Federal Contract Information (FCI) is information provided by or generated for the government under contract and not intended for public release. Handling FCI puts you at Level 1. Controlled Unclassified Information (CUI) is government information that requires safeguarding under law, regulation, or government-wide policy: think controlled technical information, export-controlled data, or certain program information. Handling CUI generally puts you at Level 2.
Two clauses tell most of the story. FAR 52.204-21 appears in nearly every federal contract that involves FCI and maps to Level 1. DFARS 252.204-7012 signals that the Department expects CUI to be involved and that NIST SP 800-171 applies, which points at Level 2. Going forward, solicitations state the required CMMC level directly through DFARS 252.204-7021, so new awards remove the guesswork.
Level 2 is not just more practices. It is all 110 requirements of NIST SP 800-171 Rev. 2, expanded into 320 assessment objectives, with a System Security Plan expected, SPRS scoring in play, and, for most defense work, a triennial assessment by a C3PAO rather than a self-attestation. The lift between levels is measured in months, not weeks, which is why misreading your level is such an expensive mistake in both directions: under-scoping risks contracts, over-scoping burns budget.
Plenty of real situations sit in the gray zone: a prime flowing down requirements conservatively, legacy contracts without modern clauses, or uncertainty about whether specific data is actually CUI. The answer is a scoping review against the official guides and your actual data flows, not a guess. That conversation usually takes an hour and settles the next year of planning.
A short conversation usually settles it. No pitch, just answers.
Talk to CyberDeka