Which CMMC Level Is in Your Contract: FCI vs CUI, the Four Phases, and the 2026 Suspension (PDF Guide)

Which CMMC level applies to your contract?

Level 1 if the only government information you handle is Federal Contract Information (FCI). Level 2 if you handle Controlled Unclassified Information (CUI). Level 3 only when a program office says so, on a small set of high-value programs. The level follows the information, not the size of your company or your contract.

This 25-page PDF guide, written in plain English for defense contractors and subcontractors, walks you from the clauses in your own solicitation to the level you owe, who checks it, and when. It is the October 2026 edition, and every date, clause number, and dollar figure in it was verified against a primary source on October 6, 2026.

Is CMMC Phase 2 still starting on November 10, 2026?

No. On July 13, 2026, the Department of War Chief Information Officer suspended the move to CMMC Phase 2 and placed all later milestones in abeyance, pending a review by a CMMC Reform Task Force. The suspension was written into the contracting rules through DARS Class Deviation 2026-O0025, Revision 2 (July 16, 2026) and Revision 3 (September 3, 2026). As of October 6, 2026, there is no replacement date.

What the suspension did not change: DFARS 252.204-7012 and the 110 requirements of NIST SP 800-171 Rev. 2, the SPRS score, the annual affirmation, Level 1 and Level 2 self-assessment in Phase 1 contracts, and False Claims Act exposure for a score you cannot back up. The guide explains each of these with the section of the rule or clause it comes from.

What this CMMC guide answers

• The three CMMC levels (Level 1, Level 2 and Level 3), what triggers each one, and who assesses: you, a C3PAO, or DIBCAC.
• The difference between FCI and CUI, with the definitions from FAR 52.204-21 and 32 CFR 2002.4 that actually decide the question.
• How to read DFARS 252.204-7012, 252.204-7021 and 252.204-7025 in your own contract, and what the February 1, 2026 renumbering did (FAR 52.204-21 became 52.240-93; DFARS 252.204-7019 was retired; 252.204-7020 became 252.240-7997).
• The four-phase rollout as written in 32 CFR 170.3(e): November 10, 2025, 2026, 2027, and 2028, and what happened to that schedule in July and September 2026.
• The Level 2 POA&M limits in 32 CFR 170.21: the minimum score, which requirements may be deferred, and the 180-day closeout.
• The subcontractor flow-down rule in 32 CFR 170.23, so a prime asks you for the level the rule requires and not one it does not.
• What you owe today in six common situations, from FCI-only supplier to a contractor whose paperwork still says Level 2 (C3PAO).

Who this guide is for

• A small or mid-size contractor that handles FCI or CUI on Department of War work, directly or as a subcontractor at any tier.
• The owner, operations lead or IT manager who has to decide what to spend and when.
• The MSP or consultant explaining CMMC to that contractor.
• Not for: primes building a Level 3 program, or anyone looking for legal advice.

What is inside the 25 pages

• 1. The 30-second answer: which level, who checks, when, and what did not change.
• 2. Two kinds of information decide everything: FCI vs CUI, with the definitions that apply.
• 3. The three levels, side by side: requirements, assessor, frequency, POA&M rules and the rule section for each.
• 4. Reading your solicitation and contract: the clause set, old and new numbers, subcontractor flow-down.
• 5. The four phases as written: 32 CFR 170.3(e) and the DFARS dates.
• 6. What changed in 2026: the February renumbering, the July suspension, the September class deviation.
• 7. What you owe today, by situation: six positions and what each has to have in place.
• 8. The score you post is a claim: two Department of Justice False Claims Act settlements (Honeywell Aerospace, 2026; MORSECORP, 2025) that never needed Phase 2.
• 9. Decision path: five questions, in order.
• 10. What to do next: a plain list, no timetable.
• 11. Watch list: the Task Force report, NIST SP 800-171 Rev. 3, the FAR CUI rule, and where to look.
• 12. Sources, glossary, about: every primary source used, by section.

How this guide was verified

Every fact was checked on October 6, 2026 against the primary source: 32 CFR Part 170 (the CMMC program rule), the DFARS final rule at 90 FR 43560, the Department’s July 13, 2026 suspension memoranda, DARS Class Deviation 2026-O0025 and its revisions, the FAR overhaul deviation text, and Department of Justice press releases. The sources section cites each by section so you can read the same text. No invented statistics, no testimonials. Where a fact could not be confirmed from a primary source, it was left out.

Frequently asked questions

What is the difference between FCI and CUI?

FCI is non-public information provided by or generated for the Government under a contract, such as the statement of work, schedules, and performance reports (FAR 52.204-21). CUI is information that a law, regulation, or government-wide policy requires to be safeguarded, listed by category in the National Archives CUI Registry (32 CFR 2002.4). Technical data with a distribution statement, export-controlled data, and anything marked CUI are CUI. FCI alone means Level 1; CUI means Level 2.

Do I need a C3PAO assessment right now?

Under the July 2026 suspension, the Department is not writing Level 2 (C3PAO) or Level 3 (DIBCAC) into new solicitations and has directed contracting officers to remove those requirements from existing ones. A prime may still ask for a third-party assessment as a supplier condition, and voluntary C3PAO assessments are still available. The guide covers all three cases.

What does DFARS 252.204-7021 require?

To hold a current CMMC status at the level named in the contract, for every information system that processes, stores or transmits FCI or CUI in performance, for the life of the contract, and to flow the requirement down to subcontractors. The level itself is stated in the solicitation provision, DFARS 252.204-7025.

Do I still have to post a score in SPRS?

Yes. Level 1 requires a self-assessment and affirmation every year; Level 2 (Self) requires a self-assessment every three years with an affirmation every year. Older contracts that carry DFARS 252.204-7019 or 252.204-7020 still require the Basic NIST SP 800-171 self-assessment score.

Is NIST SP 800-171 Revision 3 required for CMMC?

No. Revision 2 remains the baseline for both DFARS 252.204-7012 and CMMC. Class Deviation 2024-O0013 pinned Revision 2 in 2024, and the June 2026 deviation text of 252.204-7012 names Revision 2 in the clause itself. Revision 3 is on the guide’s watch list.

Can I use a POA&M at Level 2?

Yes, within the limits in 32 CFR 170.21: a score of at least 88 out of 110, only 1-point requirements on the POA&M (with one encryption exception), a short list of requirements that can never be deferred, and closeout within 180 days. Level 1 allows no POA&M.

Pair it with

• NIST 800-171 SPRS Score Workbook: score the 110 requirements the way the DoD Assessment Methodology does, before you post a number. https://payhip.com/b/R5g4Y
• Asset Scoping Worksheet: work out which systems actually touch FCI or CUI. https://payhip.com/b/2nzjO
• CMMC Level 2 Readiness Kit: 5 NIST 800-171 Tools: the Workbook, Evidence Tracker, Asset Scoping Worksheet, SSP Template, and POA&M Tracker in one kit. https://payhip.com/b/LutGC

Format and delivery

• One PDF, 25 pages, US Letter, searchable and printable. Dark design with large serif type for on-screen reading.
• October 2026 edition; the edition date is on the cover.
• Instant download after purchase.

Please note

This guide is orientation and templates, not legal or compliance advice. It describes regulations, memoranda, and class deviations as they stood on the edition date. Determinations about CMMC status, SPRS scores, and contract eligibility rest with the Department of War, DIBCAC, authorized C3PAOs, and your contracting officer. Confirm current requirements with your contracting officer, your prime, and counsel before acting on them.

About the author

Lennan Carver writes plain-English compliance guides and working templates for small businesses under the CyberZ name. The CMMC tool line, the guides, and the Readiness Kit are at cyberz.pro.