Not every DoD contract needs CMMC Level 2. Level 1 (17 basic safeguarding practices, annual self-assessment) covers contracts handling Federal Contract Information only. Level 2 (110 NIST 800-171 practices, third-party assessment for most) applies when Controlled Unclassified Information is involved. The contract's solicitation states the required level — check it before spending a dollar on the wrong one. Which level are your contracts requiring?