Federal cybersecurity acronyms are an industry by themselves. Contractors get pulled into FAR 52.204-21, NIST 800-171, DFARS 7012, CMMC Level 1, CMMC Level 2, FedRAMP, and StateRAMP — sometimes all in the same week, often by people who can't explain the difference. This post is the plain-English map.
Start here: FCI vs CUI
Before any of this matters, figure out what kind of government data you handle. The framework that applies depends entirely on the data type.
| Data type | Definition | Examples |
|---|---|---|
| FCI — Federal Contract Information | Information not intended for public release that's provided by or generated for the government under a contract. | Statement of work, contract correspondence, delivery schedules, internal status reports. |
| CUI — Controlled Unclassified Information | Information that requires safeguarding under a specific law, regulation, or government-wide policy. | Technical data subject to ITAR, controlled technical info under DFARS 252.204-7012, PII under the Privacy Act, draft solicitations. |
FAR 52.204-21 — the 15 basic safeguarding requirements
FAR 52.204-21— “Basic Safeguarding of Covered Contractor Information Systems” — is the clause the federal government has been writing into contracts since 2016 for any contractor handling FCI. It defines the baseline 15 safeguarding requirements that became, verbatim, CMMC Level 1.
FAR 52.204-21 is a contract clause. There's no submission or registration. If you signed a contract with the clause in it, you've agreed to comply. Most contractors don't notice until a prime asks for proof.
NIST SP 800-171 — the 110-control standard
NIST Special Publication 800-171is the National Institute of Standards and Technology's standard for protecting CUI in non-federal systems. It defines 110 controls across 14 families, scored against the SPRS rubric (110 maximum, deductions per missing control). NIST 800-171 is required by DFARS 252.204-7012 for any contractor handling CUI.
Important: NIST 800-171 is what your SPRS score measures. The 15 FAR safeguarding requirements are a strict subset of the 110 NIST controls. If you implement all 110, you've also implemented the 15.
CMMC Level 1 — self-attestation against the 15
CMMC Level 1 took the 15 FAR 52.204-21(b)(1) safeguarding requirements, added a self-attestation requirement, and made it annual. The DoD's final rule (32 CFR 170, effective Dec 16, 2024) requires:
- Annual self-assessment against all 15 basic safeguarding requirements (FAR 52.204-21(b)(1)(i)–(b)(1)(xv))
- Annual affirmation in SPRS, signed by a senior official of the contractor (i.e., your CEO/COO — their name on a federal attestation)
- System Security Plan (SSP) documenting how each practice is implemented
- Affirmation memo retained for record
No third-party assessor required. No assessment cost. Just a signed self-attestation by a senior official, and the False Claims Act exposure that comes with one.
CMMC Level 2 — assessed against the 110
CMMC Level 2 requires implementation of all 110 NIST 800-171 controls and is the floor for any contractor handling CUI. There are two sub-tiers:
- Level 2 self-assessment— permitted for some lower-risk CUI scenarios. Self-attestation, like L1.
- Level 2 third-party assessment(the common case) — required for prioritized CUI work. Conducted by a C3PAO(Certified Third-Party Assessment Organization). Typical engagement: 6–9 months, $80,000–$250,000 for an SMB.
Side-by-side comparison
| FAR 52.204-21 | NIST 800-171 | CMMC Level 1 | CMMC Level 2 | |
|---|---|---|---|---|
| Data covered | FCI | CUI | FCI | CUI |
| Number of controls | 17 | 110 | 17 | 110 |
| Assessment type | Contract clause; no formal assessment | Self-assessment with SPRS score | Annual self-attestation | Self or 3PAO depending on tier |
| Frequency | Continuous (contract obligation) | Every 3 years | Annual | Every 3 years (3PAO) / annual self |
| Filed in SPRS? | No | Yes (Basic Assessment score) | Yes (CMMC Status) | Yes (CMMC Status) |
| Senior official sign-off? | Implied | Yes | Yes — FCA exposure | Yes — FCA exposure |
| Typical cost (SMB) | $0–$5K (template work) | $10K–$60K | $0–$10K (SaaS) / $9K–$30K (consultant) | $80K–$250K (3PAO engagement) |
| Custodia covers it? | Yes | No | Yes | No |
Decision tree: which one applies to you
- Do you have any DoD contract paperwork? If no, none of this applies (yet). If yes, continue.
- Does your contract include DFARS 252.204-7012? If yes — you handle CUI, you need NIST 800-171 / CMMC L2. If no, continue.
- Does your contract include FAR 52.204-21? If yes — you handle FCI, you need CMMC Level 1. (This is the most common case for small DoD contractors.)
- You don't see either clause but a prime asked for a SPRS score? Get on a call with the prime's small-business liaison and ask which clause applies. Then come back here.
If you landed on CMMC Level 1 in step 3, you're in the right place. The 15-requirement walkthrough is your next read, or skip the reading and take the free 4-minute SPRS quiz to see where you stand.
FAQ
If I have CMMC Level 2, do I also need Level 1?
No. Level 2 supersedes Level 1. If you're assessed at L2, the 17 L1 practices are part of that scope.
Can I do CMMC Level 2 self-assessment instead of paying a 3PAO?
Only for the subset of L2 contracts the DoD has designated as eligible for self-assessment — typically lower-risk CUI. Most prioritized contracts require a C3PAO assessment.
What about FedRAMP?
FedRAMP is for cloud service providers selling to the federal government. It's a different regime entirely. If you're not a CSP selling SaaS to federal agencies, you don't need it.
Does StateRAMP affect DoD work?
No. StateRAMP is for cloud services sold to state and local governments. Federal DoD contractors are unaffected.
What's the cheapest path through CMMC Level 1?
Self-led with templates and SaaS. Custodia's entire reason for existing is that L1 doesn't justify a $9k–$30k consultantengagement when it's ultimately a structured data-collection problem. See the cost comparison.
“The L1 vs L2 question almost always comes down to the data type. If your contract doesn't flow CUI down, you don't need the $150,000 engagement. You need a week and a checklist.”— The Custodia Compliance Team