assessor Organization assessment 
A timeline of 6 to 18 months 
An overall investment of $20,000 to more than $100,000 

Planning early helps minimize cost overruns and prevents delays during assessment. 

 

How MAD Security Helps You Navigate CMMC

CMMC compliance requires more than technology. It requires expertise, documentation, security operations, and a structured approach. As a Cybersecurity Maturity Model Certification Registered Provider Organization with deep experience in Defense Federal Acquisition Regulation Supplement, National Institute of Standards and Technology Special Publication 800- 171, and Security Operations Center services, MAD Security guides contractors through every phase of the process. 

Through the Completely MAD Security Process, we support you with: 

Deep Dive Discovery to understand your environment and requirements
Gap assessments that identify deficiencies and risk areas 
Policy and documentation development tailored to your operations 
Security operations support including monitoring, detection, and response 
Assessment readiness for both self-assessments and Certified Third- Party Assessor Organization assessments 

What this means for you: You gain a trusted partner who simplifies compliance and strengthens your security posture so you can confidently pursue and maintain Department of Defense contracts. 

 

Conclusion: Make Informed Decisions and Stay Competitive

Understanding the difference between CMMC Level 1 and CMMC Level 2 is essential for any organization working in the defense industrial base. Each level carries its own requirements, costs, timelines, and maturity expectations. Identifying your required level early helps you stay competitive, reduce compliance friction, and avoid contract delays. 

MAD Security is ready to help you determine your required level and chart a clear path to readiness. Contact us today to schedule a no obligation discovery session!

Frequently Asked Questions (FAQs) 

 

Original Publish Date: TO BE FINALIZED

By: MAD Security