If someone asked you right now which CMMC level applies to your contracts, could you answer confidently?
Most contractors we talk to cannot. Not because they haven’t thought about it, and not because they are ignoring the requirement. It is because they are mixing up two terms that sound similar but drive very different obligations: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Get that distinction wrong, and you will get your CMMC level wrong too, along with your budget, your timeline, and your risk exposure.
This article walks through what FCI and CUI actually are, how they map to the three CMMC levels, and how to figure out with confidence which level applies to your organization.
Why This Question Matters Right Now
CMMC is not a future requirement anymore. Phase 1 of the CMMC rollout took effect on November 10, 2025, and Level 1 and Level 2 self-assessment requirements are already showing up in Department of War (DoW) solicitations and contracts. Contractors are required to post self-assessment scores in SPRS and to submit an annual affirmation. That obligation, along with the underlying DFARS 252.204-7012 clause and the NIST SP 800-171 control set, has not gone anywhere.
The Department has paused the rollout of mandatory third-party certification while a reform review plays out, but that pause only affects how compliance gets verified, not whether you need to know your level. You still do, and you need to know it now so you are not scrambling when a contracting officer or a prime asks.
Start With the Information, Not the Contract Number
A common mistake is trying to figure out CMMC level from the contract vehicle, the dollar value, or the type of work. None of those tell you the level. What tells you the level is the type of information you receive, generate, store, or transmit on behalf of the government or a prime contractor. That comes down to two categories.
What Is FCI?
Federal Contract Information is information that is not intended for public release and is provided by, or generated for, the government under a contract to develop or deliver a product or service. Think purchase orders, basic contract deliverables, invoices, routine schedules, and similar business information tied to performing the contract.
FCI is the baseline. If you have a contract with the federal government at all, you almost certainly handle FCI, even if you never see a document marked CUI. FCI is protected by a much shorter, more basic set of security practices, found in FAR clause 52.204-21.
What Is CUI?
Controlled Unclassified Information is a much narrower and more sensitive category. It is government-created or government-owned information that requires safeguarding or dissemination controls under law, regulation, or government-wide policy, but that is not classified. In the defense context, this often includes technical drawings, engineering data, export-controlled information, certain program schedules, unclassified controlled technical information tied to a weapons system, and similar material.
CUI is typically marked as such, or it should be. It falls into specific categories defined in the CUI Registry, and DoW contracts that involve CUI will usually reference it directly, most commonly through a DD Form 254 (for classified contract security requirements that also touch CUI handling), a CUI marking requirement in the statement of work, or an explicit contract clause identifying categories of CUI you will receive or generate.
CUI is protected by a much more rigorous set of controls, drawn from NIST SP 800-171.
The Distinction That Trips People Up
Here is where the confusion usually happens. A contractor will say, “We handle sensitive government data, so we must be Level 2 or Level 3.” But sensitive is not the same as CUI. Plenty of information that feels sensitive to a business, like proprietary technical approaches or internal cost data, is not CUI at all. Conversely, some things that do not feel sensitive on their face, like a specific unclassified drawing revision for a weapons system component, absolutely are CUI because of how the government has designated that category.
The only way to answer this reliably is to look at what your contract, your prime, or your contracting officer has actually told you about the information you will receive or generate, and cross-reference it against the CUI Registry categories. Guessing based on gut feeling is exactly how contractors end up over-scoped, wasting money on controls they do not need, or under-scoped, and exposed to a contract compliance failure.
Mapping FCI and CUI to the Three CMMC Levels
CMMC 2.0 has three levels. Each one exists specifically to match the sensitivity of the information involved.
Level 1: Foundational Applies to organizations that handle FCI only, and no CUI. Level 1 requires implementation of 15 basic safeguarding requirements from FAR 52.204-21, verified through an annual self-assessment. If your contract only involves FCI, this is your ceiling, not your floor. You do not need to build a Level 2 or Level 3 program for a Level 1 scope.
Level 2: Advanced Applies to organizations that handle CUI. Level 2 requires implementation of the 110 security requirements in NIST SP 800-171, verified through either self-assessment or third-party assessment depending on the specific contract requirement. If your contract requires you to receive or generate CUI, Level 2 is very likely your floor.
Level 3: Expert Applies to a smaller subset of organizations that handle the most sensitive CUI, typically tied to DoW’s highest-priority programs. Level 3 builds on the full Level 2 requirement set and adds a further set of enhanced security requirements drawn from NIST SP 800-172, verified by government-led assessment. Very few contractors need Level 3, and it is reserved for information the Department has specifically identified as warranting that added protection.
The through-line across all three levels is the same: the level is a direct function of the information type. FCI only puts you at Level 1. Any CUI puts you at Level 2 at minimum. A specific, narrow set of the most sensitive CUI puts you at Level 3.
How to Actually Determine Your Level
If you are still unsure which level applies to you, walk through these questions in order.
- Does our contract or subcontract involve any information the government has designated as CUI? Check the contract clauses, the statement of work, any DD Form 254, and any markings on documents you have already received. If the answer is genuinely no, and you have documentation to support that conclusion, you are likely Level 1.
- Has our prime contractor flowed down a CUI requirement to us? DFARS 252.204-7012 requires primes to flow down cybersecurity requirements to subcontractors who will handle CUI. If your prime has told you that you will receive CUI, or if your scope of work makes that unavoidable, you are Level 2 at minimum, even if you are a small subcontractor several tiers down.
- Have we cross-referenced the specific information categories against the CUI Registry? Do not rely on assumption. The Registry defines specific categories, and matching your actual data against it removes the guesswork.
- Has the government specifically identified our program as requiring enhanced protections beyond standard CUI handling? This is rare, and it will be explicit if it applies. Absent that explicit direction, assume you are not a Level 3 candidate.
- Have we documented the answer, not just assumed it? Even with self-assessment currently in place at Level 1 and Level 2, you are expected to have a System Security Plan and a scoping rationale that explains why you landed at the level you did. That documentation is what protects you if a prime, an auditor, or the government later questions your posture, and it is also what protects you under the False Claims Act, since an inaccurate SPRS score or affirmation carries real liability.
The Cost of Getting This Wrong
Two failure modes show up constantly.
The first is under-scoping: a contractor assumes they are Level 1 because they have never seen a CUI marking, without realizing their prime has quietly been sending them CUI-designated technical data for two years. That is a contract compliance problem and, increasingly, a False Claims Act exposure problem, since attesting to a compliance posture you have not actually achieved is a legal risk, not just a cybersecurity one.
The second is over-scoping: a contractor assumes worst case and builds out a full NIST SP 800-171 program, and the accompanying cost and complexity, for a contract that only ever involved FCI. That is a resource problem. Money and staff time go toward controls the contract never required, while other parts of the business go underfunded.
Both failure modes come from the same root cause: not doing the work up front to nail down what information you actually handle.
Where to Start
If you cannot answer the question in the title of this article with confidence, the fix is not complicated, but it does take a deliberate review. Pull your active contracts and subcontracts. Identify every clause, marking, and prime flow-down requirement related to CUI. Cross-reference against the CUI Registry. Document your conclusion in a scoping statement. Then build, or validate, your security program against the level that conclusion points to, not the level you assumed, and not the level that feels safest to claim.
The regulatory mechanics of CMMC may continue to be refined, but the underlying logic that determines your level is not moving. It has always come down to FCI versus CUI.
Valor Cybersecurity works with Department of War contractors, shipyards, and manufacturers to determine exact CMMC scope, build the documentation to support it, and implement the right controls for the level that actually applies. If you would like a second set of eyes on your scoping conclusion, we are glad to help.
