The CMMC requirements that apply to your company depend on two things: the type of information your contract has you handle, and the CMMC level written into the contract. If you handle only Federal Contract Information (FCI), Level 1 applies; if you handle Controlled Unclassified Information (CUI), you’re in Level 2 territory, and CMMC Level 2 requirements are the 110 security requirements in NIST SP 800-171 Revision 2.
This post explains the difference between FCI and CUI, what each level asks of you, who does the assessment, and how to read your own contract to find out. Every requirement below links to the primary source.
FCI vs CUI: start with the information
Federal Contract Information (FCI) is information not intended for public release that is provided by or generated for the government under a contract. It doesn’t include public information or simple transactional information, such as what’s needed to process payments. That definition comes from FAR 52.204-21.
Controlled Unclassified Information (CUI) is information the government creates or possesses, or that a company creates or possesses for the government, that a law, regulation or government-wide policy requires or permits to be handled with safeguarding or dissemination controls. That’s the definition used in DFARS 252.204-7021. Drawings, specifications and technical data marked as CUI are common examples in defense work.
DFARS 252.204-7012 uses a related term, covered defense information: CUI, including controlled technical information, that is marked or otherwise identified in your contract, or that you collect, develop, store or use in performing it. Which kind of information you touch drives your level.
The three CMMC levels
The CMMC program rule, 32 CFR Part 170, sets out three levels. Here’s how they compare:
| Level | Protects | Requirements | Who assesses | How often |
|---|---|---|---|---|
| Level 1 | FCI | The 15 basic safeguarding requirements in FAR 52.204-21 | You (self-assessment) | Self-assessment and affirmation every year |
| Level 2 | CUI | The 110 security requirements in NIST SP 800-171 Rev 2 | You, or an authorized third-party assessor (C3PAO), depending on the contract | Assessment every three years, affirmation every year |
| Level 3 | CUI | Level 2, plus selected requirements from NIST SP 800-172 | DCMA’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) | Assessment every three years, affirmation every year |
A few details from the rule worth knowing. Level 1 doesn’t allow a Plan of Action and Milestones (POA&M), so every requirement must be met. Level 2 allows a conditional status with a POA&M, but open items must be closed within 180 days. Level 3 requires a final Level 2 certification by a C3PAO first. Results go into the Supplier Performance Risk System (SPRS), and a senior official at your company must affirm continued compliance every year.
Self-assessment vs C3PAO: what decides it
For Level 2, the contract decides. The clause at DFARS 252.204-7021 has a blank where the contracting officer fills in one of four options: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC). You don’t choose; you meet what’s written.
Check the current program status before you plan. The DoD CIO’s About CMMC page currently says the CMMC Program is paused in Phase 1 and may only require self-assessments at two levels, Level 1 (Self) and Level 2 (Self). DoD has suspended the Phase II requirements and announced a comprehensive review of the program and a reform task force. The page also says NIST SP 800-171 Rev 2 compliance will be enforced through self-assessments and select government-led assessments, and that the pause doesn’t remove the requirement to protect information under DFARS 252.204-7012. Program status can change, so read that page yourself before you set your plan.
How to tell from your contract: a clause checklist
Pull your current contracts, subcontracts and any recent solicitations, and search them for these clause numbers:
- FAR 52.204-21: you handle FCI and must apply 15 basic safeguarding requirements. This maps to Level 1.
- DFARS 252.204-7012: you handle covered defense information, must provide adequate security based on NIST SP 800-171, and must report cyber incidents. These obligations apply now, whatever the CMMC status, and it’s the clearest signal that any CMMC requirement you see will be at Level 2.
- DFARS 252.204-7019 and 252.204-7020: you need a current NIST SP 800-171 DoD Assessment score posted in SPRS (no more than three years old, unless the solicitation sets a shorter time).
- DFARS 252.204-7025 (in solicitations) and DFARS 252.204-7021 (in contracts): these state the CMMC level you need, filled in by the contracting officer.
If you’re a subcontractor, look at what the prime flows down to you. DFARS 252.204-7021 requires primes to flow the right CMMC level down to subcontractors that will handle FCI or CUI. If you’re not sure what you’ve received, ask the prime in writing.
A hypothetical example
Say a 30-person machine shop makes parts for a prime contractor. The purchase orders include FAR 52.204-21, so the shop handles FCI. Then the prime starts sending drawings marked CUI, and the subcontract now includes DFARS 252.204-7012. The shop now handles CUI and has DFARS 252.204-7012 obligations today, and any CMMC level in its subcontract will likely be Level 2. The next step is finding every system where those drawings live, because that defines what gets assessed.
What to do next
- Find the clauses. Use the checklist above on every active contract and recent solicitation.
- Find where FCI and CUI live. Email, file shares, laptops, cloud apps and the people who use them. 32 CFR 170.19 sets the scoping rules for what gets assessed.
- Compare against the requirements. For Level 2, use NIST SP 800-171 Rev 2 and its assessment procedures in NIST SP 800-171A. NIST has since published Rev 3 and marks Rev 2 as withdrawn, but CMMC Level 2 is assessed against Rev 2, which is the version 32 CFR Part 170 incorporates and the DoD CIO page names.
- Check SPRS. Know what score, if any, your company has posted today.
Where to get help
Balancelogic® built the Balancelogic CMMC Readiness Review for this exact question. It runs in three phases with fixed scope: Assessment and Roadmap (where you stand against NIST SP 800-171, your CUI boundary and your gaps), Documentation (your System Security Plan, policies and POA&M) and Validation and SPRS (a final pre-assessment review and help preparing the score you submit). Balancelogic has a Cyber AB Registered Practitioner on staff. Certification assessments are done by an authorized third party, such as a C3PAO, not by Balancelogic.
Want to gather your documents first? Our CMMC know-where-you-stand guide lists what to pull together. For ongoing security leadership afterward, see our Fractional CISO Services.
Not sure which requirements apply to you yet? Send us a message and ask about a Balancelogic CMMC Readiness Review.
Frequently asked questions
What are the CMMC Level 2 requirements?
CMMC Level 2 requirements are the 110 security requirements in NIST SP 800-171 Revision 2, which protect Controlled Unclassified Information. The CMMC rule at 32 CFR Part 170 states that the Level 2 requirements are identical to NIST SP 800-171 Rev 2.
Do I need a C3PAO assessment or can I self-assess?
Your contract decides. DFARS 252.204-7021 lists the required level as Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC). While the program is paused in Phase 1, the DoD CIO page says it may only require self-assessments, so check that page for current status.
What is the difference between FCI and CUI?
FCI is non-public information provided by or generated for the government under a contract. CUI is information that a law, regulation or government-wide policy requires or permits to be handled with safeguarding or dissemination controls. FCI points to Level 1; CUI points to Level 2 or Level 3.
Which contract clauses tell me what CMMC level I need?
Look for FAR 52.204-21 (FCI), DFARS 252.204-7012 (covered defense information and NIST SP 800-171), DFARS 252.204-7019 and 7020 (SPRS assessment scores) and DFARS 252.204-7025 or 7021, which state the CMMC level required.
Does the Balancelogic CMMC Readiness Review certify my company?
No. Certification assessments are conducted by an authorized third party, such as a C3PAO. The Balancelogic CMMC Readiness Review helps you understand what applies, close the documentation gaps and prepare for that assessment.
Our work supports your compliance program. It doesn’t guarantee compliance, certification or audit results.
