The CMMC Level you will have to meet will be determined by the type of information in the contract, Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). For most companies, about 60% will be at CMMC Level 1, focused on securing FCI, with 17 practice requirements.  CMMC Levels 2 and above are focused on securing FCI and CUI. The class will be determined by the government contract and negotiations between the prime contractor and the government contracting officer. All government-controlled information, CUI, must be identified and plainly marked.