Level 1 applies to companies handling only FCI.
Level 2 applies to most contractors handling CUI and maps directly to NIST 800-171.
Level 3 applies to a small number of organizations supporting the most sensitive DoD programs.
Most contractors will need Level 2 certification.
