CMMC Level 1 vs. Level 2: start with your information, then your scope

The difference at a glance

New to the program? Start with what CMMC means, then use the contractor decision guide to identify the questions to resolve before selecting a readiness path.

Do not confuse a level with a rollout phase

A level describes the required security baseline. A phase describes how requirements enter the acquisition process. Those are different decisions. The government’s CMMC page reports that Phase II was suspended on July 13, 2026 while Phase I self-assessment requirements remain in place. Check the official implementation notice before planning around a date or assessment requirement.

A useful readiness plan starts with the contract and the actual environment, rather than a general deadline found in an older article. Ask who owns the requirement, what information is involved, and what evidence supports the current implementation.

A practical way to establish your starting point

1. Read the contract language. Record the applicable clauses, required level, assessment type, and the person responsible for confirming them. Resolve unclear requirements with the appropriate contracting or compliance contact.
2. Trace the information. Identify where relevant information is received, processed, stored, and transmitted. Include the people, endpoints, applications, locations, and service providers involved.
3. Describe the boundary. Document which systems support the work and how they connect. Use the relevant government scoping guide rather than assuming a separate network automatically settles the scope.
4. Map implementation to requirements. For each requirement, record what is in place, who can explain it, and where supporting material lives.
5. Separate gaps from completed work. Give each unresolved item a clear owner and next step. A planned change should remain distinguishable from a verified implementation.

Where CMMC Pulsar fits

CMMC Pulsar provides a connected workspace for program scope, controls, evidence, network architecture, and readiness exports. Use the six-step product tour to see how those records fit together. Keep technical implementation and human review connected to the record; a completed screen is not proof that a safeguard works.

If your team needs help organizing the effort, Federal Bid Partners offers readiness support alongside the software workflow. Start by agreeing on the work boundary and the responsibilities of your internal IT team, outside providers, and readiness support team.