The Short Answer
If your contract only involves Federal Contract Information (FCI), you need Level 1. If it involves any Controlled Unclassified Information (CUI), you need Level 2. Everything else is detail that helps you figure out which one applies to you.
What Counts as FCI vs CUI
FCI is information provided by or generated for the government under a contract that is not intended for public release. Think purchase orders, invoices, basic contract status updates. It is not sensitive in itself, but it is not public either.
CUI is information that requires safeguarding under law, regulation, or government-wide policy, even though it is not classified. Technical data, engineering drawings, export-controlled specifications, and certain program details typically fall into this category. If you are touching anything a prime marks as CUI, or anything covered by a DD Form 254, you are in CUI territory.
Four Questions to Ask
Does your contract include DFARS clause 252.204-7012?
This clause specifically covers safeguarding covered defense information, which is DoD's term closely tied to CUI. If it is in your contract, assume Level 2 applies.
Has your prime given you a DD Form 254 or specific CUI marking instructions?
A DD 254 is a strong signal you are handling classified or CUI-adjacent material as part of the work. If you have one, you are almost certainly Level 2.
Do you generate, receive, store, or transmit technical data or drawings tied to a specific program?
Basic administrative work rarely rises to CUI. Engineering data, test results, and program-specific technical documents usually do.
If none of the above apply, can you confirm in writing that you are FCI-only?
Get it in writing from your prime or contracting officer where possible. A Level 1 self-assessment is far easier to defend later if the FCI-only scope is documented, not just assumed.
What Happens if You Guess Wrong
Under-scoping is the riskier mistake. If you assess yourself at Level 1 but are actually handling CUI, you have an incomplete self-assessment on record and a real compliance gap that surfaces the moment a prime or the DoD asks questions. Over-scoping to Level 2 when you only needed Level 1 costs you time and effort you did not need to spend, but it will not get you in trouble.
When genuinely unsure, treat it as Level 2 until your prime or contracting officer confirms otherwise in writing.