CMMC for Small Business: Right-Sizing Level 1 and Level 2

Match Effort to Information

• FCI only — Level 1 self-assessment against 15 FAR 52.204-21 requirements
• CUI — Level 2 against 110 NIST SP 800-171 Rev 2 requirements (Self during suspension when designated that way)

Do not implement a 110-control programme because a blog said “everyone needs Level 2.” Read the solicitation.

Lean Moves That Still Pass Scrutiny

1. Shrink scope with a hard CUI enclave instead of boiling the ocean.
2. Prefer one identity plane and one logging destination.
3. Write a short, accurate SSP — length ≠ quality.
4. Track affirmations on a calendar (annual for Level 2).
5. Use POA&M only where Conditional status allows (not Level 1) and close within 180 days.

How CyberSilo Helps

• CSA sized for continuous evidence without a 20-person GRC team
• ThreatHawk when you need AU evidence without building a full SOC
• Honest quotes after scoping — no fake small-business price cards

Frequently Asked Questions

Is Level 1 still 17 practices?

No. Older marketing said 17. The 32 CFR Final Rule locks Level 1 to 15 FAR 52.204-21 basic safeguarding requirements.

Do small businesses need a C3PAO right now?

Only if a contract designates Level 2 (C3PAO). During Phase II suspension, requiring activities may designate only Level 1 (Self) or Level 2 (Self).

Can we skip SPRS if we are small?

No when your clauses require assessment results and affirmations in SPRS. Score max for Level 2 is 110.

Related CMMC Resources

CMMC hub · Checklist · SSP · Scoping · POA&M