CMMC Level 1 vs Level 2: when an AI tool brings a system into scope

CMMC levels follow the information, not the technology. Level 1 is about Federal Contract Information (FCI). Level 2 is about Controlled Unclassified Information (CUI). An AI tool lands at whichever level the information flowing through it, or the protection it provides, puts it. Neither 32 CFR Part 170 nor NIST SP 800-171 Rev. 3 has an AI-specific rule; the same scoping test applies to a chatbot as to a file server.

The two levels side by side

DoD CIO summarizes the same split: Level 1 is an annual self-assessment and annual affirmation of compliance with the 15 security requirements in FAR clause 52.204-21; Level 2 is a self-assessment every three years, with annual affirmation of compliance with the 110 security requirements in NIST SP 800-171 Revision 2.

A Level 2 POA&M has conditions. The score divided by the number of Level 2 requirements must be greater than or equal to 0.8, and certain requirements, including CA.L2-3.12.4 System Security Plan, can never be on it. Achieving Level 2 (Self) also satisfies the requirements for a CMMC Status of Level 1 (Self) for the same assessment scope.

Level 1 scope: systems that touch FCI

Under § 170.19(b), OSA information systems which process, store, or transmit FCI are in scope for CMMC Level 1. Systems that do not are out of scope, and there are no documentation requirements for out-of-scope assets at Level 1. To scope, the rule says to consider the people, technology, facilities, and External Service Providers (ESP) that handle FCI.

Level 2 scope: five asset categories

Table 3 to § 170.19(c)(1) sorts every asset into a category:

• CUI Assets: assets that process, store, or transmit CUI. Assessed against all Level 2 requirements.
• Security Protection Assets: assets that provide security functions or capabilities to the OSA’s CMMC Assessment Scope. Assessed against the requirements relevant to those capabilities.
• Contractor Risk Managed Assets: assets that can, but are not intended to, process, store, or transmit CUI because of security policy, procedures, and practices in place. Documented in the SSP; the assessor can run a limited check.
• Specialized Assets: IoT, IIoT, OT, government-furnished equipment, restricted information systems and test equipment that can process, store, or transmit CUI but are unable to be fully secured.
• Out-of-Scope Assets: assets that cannot process, store, or transmit CUI; and do not provide security protections for CUI Assets. The organization must prepare to justify the inability of an Out-of-Scope Asset to process, store, or transmit CUI, and assets that fall into any in-scope asset category cannot be considered an Out-of-Scope Asset.

NIST’s framing is the same: the SP 800-171 requirements apply to components of nonfederal systems that process, store, or transmit CUI or that provide protection for such components.

When an AI tool brings a system into scope

Analysis, not sourced fact: the rule does not name AI, so the mapping below applies the § 170.19 categories to common AI deployment patterns. Your assessor’s reading of your SSP decides.

1. CUI goes into prompts, retrieval indexes, fine-tuning sets, logs or outputs. The AI tool and the systems it runs on are CUI Assets, assessed against all Level 2 requirements. This is the most common way an AI pilot turns a Level 1 environment into a Level 2 one.
2. Only FCI goes in. If the tool handles FCI and no CUI, it is in Level 1 scope as a system that process, store, or transmit FCI.
3. The AI service is a cloud service. For Level 2, a cloud offering that handles CUI must be FedRAMP Authorized at the FedRAMP Moderate (or higher) baseline or meet security requirements equivalent to those established by the FedRAMP Moderate (or higher) baseline. Your side does not drop out: the OSA’s on-premises infrastructure connecting to the CSP’s product or service offering is part of the CMMC Assessment Scope.
4. The AI provider is an external service provider but not a cloud provider (for example a managed annotation or model-ops service that handles CUI). Its services are in the OSA’s assessment scope and shall be assessed as part of the OSA’s assessment.
5. The AI tool is a security tool. An AI-driven SOC, EDR or log-analysis service that protects the CUI environment is a Security Protection Asset. Security Protection Data includes log files generated by or ingested by an SPA, and a cloud provider handling SPD without CUI is in the OSA’s assessment scope and shall be assessed as Security Protection Assets.
6. The AI tool could reach CUI but policy says it must not. That is the Contractor Risk Managed Asset pattern: it has to be in the asset inventory, the SSP and the network diagram, and the controls that keep CUI out are what the assessor will question.
7. The AI tool is physically or logically separated and cannot reach CUI. It can be out of scope, but you must be able to justify that, and a tool that protects CUI assets cannot be out of scope.

Where the program stands (24 October 2026)

DoD CIO says that on July 13, 2026 the DoW suspended the implementation of Phase II of the CMMC and established a CMMC reform task force, that the program is paused in Phase 1 and may only require self-assessments at two levels, and that during this period the DoW will enforce cybersecurity compliance with NIST 800-171 Rev 2 through self-assessments and select government-led assessments. The pause does not eliminate the requirement for companies to protect information in accordance with DFARS clause 252.204-7012.

C3PAO certification assessments still take place. On 14 October 2026 Tagup, which describes itself as a defense technology company working with AI for logistics, announced it had achieved Cybersecurity Maturity Model Certification (CMMC) Level 2 following an independent assessment by Sera Brynn, an authorized CMMC Third-Party Assessment Organization (C3PAO). That is an organizational certification of Tagup’s assessed environment, not an assessment of an AI model.

The requirement baseline is still Revision 2. NIST published SP 800-171 Rev. 3 in May 2024, and it supersedes Rev. 2 on the NIST site. But the CMMC rule uses NIST SP 800-171 R2 and DoD CIO describes enforcement against NIST 800-171 Rev 2.

Questions

Does using an AI assistant on FCI-only work require Level 2?

No source we cite says so. Level 2 scoping in § 170.19(c) is driven by CUI. A tool that handles only FCI is a Level 1 scoping question under § 170.19(b). Check the solicitation: DoD Program Managers or requiring activities are responsible for selecting the CMMC Status based on whether FCI or CUI will be handled.

Can a gap in how we control an AI tool go on a POA&M at Level 1?

No. A POA&M is not permitted at any time for Level 1 self-assessments. The organization must complete and achieve a MET result for all security requirements.

If our AI vendor is FedRAMP Moderate, is our integration out of scope?

No. The rule keeps the OSA’s on-premises infrastructure connecting to the CSP’s product or service offering in scope, and the security requirements from the customer responsibility matrix must be documented or referred to in the OSA’s SSP.

For Level 3, see CMMC Level 2 vs Level 3 for AI systems. For control-by-control detail, see NIST SP 800-171 controls for AI tools handling CUI and the CMMC / NIST SP 800-171 explainer.