CMMC Compliance Guide for Defense Contractors

CMMC Level 1 vs. Level 2: Which Applies to Your Business?

Published by Overwatch Tools · March 2026 · 12 min read

Before you can comply with CMMC, you need to know which level actually applies to you. For a lot of small contractors, the answer isn't what they expect — and it's not just one level.

Many small defense contractors assume they only need to worry about CMMC Level 1. Some have never heard of Level 2 at all. A few have heard of it and assume it's only for large prime contractors running classified programs. Most of these assumptions are wrong.

The key distinction that determines your CMMC level isn't your company size, your revenue, or how long you've been in the defense industrial base. It comes down to one question: What kind of federal information do you handle?

The answer to that question — FCI, CUI, or both — determines whether you need Level 1, Level 2, or both stacked together. Let's break it down clearly.

---

What Is FCI? (And Why It Triggers Level 1)

Federal Contract Information (FCI) is information provided by or generated for the federal government under a contract to develop or deliver a product or service — but not intended for public release.

In plain terms: if your company performs work on a DoD contract, you almost certainly handle FCI. It includes things like:

• Contract deliverables and performance data
• Pricing, cost, and schedule information from your contract
• Communications with contracting officers about your work
• Project documentation created for government use
• Proposals, reports, and status updates tied to a contract

FCI is not classified. It's not necessarily sensitive in an intelligence sense. But it's not meant to be publicly shared, and it needs to be protected.

---

What Is CUI? (And Why It Triggers Level 2)

Controlled Unclassified Information (CUI) is a step above FCI in sensitivity. It's information the government has designated as requiring safeguarding under law, regulation, or government-wide policy — but it's not classified.

CUI is identified in your contract documents — often in a DD Form 254 (Contract Security Classification Specification) or in the contract's performance work statement. If your work involves any of the following, there's a strong likelihood CUI is in play:

• Technical drawings, design specifications, or engineering data
• Export-controlled data (ITAR/EAR-related information)
• Research and development information under DoD programs
• Certain contract performance data explicitly marked as CUI
• Information marked with CUI category labels (e.g., "CUI//SP-CTI" or "CUI//PRVCY")
• Data shared under a controlled distribution notice

If you receive, generate, store, process, or transmit any of this kind of information as part of your contract, CMMC Level 2 also applies to your organization — specifically to the systems and devices that touch that CUI.

---

FCI vs. CUI: A Side-by-Side View

The critical insight here: Level 2 does not replace Level 1. It is applied on top of it — to your CUI environment specifically.

---

Do You Handle CUI? A Plain-Language Self-Check

Use the following checklist to help you identify whether CUI is likely part of your contract. This is not a definitive legal assessment — it's a practical starting point.

---

Why Most CUI Handlers Need Both Levels

Here's the part that surprises many contractors: if you handle CUI, you don't get to skip Level 1. Level 1 applies to your entire business environment. Level 2 applies additionally to the specific systems and devices where CUI lives.

Think of it as two layers of compliance working at different scopes:

CMMC Level	What It Covers	Assessment Type	Annual Cost (Overwatch Tools)
Level 1	Your entire company environment — all devices and systems used for contract work	Annual self-assessment	$2,495/yr
Level 2	Your CUI enclave only — the dedicated, isolated environment where CUI is handled	Annual self-assessment (eligible programs) or C3PAO	$3,495/yr
Both Combined	Full FCI + CUI coverage — complete CMMC posture for CUI-handling contractors	Self-assessment for both levels	$5,990/yr

The combined investment of $5,990/year covers both your Level 1 and Level 2 self-assessments — full CMMC posture for a small contractor handling CUI. Compare that to a C3PAO third-party assessment, which runs $50,000 or more and is required if your program is not eligible for self-assessment at Level 2.

---

A Brief Introduction to the CUI Enclave

When we talk about Level 2 applying to your CUI footprint, what does that actually mean in practice? The short answer: a CUI enclave.

A CUI enclave is a dedicated, isolated environment — separate from your general business systems — where all CUI is stored, processed, and transmitted. Think of it as a walled-off digital workspace that only handles CUI, running on separate devices or accounts that never touch your everyday business tools.

For a small contractor, this doesn't mean building an enterprise data center. It means setting up a focused, right-sized environment using a government-grade cloud platform — either Google Workspace for Government or Microsoft 365 GCC High — on dedicated devices (Windows laptops or Chromebooks). No Active Directory. No SIEM. No full-time IT staff required.

The Overwatch Tools L2 CUI Enclave Package is built specifically for this: 110 practices mapped to 182 defined artifacts, dedicated enclave configuration guides for both platforms, a pre-filled System Security Plan, and 12 bi-weekly consulting sessions — all implementable part-time, with time estimates on every task.

We cover the CUI enclave in much greater depth in Article 2 of this series: "What Is a CUI Enclave and Do You Need One?"

---

A Note on Self-Assessment Eligibility

Not every CMMC Level 2 program qualifies for self-assessment. Under the CMMC framework, some programs are designated as requiring a Certified Third-Party Assessment Organization (C3PAO) — a formal, expensive, multi-day assessment process. These programs cannot self-assess at Level 2.

However, many Level 2 programs — particularly those at smaller contractors with limited CUI scope — are eligible for annual self-assessment. This is the window the Overwatch Tools L2 CUI Enclave Package is built for.

How do you know if your program qualifies for self-assessment? The short answer: check your contract and your program designation. Your contracting officer or the prime contractor above you in the supply chain can often confirm this. A consultation with a CMMC specialist is also a fast and reliable way to determine your assessment path.

We cover self-assessment eligibility, how to confirm your program status, and what happens if requirements change in Article 3 of this series: "CMMC Level 2 Self-Assessment: Who Qualifies and What's Required?"

---

Putting It All Together: Which Level Applies to You?

Here's a simple decision map based on what your contracts involve:

Your Situation	CMMC Level Required	Assessment Type
You perform DoD contract work — no CUI identified in your contracts	Level 1 only	Annual self-assessment
You handle CUI under an eligible self-assessment program	Level 1 + Level 2	Self-assessment for both levels
You handle CUI under a program designated for C3PAO assessment	Level 1 + Level 2	L1 self-assessment + L2 C3PAO
You're not sure which category applies to your contracts	Start with the free assessment tool	Book a free scope review to confirm

---

What's Next in This Series

This article established the foundation: FCI vs. CUI, and how each maps to a CMMC level. The rest of the C Series goes deeper on each piece:

• Article 2: What Is a CUI Enclave and Do You Need One? — A practical guide to understanding and scoping a CUI enclave for a small contractor.
• Article 3: CMMC Level 2 Self-Assessment: Who Qualifies and What's Required? — Eligibility, program designation, and what the self-assessment process actually looks like.
• Article 4: Google Workspace for Government vs. Microsoft 365 GCC High for Your CUI Enclave — A platform comparison for small contractors making this decision.
• Article 5: 110 Practices, 182 Artifacts: What CMMC Level 2 Self-Assessment Actually Requires — A ground-level look at the documentation and evidence requirements.
• Article 6: Scoping Your CUI Enclave: How to Limit What Level 2 Applies To — Right-sizing your CUI footprint to reduce compliance burden without cutting corners.

---

Investment Summary

---