The levels are not a maturity ladder you climb at your own pace. They are a classification of the information you hold, and the contract tells you which one you must meet.
Level 1: Federal Contract Information
Level 1 applies where you handle FCI and no CUI. It consists of the 15 basic safeguarding requirements in FAR clause 52.204-21 — limiting system access to authorized users, controlling who can post to public systems, sanitizing media before disposal, and so on. It is assessed by you, annually, with an affirmation from a company official.
For a shop that machines commercial parts and occasionally takes a government purchase order, Level 1 is often the whole story. It is genuinely achievable in weeks rather than months.
Level 2: Controlled Unclassified Information
Level 2 applies where CUI touches your systems, and it is a different order of work: all 110 security requirements of NIST SP 800-171, organized into 14 families, from access control through system and information integrity. It requires a System Security Plan that describes how each of the 110 is met, a Plan of Action and Milestones for anything not yet met, and a score submitted to the Supplier Performance Risk System.
Depending on what the contract specifies, Level 2 is met either by self-assessment or by a certification assessment performed by an accredited C3PAO. The planned November 10, 2026 shift to mandatory third-party certification for CUI contracts was suspended by DoD on July 13, 2026, pending a 60-day review; until that review lands, Level 2 is a self-assessment with a score in SPRS and an annual affirmation.
How to tell which one you are, today
- Search your email for the words "Controlled Unclassified Information", "CUI", "Distribution Statement", or "Export Controlled". Attachments count.
- Look at the header and footer banners on the drawings in your engineering folder, not just the cover sheet of the package.
- Read the flow-down letter or contract clauses your prime sent. DFARS 252.204-7012 in your terms means covered defense information is in play.
- Ask your prime's supply chain contact directly which level they expect from you. They usually know, and the question makes you look prepared rather than lost.
If you find CUI and your systems have never been assessed, you are not in trouble — you are in the ordinary starting position. What creates trouble is affirming a score you cannot evidence.
The cost difference is real
Level 1 is a documentation exercise a competent shop can carry out with help in a matter of weeks. Level 2 involves a boundary definition, an honest gap assessment against 110 requirements, a written SSP, and evidence an assessor can follow. Preparing for a first Level 2 assessment commonly takes six to twelve months when it is squeezed around production. That gap is exactly why the November deadline matters now rather than in October.