The first CMMC question isn't "how do I comply" - it's "which level am I?" Get this wrong in one direction and you spend thousands over-complying; get it wrong in the other and you affirm a Level 1 assessment that doesn't cover your actual obligations. The answer hangs on one distinction: FCI versus CUI.
FCI vs CUI in plain English
Federal Contract Information (FCI) is information provided by or generated for the government under contract that isn't meant for public release: your POs, quotes, contract emails, most build-to-print drawings, delivery schedules. If you hold any DoD contract, you almost certainly handle FCI - it's the water the work swims in.
Controlled Unclassified Information (CUI) is a step up: information the government specifically requires safeguarding for, under law or policy. Think export-controlled technical data (ITAR/EAR), specifications marked with CUI banners, controlled drawings with distribution statements. CUI usually announces itself - markings on documents, a DFARS clause in the contract, or your prime telling you a program is controlled.
The clause test - the fastest reliable check
Open your contract or subcontract and search for two clauses:
- FAR 52.204-21 alone → you're handling FCI → Level 1: 15 basic safeguarding requirements, an annual self-assessment, and an affirmation in SPRS. Here's all 15, translated.
- DFARS 252.204-7012 (usually with 7019/7020, and increasingly 7021) → CUI is in play → Level 2: the 110 security requirements of NIST SP 800-171.
Still ambiguous? Ask your prime's contracts person - or, if you contract directly with the government, your contracting officer - one written question: "Does our work involve CUI, and which CMMC level applies to us?" Their answer is worth having in your files either way.
Two different "scoping" questions, don't mix them up. This guide answers which level you're at. A separate question is which of your systems are in scope once you know it's Level 1 - and the answer is systems and facilities, not just the people who touch FCI. If that's the question you actually have, read what's actually in scope for Level 1: systems, not headcount.
What each level actually requires
| LEVEL 1 | LEVEL 2 | |
|---|---|---|
| Information | FCI | CUI (and FCI) |
| Requirements | 15 (FAR 52.204-21) | 110 (NIST SP 800-171) |
| Assessment | Annual self-assessment | Self-assessment for some contracts; third-party (C3PAO) assessment was scheduled for Phase 2 in November 2026 and is currently suspended pending DoD review |
| Scoring | Pass/fail - all 15 met, no POA&Ms | Scored from -203 to 110; conditional status possible at 88+ with a POA&M, valid 180 days |
| Where it's recorded | SPRS, with senior-official affirmation, renewed annually | SPRS (and C3PAO records), affirmed annually |
| Typical small-shop cost | A few weekends of fixes; consultants charge $5,000-15,000 if you outsource it | Commonly five to six figures with consultants, tooling, and assessment fees |
Landed on Level 1? The free 5-question check shows you where your shop stands against the 15 in about three minutes, no email to start.
The mistakes we see most
Buying Level 1 help for a Level 2 problem. If your contracts carry DFARS 252.204-7012, a Level 1 assessment - ours or anyone's - doesn't cover you, and a vendor who'll sell it to you anyway is telling you something about themselves. (Our own assessment asks two scoping questions before anything else, and stops you at the door if the answers point to CUI.)
Assuming small means Level 1. Level is set by the information you touch, not headcount. A 6-person shop machining export-controlled parts is Level 2. A 200-person logistics firm handling only FCI is Level 1.
Treating uncertainty as a reason to wait. The clause test takes ten minutes, the prime question takes one email, and either answer starts a clock you're already on - enforcement began phasing in November 2025.
Rule of thumb, honestly stated: most build-to-print machine shops, fabricators, and service subcontractors are Level 1. Anyone receiving marked technical data, ITAR-controlled drawings, or contracts with the 7012 clause should assume Level 2 until a professional tells them otherwise - and that professional isn't us.
Where does your shop stand right now?
Five yes/no questions, instant grade, no email required. Know before you're asked.
Take the free 5-question check