CMMC Level 1 vs Level 2: which one does a small shop need?
The deciding factor is the kind of information in the contract. Federal Contract Information with no CUI points to Level 1, a 15-practice self-assessment. Controlled Unclassified Information points to Level 2, a third-party C3PAO assessment on a three-year cycle.
Level 1
Fifteen practices aligned to FAR 52.204-21, covering basic safeguarding of Federal Contract Information. The company assesses itself every year and affirms the result in SPRS. No auditor. This is the lane for contracts where the only sensitive information is FCI.
Level 2
One hundred ten practices aligned to NIST SP 800-171, covering CUI. Most Level 2 contracts require an assessment by an accredited third party (a C3PAO), repeated every three years. This is the lane once CUI enters the picture, for example controlled technical data in defense drawings.
How a small shop tells
Read the contract and the flow-down from the prime. Look for the CMMC level stated in the solicitation, and ask the prime's security contact which information categories your work touches. Do not guess. A shop that bids Level 1 work while handling CUI will fail the requirement at award, and a shop that pays for a Level 2 assessment it does not need has spent money for nothing. When the answer is Level 1, start with the free walkthrough.
Educational guide, not legal or compliance advice. Confirm current requirements against the CMMC rule (32 CFR Part 170) and your contract.