CMMC Level 1 vs Level 2: FCI, CUI and Which One Your Contract Carries

Which CMMC level does your contract carry?

Level 1 if you handle only Federal Contract Information (FCI). Level 2 if you handle Controlled Unclassified Information (CUI). The DoD CIO's CMMC FAQ puts it that simply, and the data you receive from the government or your prime decides it, not the size of your company or the value of the contract.

FCI and CUI in plain terms

FCI is information the government gives you or you create for the government under a contract, which is not meant for public release. A statement of work, an invoice with contract numbers on it. Almost every federal contractor has FCI the day the contract is signed.

CUI is information the government requires to be protected under law, regulation or policy, and that is marked or identified as such. Export-controlled drawings, technical data packages, some program information. DFARS 252.204-7012 calls the defense version "covered defense information" and attaches the 110 requirements of NIST SP 800-171 to it. Our post on what counts as CUI goes through the categories and the markings.

A quick test. If a document would need to be protected even if the contract ended tomorrow, it is probably CUI. If it only matters because it is about this contract, it is probably FCI.

The two levels side by side

	Level 1	Level 2
Data	FCI only	CUI (and FCI)
Requirements	The 15 basic safeguarding requirements of FAR 52.204-21	The 110 requirements of NIST SP 800-171 Rev 2
Who assesses	You, every year	You, or a C3PAO when the contract requires certification
Scoring	Met or Not Met, every requirement	A points score from 110 downward, posted in SPRS
POA&M	Not permitted	Permitted for limited items, closed within 180 days
Affirmation	A senior official, annually	A senior official, annually

The table comes from 32 CFR Part 170 and the DoD CIO FAQ. Two lines deserve a closer look.

Level 1 has no partial credit. The rule states that all Level 1 requirements must be fully implemented and no plan of action is permitted, so a supplier with fourteen of fifteen in place is not at Level 1. It is at zero, in the government's eyes, until the fifteenth is done.

Level 2 carries a points score. The 110 requirements are weighted at 1, 3 or 5 points each, you start at 110, and every unmet requirement subtracts its weight. We walk through the arithmetic in how to calculate your SPRS score honestly.

What Level 1 actually asks for

Fifteen practices. Limit access to authorized users. Control what connects to your network. Sanitize media before disposal. Escort visitors. Patch systems. Run anti-malware and keep it current. Use a boundary firewall. None of this is exotic, and a well-run IT shop meets most of it already.

The catch is evidence. A Level 1 self-assessment is an affirmation by a senior official that each practice is implemented, and the government can ask to see proof. Settings screenshots, a patch report, a visitor log. Collect those before you sign, not after.

What Level 2 adds

Ninety-five more requirements, and a different kind of work. Level 2 asks for a system security plan that describes your environment, multifactor authentication, audit logging you can actually search, FIPS-validated encryption for CUI, incident response that meets the 72-hour reporting clock in DFARS 252.204-7012, and a scoped boundary that an assessor can walk.

The boundary decides the cost. A 30-person machine shop with CUI on every laptop is assessing 30 laptops. The same shop with CUI in one enclave of six users is assessing six. Our readiness timeline for a 30-person supplier shows how that choice shapes the schedule, and the NIST SP 800-171 framework page covers the 14 families.

Where the program stands

Phase 1 self-assessments have appeared in solicitations since 10 November 2025. Phase 2 third-party assessments were suspended on 13 July 2026, and the class deviation of 3 September 2026 removes the C3PAO requirement from contracts for now, with no end date and no repeal. DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS scores and the 72-hour incident report still apply. AccuSights is not a C3PAO.

So your level has not moved. What has moved is who checks it. For now, both levels are self-assessed, which makes an honest score more important, not less. What a C3PAO assessment costs explains why that fee is not on your invoice yet.

How to settle the question in an afternoon

1. Pull every active DoD contract and subcontract and search for 252.204-7012, 252.204-7019 and 252.204-7021.
2. Ask each prime, in writing, whether they send you CUI and under which contract.
3. Look for CUI markings on the drawings and data you already hold.
4. If any answer is yes, you are at Level 2 for that work. Scope the boundary before you do anything else.

If every answer is no, you are at Level 1 and the job is smaller than you feared. Collect the evidence anyway.

Where AccuSights fits

We scope your CUI, assess the 110 requirements and write the SSP and POA&M, with a named engineer rather than a ticket queue and a fixed fee in writing within 24 hours of the intake form. We are not a C3PAO and we do not certify anyone. Start with the CMMC framework page or book a free Risk Diagnosis and we will tell you which level your contracts carry.