An OSC has produced two assessment scopes. When the Lead Assessor questioned the OSC PoC why, they detailed that they process, store, or transmit FCI…

CMMC Level 2 is specifically designed for the protection of Controlled Unclassified Information (CUI). The security requirements for Level 2 are derived directly from NIST SP 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations." An assessment scope containing CUI is therefore the subject of a Level 2 assessment and certification. Conversely, CMMC Level 1 is designed to protect Federal Contract Information (FCI) and aligns with the basic safeguarding requirements in FAR 52.204-21. An organization can have separate scopes for different information types, and the certification level applies to the specific scope being assessed.

A. The scope that processes, transmits, or stores FCI: This scope would be assessed against CMMC Level 1 requirements, not Level 2, as Level 1 is the designated level for protecting FCI.

C. For both assessment scopes: The certification level is tied to the type of information protected within a scope. The FCI scope would be assessed at Level 1, and the CUI scope at Level 2.

D. The OSC cannot be certified at Level 2 because they haven’t met Level 1 requirements: This is incorrect. CMMC Level 2 requirements are cumulative and include all 15 requirements from Level 1. Meeting Level 2 inherently satisfies Level 1.

---

1. U.S. Department of Defense, CMMC 2.0 Model Overview Briefing (November 2021):

Slide 5, "CMMC 2.0 Model," explicitly states that Level 1 (Foundational) is for the protection of FCI and aligns with FAR 52.204-21. It also states that Level 2 (Advanced) is for the protection of CUI and aligns with NIST SP 800-171.

2. U.S. Department of Defense, CMMC Scoping Guide, Level 2 (Version 2.0, December 3, 2021):

Section 1.1, "Purpose," Page 1: "This guide is intended to help organizations and assessors determine the scope of a CMMC Level 2 assessment. The CMMC Level 2 assessment is based on the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171... which are designed to protect Controlled Unclassified Information (CUI)."

3. U.S. Department of Defense, CMMC Scoping Guide, Level 1 (Version 2.0, December 3, 2021):

Section 1.1, "Purpose," Page 1: "This guide is intended to help organizations and assessors determine the scope of a CMMC Level 1 assessment. The CMMC Level 1 assessment is based on the safeguarding requirements in Federal Acquisition Regulation (FAR) clause 52.204-21... which are designed to protect Federal Contract Information (FCI)."