What is Federal Contract Information (FCI)?

FCI is information the government provides to you, or that you create for the government, that is not intended for public release but does not require classified-level controls. Defined in FAR 52.204-21. Examples include contract terms and pricing, statements of work, performance reports, vendor lists, and internal emails about a DoD contract.

What is Controlled Unclassified Information (CUI)?

CUI is government information that is not classified but requires safeguarding under law, regulation, or government-wide policy. Defined in 32 CFR Part 2002, with safeguarding requirements from DFARS 252.204-7012 and NIST SP 800-171. Examples include technical drawings, software source code for government systems, test results, and export-controlled information.

Which CMMC level do I need?

If your DoD contracts involve only Federal Contract Information (FCI), you need Level 1 (15 practices, FAR 52.204-21). If your contracts involve Controlled Unclassified Information (CUI), you need Level 2 (110 practices, NIST SP 800-171). Most small DoD contractors only handle FCI and only need Level 1.

How do I tell if my contract involves CUI?

Look for DFARS clause 252.204-7012 in your contract. If it is present, your contract involves CUI and you need Level 2. If only FAR 52.204-21 appears and no DFARS 7012 clause is present, you only handle FCI and Level 1 applies. When unsure, ask your contracting officer directly.

CMMC Level 1 vs Level 2: Which Do You Need?

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}CMMC Level 1 vs Level 2: Which Do You Need?Compare CMMC Level 1 (FCI) and Level 2 (CUI) side by side. Understand who needs each level, with NIST and FAR sources, and a full requirement breakdown.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.