Small defense contractors ask us one question more than any other: "Do we need Level 1 or Level 2?"
The answer depends on the kind of government information your company handles. Level 1 covers Federal Contract Information (FCI). Level 2 covers Controlled Unclassified Information (CUI). They sound alike, but the difference between them is the difference between 15 basic safeguards and 110 security requirements. Here is how to tell which one you have.
Federal Contract Information (FCI)
FCI is defined in FAR 4.1901. In plain terms, it is information that:
- is not intended for public release, and
- is provided by the government or generated for the government under a contract to develop or deliver a product or service.
It does not include information the government has made public, or simple transactional information such as what's needed to process payments.
Most companies with a DoD contract handle some FCI: the contract itself, statements of work, delivery schedules, specifications, emails with the contracting office and the reports you send back. If you hold a contract with FAR 52.204-21, the clause that protects FCI, you are expected to meet its 15 basic safeguarding requirements. That is what CMMC Level 1 checks.
Controlled Unclassified Information (CUI)
CUI is a narrower and more sensitive category. Under the government-wide CUI program (32 CFR part 2002), it is information that a law, regulation or government-wide policy requires to be safeguarded or restricted in how it is shared. The National Archives keeps a public CUI Registry that lists the categories.
For defense contractors, CUI often shows up as:
- Documents marked "CUI" (or with older markings such as "FOUO")
- Technical drawings and data with a distribution statement (B through F) limiting who can see them
- Export-controlled technical data under ITAR or EAR
- Information covered by DFARS 252.204-7012, which the clause calls "covered defense information"
If your contract includes DFARS 252.204-7012 and you actually receive or create CUI, you are expected to meet the 110 requirements of NIST SP 800-171. That is what CMMC Level 2 checks.
Quick comparison
| Level 1 | Level 2 | |
|---|---|---|
| Protects | FCI | CUI |
| Main clause | FAR 52.204-21 | DFARS 252.204-7012 |
| Requirements | 15 basic safeguards | 110 (NIST SP 800-171) |
| How it's assessed today | Annual self-assessment | Self-assessment (third-party assessments paused in July 2026) |
| Plans of action (POA&Ms) | Not allowed | Allowed in limited cases |
| Annual affirmation in SPRS | Yes | Yes |
Four questions to find your level
1. What does the solicitation or contract say? CMMC requirements are set contract by contract. The solicitation names the level required, such as Level 1 (Self) or Level 2 (Self). Start there.
2. Is DFARS 252.204-7012 in your contract? If it isn't, you probably don't handle CUI under that contract. If it is, keep going: the clause appears in many DoD contracts, and it applies to CUI you actually handle.
3. Have you ever received anything marked CUI, or with a distribution statement? Look at the drawings, specifications and files your customers send you. Markings are the clearest signal. If nothing you receive or create is marked, and you don't produce controlled technical data, you are likely an FCI-only company.
4. Do you flow information down from a prime? Subcontractors inherit their prime's requirements for the information that flows to them. If your prime sends you CUI, you need Level 2 for the systems that handle it, even if your own work feels routine.
If you're unsure, ask your contracting officer or your prime. It is a normal question, and getting it right protects both of you.
Why this matters for a small shop
Many small manufacturers, builders and service providers handle only FCI. For them, Level 1 is 15 practical safeguards: individual logins, a firewall, updates, antivirus, a locked door, a visitor log and a way to dispose of old drives. They don't need a Level 2 program, and they don't need to buy one.
The opposite mistake is just as costly. If you do handle CUI and treat it as Level 1, your SPRS affirmation will not be accurate, and that is a statement made to the federal government.
One more option: some companies keep CUI out of their everyday systems altogether, for example by holding controlled drawings in a separate, well-protected environment. Then only that part of the business needs Level 2. If you only receive CUI occasionally, ask your prime or an advisor about this.
Where Fix&Affirm fits
Fix&Affirm is built for FCI-only companies. It walks through the 15 Level 1 requirements in plain English, shows how to fix each gap and produces the document pack behind your annual SPRS affirmation. The assessment is free, so you can see where you stand in a few minutes.
Start your free Level 1 assessment
This article is general information, not legal advice. Your contract and your contracting officer have the final word on which level applies.