Do We Actually Need CMMC Level 2? Decision Tree

Decision flow

Work from top to bottom. The goal is not to make a final legal determination; it is to identify which CMMC path deserves a scoped review.

Step 1

Does a contract, solicitation, or prime flowdown mention CMMC, DFARS 252.204-7021, or a Level 2 status?

Yes: move to Step 2 and preserve the clause or flowdown language.
No: move to Step 3 if you still handle controlled technical or defense information.
Unsure: review the request with someone who can interpret the contract path before answering.

Step 2

Does the work involve CUI or controlled technical information?

Yes: Level 2 is likely relevant; start scoping before choosing technology or a timeline.
No, FCI only: Level 1 or basic safeguarding may be the better starting point.
Unknown: map information types, labels, drawings, specs, file shares, and prime-provided data.

Step 3

Where does the sensitive work happen?

Email, file sharing, CAD, ERP, cloud storage, shop-floor workflows, and supplier handoffs can all affect the boundary.
If CUI touches only a small team or system set, an enclave may reduce scope.
If CUI is spread across general business systems, plan for broader remediation and documentation.

Step 4

Is the requirement tied to award, option period, or ongoing status?

Condition of award: timing risk is high; validate readiness and documentation early.
Option period or future flowdown: use the time to scope, close gaps, and avoid rushed evidence.
Prime questionnaire only: answer carefully and avoid claiming status beyond your evidence.

Step 5

Which outcome fits?

Likely Level 2: start with CUI scoping and a readiness roadmap.
Potential Level 2 but unclear CUI: run a scope review before remediation.
FCI-only today: keep contract monitoring in place and avoid unnecessary Level 2 spend.

Step 6

What should you do next?

Use a scoping tool if the CUI boundary is the main unknown.
Use a readiness planner if Level 2 already looks likely.
Book a scope call if contract language, CUI handling, or cloud architecture needs interpretation.

Recommended path by result

Match the decision-tree result to the next useful page, tool, or asset.

Likely Level 2

Scope the environment first

Review CUI Scoping, try the Scoping Boundary Builder, and inspect the CUI Scoping Pack before remediation.

Readiness path

Turn scope into a workplan

Review Readiness Assessment and use the Assessment Readiness Planner to estimate phases, risk, and documentation work.

Human review

Clarify the contract and boundary

When the answer depends on contract language, CUI handling, or cloud architecture, use a scoped conversation before committing to a path.

Book a scope call

Official-source posture

This decision tree is written to support planning. It does not replace contract review, legal interpretation, or an official assessment. The practical starting point is to preserve the requirement language, identify whether CUI is present, and document the CUI boundary before choosing a remediation plan.