When a Level 1 Contract Quietly Becomes a Level 2 Problem
A level determination isn’t a certificate you earn and keep. It’s a reading you take, and readings go stale. The work moves, the memo stays, and nobody announces the change.
Somewhere in most compliance folders is a short memo that says, in so many words, we handle FCI, not CUI, so we’re Level 1. It was probably right the day it was written. Someone did the work, made the call, and filed it.
Here’s the question I’d ask, and it’s an uncomfortable one for a compliance lead: when did anyone last check whether it’s still true?
How a right answer goes wrong
This is the part that catches careful people, because nothing dramatic happens. You didn’t misjudge your level. You judged it correctly, and then the work moved. A delivery order added a drawing. A prime’s engineer emailed a spec marked “Distribution B.” A program manager cc’d one of your people on a thread about system architecture. An old “FOUO” folder from three reorganizations ago is still sitting on a shared drive. No contract modification arrived. Nobody announced anything. And slowly, the memo in your folder started describing a company you no longer are.
When I was running our CMMC program, the thing I had to make peace with was that scope is not a decision you make once and shelve. It’s a living picture of a moving environment. Every new task order and every new customer relationship had a way of quietly changing what we handled, and if I wasn’t looking, the paperwork and the reality would drift apart without a sound. The same drift that turns an asset inventory stale can turn a scope determination stale.
The mistake isn’t getting it wrong
So the mistake here isn’t misreading your level. Plenty of careful companies get the first call exactly right. One of the easiest assumptions to make is that because the determination was correct once, it’s still correct today. That isn’t carelessness. It’s simply forgetting that businesses change faster than documentation does.
A determination has a shelf life
A level determination isn’t a certificate you earn and keep. It’s a reading you take, and readings go stale.
Your Level 1 determination isn’t permanent; it’s perishable.
The company that stays out of trouble isn’t the one that got the answer right once. It’s the one that keeps checking whether the answer still holds.
A new stop every Tuesday and Thursday.
Our twice-weekly series breaking CMMC down one step at a time. Opt in and we’ll send each one to your inbox.
Why the drift is so quiet
The reason this happens without anyone noticing is that CUI does not always announce itself. When the government provides CUI to a contractor, it is supposed to identify that through the contract and mark the material. That does not always happen cleanly, and a missing marking is not proof that information is not CUI.
What matters is who holds the authority. The agency that created the information makes the designation, not the prime who forwarded it, and not you. That cuts both ways. A technical drawing, an export-controlled specification, or a document carrying a Distribution Statement can be CUI, and a Distribution Statement on its own is a dissemination control rather than a designation. Read all of these as reasons to go find out, not as answers.
The stakes are simple to state. If CUI has become part of your environment, it’s time to revisit whether your Level 1 determination still holds and whether Level 2 requirements now apply. That’s not a reason to panic. It’s a reason to keep watching.
Catching drift is a habit, not a project
Catching drift isn’t a project. It’s a habit.
That’s the reassuring part, and it’s the whole game. You don’t have to rebuild anything to stay ahead of this. A short, regular look at what’s actually flowing into your environment can catch these changes long before a prime’s questionnaire or an assessor does. The companies that handle this well aren’t the ones with the most sophisticated tooling. They’re the ones who decided the determination was worth revisiting on purpose, instead of hoping it still held.
What I would do if I were in your seat
Make the level determination a living decision, not a filed memo.
Give it a trigger: every new contract, task order, and delivery order gets a quick CUI check before the work starts.
Read the delivery orders, not just the base contract.
That’s where scope quietly grows. Look for technical data, drawings, Distribution Statements, and any designation indicators.
Keep a standing question in front of your PMs and engineers.
What have we received from the government side lately, and where did it land? The answer usually lives with the people doing the work, not in a contract file.
When something looks like it may be CUI and the markings or contract direction are unclear, do not guess.
Isolate the question, check the CUI Registry along with your contract and program guidance, and get clarification from the appropriate government or contracting authority. The designation is not yours to make, and self-designating widens your scope, your systems, your providers, and your costs in ways that are hard to walk back.
Put a quarterly re-check on the calendar.
One short, deliberate review so the determination never silently goes stale again.
None of that is heavy. It’s the difference between a determination you made once and a determination you actually maintain. And maintaining it is what keeps a good Level 1 program from quietly becoming a Level 2 problem.
So here’s the question worth sitting with, and it may be the whole article in one line: when was the last time we actually proved our Level 1 determination was still true? If you can’t remember, that isn’t a failure. It’s the moment to make checking a habit.
CMMC: Everything You Need to Know to Get Started (6th Edition)
Want the full compliance framework and the funding resources available to defense contractors? Our guide has it.
A few sources
- 32 CFR Part 2002, the National Archives CUI Registry, and DoD Instruction 5200.48: who holds designation authority, how CUI is identified through the contract and marked, and why a missing marking is not proof that information is not CUI
- 32 CFR Part 170: the CMMC levels, and what should prompt an organization to revisit whether a Level 1 determination still holds
- DFARS 252.204-7012: the obligation to protect CUI once it is in your environment
