Your employee count does not determine your CMMC level. Start with the information handled and the status required by the governing contract.
Level 1: basic safeguarding for FCI
FCI is nonpublic information provided by or generated for the Government under a contract, subject to the definition's exclusions. Level 1 incorporates the 15 safeguarding requirements in FAR 52.204-21. When Level 1 (Self) applies, the organization conducts an annual self-assessment, records the result in SPRS, and affirms compliance.
Level 1 requires all applicable safeguards to be MET. It does not offer a conditional CMMC status supported by a POA&M, and there is no C3PAO certification assessment path for Level 1.
Level 2: protecting CUI
CUI is a defined government information category, not a label for every confidential business document. CMMC Level 2 incorporates 110 requirements from NIST SP 800-171 Revision 2. It requires a more extensive review of the environment, implementation, and supporting evidence.
The program defines Level 2 (Self) and Level 2 (C3PAO). Self-assessments are performed by the organization; Level 2 certification assessments are conducted by an authorized or accredited C3PAO. Level 2 assessment results are generally current for three years, subject to continued compliance and annual affirmations. Conditional status has additional restrictions and a limited closeout period.
How the 2026 pause affects the decision
The July 2026 suspension paused the Phase II transition; the Department says Phase I self-assessment requirements remain. Do not equate handling CUI with an automatic current requirement to purchase a third-party assessment, and do not equate the pause with permission to stop implementing applicable safeguards.
Review the required status in your actual documents and seek clarification about any affected third-party requirements or amendments. Customer supplier conditions and government contract requirements should be identified separately.
Choose your first engagement
If information types or contract requirements are unclear, start with scoping. If the requirement is known but implementation is uncertain, start with a gap assessment. If controls are established but records and ownership drift over time, discuss managed compliance. Continuum helps establish that starting point without presenting an introductory questionnaire as an official assessment.
Relevant government sources
Review current source material alongside your actual contract and customer instructions. This guide provides general education; it does not determine your organization’s compliance status.