CMMC level finder
The most useful first question is what the solicitation requires. The second is what information the system will handle. DFARS 252.204-7025 still contains Level 1 Self, Level 2 Self, Level 2 C3PAO, and Level 3 DIBCAC designations in the regulatory text. The current August 2026 CMMC program page is narrower: implementation is paused in Phase 1 and may only require Level 1 Self and Level 2 Self during this period, while the Department also notes select government-led assessments. FCI and CUI help explain the safeguarding level, but the live solicitation and current program guidance control the procurement decision.
If the solicitation is not clear yet, the information type can still tell you which safeguarding baseline to investigate. This is triage, not a contract determination.
How to use the result
Use the output as a triage note, then open the solicitation and confirm the CMMC provision, contract clauses, and the information system that will perform the work. If CUI is involved, trace the data rather than assuming the whole company network is automatically the assessment boundary. If only FCI is involved, review the Level 1 safeguarding requirements and verify whether the procurement adds anything beyond the baseline.
The July 13, 2026 program change makes this source check unusually important. Phase II requirements were suspended while Phase I self-assessment requirements remain. That means an older chart describing a November 2026 milestone can be stale even when the underlying DFARS and NIST duties are still active.
FCI and CUI are not synonyms
Federal Contract Information is contract information provided by or generated for the government that is not intended for public release, subject to the FAR definition and its exclusions. Controlled Unclassified Information is a governmentwide category requiring safeguarding or dissemination controls under law, regulation, or governmentwide policy. The National Archives CUI Registry is the authoritative place to check CUI categories.
Do not classify ordinary company-confidential data as CUI merely because it is sensitive, and do not assume an unmarked file can never be CUI without checking the contract context and marking responsibilities. Accurate classification keeps the system boundary and assessment effort proportional to the work.
What to record after triage
Create a one-page record with the opportunity number, required CMMC level, assessment type, FCI/CUI determination, system name, CMMC UID if applicable, SPRS status, affirmation date, and the person responsible for the system. Proposal staff can then use the same record instead of asking IT to rebuild the answer for each bid.
Next, read the FCI vs CUI decision guide and the DFARS 252.204-7025 guide.