Level 1 applies to companies handling only FCI.

Level 2 applies to most contractors handling CUI and maps directly to NIST 800-171.

Level 3 applies to a small number of organizations supporting the most sensitive DoD programs.
Most contractors will need Level 2 certification.