There are 4 protection levels (PL). To determine your level, you need to know whose data, which categories of data, and the volume of data you are processing, as well as the type of relevant threats.
Relevant threats are conditions and factors that create the risk of unauthorized access to personal data (PD). There are 3 types of threats:
Type 1 threats are related to undocumented (undeclared) features in the system software.
Type 2 threats are related to undocumented (undeclared) features in the application software.
Type 3 threats are not related to undocumented (undeclared) features in the system software and application software.