What is the difference between CMMC Level 1 and Level 2?

“CMMC Level 1 covers 17 basic cybersecurity practices for contractors handling Federal Contract Information (FCI) and allows annual self-assessment. Level 2 requires 110 security practices aligned with NIST SP 800-171 and applies to contractors handling CUI. Starting November 2026, Level 2 requires a mandatory third-party assessment by an accredited C3PAO — a self-assessment will no longer be sufficient.”