CMMC Level 1 vs Level 2: Scoping Your Assessment in Texas (2026)

CMMC is the Department of Defense's mechanism for verifying that contractors protect two categories of sensitive-but-unclassified information:

• Federal Contract Information (FCI) — information provided by or generated for the government under a contract that is not intended for public release. Think delivery schedules, contract line items, and internal project data.
• Controlled Unclassified Information (CUI) — a much broader and more sensitive category: technical drawings, specifications, research data, and anything marked or carrying dissemination controls.

The type of information your contract involves is the single biggest driver of which level you need. FCI-only work points to Level 1. Any CUI puts you at Level 2.

Level 1 maps to the 15 basic safeguarding requirements in FAR 52.204-21. These are foundational hygiene controls — limiting system access to authorized users, sanitizing media before disposal, using boundary protection, and keeping antivirus current. There is no requirement for a written System Security Plan at Level 1, though maintaining one is smart.

The key relief valve at Level 1 is annual self-assessment. You are not required to hire a third-party assessor. A company officer attests to compliance and the affirmation is entered into the Supplier Performance Risk System (SPRS). For a small shop that only ever touches FCI, Level 1 is genuinely achievable with disciplined managed IT and a documented process.

Level 2 aligns to the 110 security requirements in NIST SP 800-171 Rev 2, spanning 14 control families from Access Control to System and Information Integrity. This is a categorical jump in effort. Level 2 requires:

• A written and maintained System Security Plan (SSP) describing every in-scope asset and how each control is met.
• A Plan of Action and Milestones (POA&M) for any control not fully implemented — with hard limits on which controls can be deferred and a 180-day closure clock.
• For most CUI contracts, a third-party assessment by a C3PAO (Certified Third-Party Assessment Organization) every three years, not a self-attestation.

The multi-factor authentication, FIPS-validated encryption, audit logging, and incident response requirements at Level 2 overlap heavily with the same disciplines we build for SOC 2 readiness and NIST CSF 2.0 programs. If you have done that work, you are not starting from zero.

Here is where most Texas contractors overspend. CMMC scope is defined by asset categories, and the smart move is to shrink the boundary so that only the assets that store, process, or transmit CUI carry the full 110-control burden. The CMMC scoping guidance recognizes five asset categories:

• CUI Assets — process, store, or transmit CUI. Fully in scope, fully assessed.
• Security Protection Assets — provide security functions to the CUI environment (your firewall, SIEM, identity provider). In scope for the controls they implement.
• Contractor Risk Managed Assets — could touch CUI but are governed by policy to prevent it. Documented, not fully assessed.
• Specialized Assets — IoT, OT, government-furnished equipment. Documented and risk-managed.
• Out-of-Scope Assets — physically or logically isolated from CUI. Not assessed at all.

The single most effective cost-control move is enclaving: building a segmented environment — often a dedicated Microsoft 365 GCC High tenant or a VDI enclave — where all CUI lives. Everything outside the enclave becomes out of scope. We cover the identity architecture this depends on in our Active Directory tiering and network access control guides.

• Information type: FCI only → Level 1. Any CUI → Level 2.
• Control count: 15 (FAR) vs 110 (NIST 800-171).
• Assessment: annual self-attestation vs triennial C3PAO assessment.
• Documentation: optional SSP vs mandatory SSP and POA&M.
• Typical timeline to ready: weeks to a few months vs 9–18 months.

Contractors routinely under-scope because they do not realize where CUI has spread. Common leak points we find during assessments:

• Engineering drawings emailed to personal or unmanaged accounts.
• CUI copied into general-purpose SharePoint or shared drives outside the enclave.
• Contract specs sitting in an ERP or estimating system nobody flagged.
• Backups and disaster-recovery copies that replicate CUI to an out-of-scope location — a gap we address in our disaster recovery planning.

Data flow mapping is not busywork. It is the artifact that lets you honestly draw the scope boundary and prove it to an assessor.

At Level 2, a Plan of Action and Milestones lets you certify with a handful of controls still open — but the rules are strict. Certain high-weight controls cannot be on a POA&M at all; they must be fully met. The rest must be closed within 180 days or your conditional certification lapses. Treat the POA&M as a short bridge, not a parking lot. Contractors who defer MFA, encryption, or logging into a POA&M usually discover those are exactly the controls you cannot defer.

If your DoD contracts already carry DFARS 252.204-7012, you have been obligated to implement NIST 800-171 and report a SPRS score for years. CMMC Level 2 is the verification layer on top of that existing obligation. Pull your current SPRS self-score first — the delta between that number and 110 is your honest roadmap. Many Texas contractors find their self-reported score was optimistic once an assessor's lens is applied.

Begin with a two-week scoping sprint: (1) confirm whether your contracts involve FCI, CUI, or both by reading the clauses and asking your prime; (2) map where that data actually lives today; and (3) decide whether to enclave. That single decision — enclave versus flat network — determines whether your CMMC project costs tens of thousands or hundreds of thousands. LayerLogix runs this scoping sprint as a fixed-scope engagement, and you can kick it off with a free IT assessment to gauge where your environment stands before the clock starts.

LayerLogix supports Texas defense contractors and their supply chains statewide, with deep coverage across the military and aerospace corridors:

• San Antonio Managed IT Services — Military City and the defense-industrial base
• Houston Managed IT Services — aerospace and energy contractors
• Austin Managed IT Services — defense tech and R&D
• Fort Worth Managed IT Services — aviation and manufacturing
• Dallas Managed IT Services — supply-chain and subcontractors

Whether you need Level 1 self-attestation support or a full Level 2 enclave build ahead of a C3PAO assessment, our IT outsourcing and privileged access management teams can scope it correctly the first time.