How do you confirm whether a contract requires CMMC Level 1 or Level 2?
A lot of contractors get a vague instruction to "be CMMC compliant" without anyone specifying which level applies, and the two levels are very different in scope.
The determination comes down to the type of information the contract covers. FCI maps to CMMC Level 1, while CUI maps to Level 2. If your contract only cites FAR 52.204-21, that points to Level 1. If DFARS 252.204-7012 is present, or a prime's flow-down references NIST SP 800-171, that puts you at Level 2 regardless of what your own contract language says.
The compliance burden difference is significant: Level 1 is 15 practices with an annual self-assessment, while Level 2 covers all 110 NIST SP 800-171 requirements with a third-party C3PAO assessment every three years.
And starting November 10, 2026, those third-party assessments become mandatory for applicable Level 2 contracts.
For people who've gone through this determination process: did you find clear answers by going straight to your contracting officer, or did the contract clauses alone give you enough to act on?