CMMC Level 1 vs. Level 2: Which One Does Your Manufacturing Shop Need?
CMMC Level 1 or Level 2? Here's how manufacturers can tell which one applies, what each level takes, and where CMMC stands after the Phase 2 pause.
A purchasing manager at a machine shop forwards an email from a prime contractor. It asks for the company's "CMMC level" and SPRS score by the end of the month. Nobody in the building is quite sure what that means, and the owner wants to know one thing: how much work is this going to be?
The answer depends almost entirely on one question: CMMC Level 1 vs Level 2, which one applies to you? Level 1 is a manageable project for most small shops. Level 2 is a real program that can take many months. Getting the level wrong in either direction costs you, either in wasted money or in lost contracts.
My partner Mukesh has spent 25 years in cybersecurity, and I've spent 15 years building and managing networks. Between us, we've seen a lot of manufacturers panic over CMMC when they didn't need to, and a few relax when they shouldn't have. Here's how to figure out where you actually stand.
In this guide
- Where CMMC stands right now
- CMMC Level 1 vs Level 2 at a glance
- FCI or CUI: the question that decides your level
- What Level 1 actually takes
- What Level 2 actually takes
- Mistakes we see manufacturers make
- A 30-day plan to figure out your level
- Frequently asked questions
Where CMMC stands right now
CMMC is the Cybersecurity Maturity Model Certification program. It's how the Department of Defense (which now also goes by the Department of War) checks that contractors are protecting the information they handle. The rule became effective in late 2024, and CMMC requirements started showing up in contracts in Phase 1, which began on November 10, 2025.
Phase 2 was supposed to start on November 10, 2026. That's the phase that would have made third-party Level 2 certification the default for many contracts involving CUI. On July 13, 2026, the department paused Phase 2 and set up a reform task force to review the program. As of mid-October 2026, no new Phase 2 date has been announced.
Here's the part people miss: the pause did not pause everything. Phase 1 self-assessments are still required where a contract calls for them. SPRS scores and annual affirmations still matter. And DFARS 252.204-7012, the clause that already requires most defense contractors handling CUI to implement NIST SP 800-171 and report cyber incidents, still applies.
This is a moving target. Please confirm the current status with your contracting officer, your prime, or a qualified CMMC assessor or attorney before you make decisions. I'm a network engineer, not a lawyer.
CMMC Level 1 vs Level 2 at a glance
There are three CMMC levels. Most small and mid-sized manufacturers only need to worry about the first two. Level 3 is for a smaller group of contractors working on the most sensitive programs.
CMMC Level 1 (Foundational)
- Protects: Federal Contract Information (FCI)
- Requirements: 15 basic safeguarding requirements from FAR 52.204-21
- Assessment: an annual self-assessment
- Reporting: results entered in SPRS, plus an annual affirmation from a senior official
- Open items: generally not allowed. You need to meet all 15.
CMMC Level 2 (Advanced)
- Protects: Controlled Unclassified Information (CUI)
- Requirements: the 110 security requirements in NIST SP 800-171 Rev. 2
- Assessment: either a self-assessment or a third-party assessment by a C3PAO, depending on the contract
- Frequency: every three years, with annual affirmations in between
- Open items: a limited plan of action (POA&M) is allowed for some requirements if you hit a minimum score, but they must be closed within a set window
The jump from 15 requirements to 110 is the whole story. Level 2 also expects written policies, a System Security Plan, and evidence that controls actually work day to day.
FCI or CUI: the question that decides your level
Your level isn't something you choose. It's driven by the type of information you receive, store, or create under a defense contract, and by what the contract itself says.
What FCI looks like
FCI is information provided by or generated for the government under a contract that isn't meant for public release. For a manufacturer, that often includes things like purchase orders, delivery schedules, and contract details. If you have a DoD contract or subcontract at all, you very likely handle FCI.
What CUI looks like
CUI is a more sensitive category that the government has marked or identified as needing protection. For manufacturers, the common examples are controlled technical information, like engineering drawings, specifications, and technical data packages. Export-controlled data can also fall here.
How to tell which one you have
- Look at your contracts and subcontracts for DFARS 252.204-7012 and the CMMC clause, DFARS 252.204-7021.
- Check the drawings and files you receive. Are they marked CUI, or do they carry distribution statements?
- Ask your prime contractor directly what level they will flow down to you.
- Map where those files go once they arrive: email, file shares, CAD workstations, the shop floor.
If you receive CUI, you're looking at Level 2. If you only handle FCI, Level 1 is likely your target.
What Level 1 actually takes
The good news: Level 1 is basic cyber hygiene. A lot of shops are closer than they think.
The 15 requirements in plain English
The requirements cover roughly six areas:
- Access control: only authorized people and devices get in, and they only do what they need to.
- Identification and authentication: every user has their own login, and passwords are managed properly.
- Media protection: drives and devices holding FCI are wiped or destroyed before disposal.
- Physical protection: offices and server closets are locked, visitors are escorted, and access is logged.
- System and communications protection: a firewall protects your network boundary, and public-facing systems are kept separate.
- System and information integrity: systems are patched, and antivirus or endpoint protection is installed, updated, and scanning.
A realistic Level 1 checklist
- Get rid of shared logins, including the "shop" account everyone uses on the floor PC.
- Confirm your firewall is supported, updated, and configured to block what it should.
- Turn on automatic patching for Windows and common apps, and check it actually runs.
- Make sure every computer has current endpoint protection.
- Lock the server room or network closet and keep a visitor log.
- Write down how you dispose of old drives and laptops.
- Document all of this. The assessment is a self-assessment, but you need to be able to back it up.
If you want a broader starting point, our post on 10 steps to protect your company covers many of the same basics.
What Level 2 actually takes
Level 2 is where the work multiplies. The 110 requirements span 14 families, including incident response, audit logging, configuration management, risk assessment, and security awareness training.
The documents you'll need
- A System Security Plan (SSP) that describes your environment and how each requirement is met
- Policies and procedures for each requirement family
- A network diagram showing where CUI lives and moves
- An asset inventory, including shop-floor systems that touch CUI
- A POA&M for anything not yet in place
The technical work that usually takes longest
- Multi-factor authentication for remote access and privileged accounts
- Centralized logging and someone actually reviewing the logs
- FIPS-validated encryption for CUI at rest and in transit
- Moving email and file storage to an environment that can handle CUI, which often means a government-focused cloud tenant
- Incident response procedures that line up with the 72-hour reporting requirement in DFARS 7012
Shrinking the scope
One of the smartest moves for a small manufacturer is to limit where CUI goes. If drawings only live in one secure enclave and a few engineering workstations, you assess that enclave, not every PC in the building. This is where good network design pays off, and it's the part of CMMC I enjoy most as a network engineer.
Plan for time. For a company starting from scratch, getting ready for Level 2 commonly takes many months, sometimes a year or more, depending on your starting point and budget.
Mistakes we see manufacturers make
- Assuming Level 2 when you only have FCI. That can mean spending a lot of money you didn't need to.
- Assuming Level 1 when CUI is quietly arriving by email. This is the more dangerous mistake.
- Treating the Phase 2 pause as a reason to stop. DFARS 7012 and your self-assessment obligations still apply.
- Inflating an SPRS score. Submitting an inaccurate score or affirmation can create False Claims Act exposure.
- Forgetting the shop floor. CNC machines, CAD stations, and old Windows PCs that touch drawings are in scope.
- Buying tools before mapping data. Know where your CUI is first, then pick the technology.
A 30-day plan to figure out your level
You don't need to solve CMMC in a month. But in 30 days you can know exactly what you're dealing with.
- Week 1: Pull every DoD contract and subcontract. Note any DFARS 7012 or 7021 clauses and the CMMC level listed.
- Week 1: Email your primes and ask what level they expect from you and by when.
- Week 2: Trace where contract documents and drawings land: inboxes, shared drives, CAD systems, USB drives.
- Week 2: Check whether any files are marked CUI or carry distribution statements.
- Week 3: Score yourself honestly against the 15 Level 1 requirements, or against the 110 Level 2 requirements if CUI is present.
- Week 4: List the gaps, estimate the effort for each, and decide what you'll handle in-house versus with outside help.
If you're also weighing which tools and platforms to standardize on, this post on choosing the right technology for your business may help.
Frequently asked questions
Do I need CMMC Level 1 or Level 2?
It depends on the information you handle. If you only handle Federal Contract Information, you likely need Level 1. If you receive or create Controlled Unclassified Information, such as controlled technical drawings, you'll likely need Level 2. Your contract and your prime should confirm it.
Is CMMC Level 1 a self-assessment?
Yes. Level 1 is an annual self-assessment against 15 requirements, with results entered in SPRS and an annual affirmation by a senior company official. There's no third-party audit for Level 1, but your answers need to be accurate and backed by evidence.
Is CMMC Phase 2 still happening in November 2026?
Phase 2 was scheduled for November 10, 2026, but it was paused on July 13, 2026 while the department reviews the program. As of mid-October 2026, no new start date has been announced. Self-assessment requirements and DFARS 7012 obligations still apply, so check with your contracting officer or assessor for the latest status.
How long does CMMC Level 2 take to prepare for?
For a small manufacturer starting from scratch, Level 2 readiness commonly takes many months and can run a year or longer. The biggest factors are how much of your network handles CUI, your current security tools, and how much documentation you already have.
Can a small manufacturer do CMMC Level 1 without outside help?
Many can, especially if they already have a supported firewall, unique logins, patching, and endpoint protection. Outside help is most useful for a quick gap check and for making sure your documentation would hold up if questioned.
Not sure which CMMC level applies to you?
That's a good question to answer before you spend a dollar on new tools. Our free cybersecurity assessment looks at your network, endpoints, backups, and security controls, and we'll give you a plain-English view of where you stand against the basics.
There's no obligation. If you're dealing with CUI, we'll also help you think through scope and next steps, and point you toward an authorized assessor when you're ready for a formal assessment. Request your free cybersecurity assessment here.
Related reading
- Cybersecurity for Roanoke Small Businesses: 10 Steps to Protect Your Company
- Managed IT Services in Roanoke, VA: What Local Businesses Should Expect
- IT Consulting: How to Choose the Right Technology for Your Business
Harsha is a co-founder of SoftwarePac Technologies in Roanoke, VA, and a network engineer with 15 years of experience.