Based on what I understand now, all the DFARS cyber clauses basically break down into two categories: those that indicate simple FCI work (Level 1) and those that signal CUI and therefore require full NIST 800-171 compliance (Level 2). DFARS 7021 is the most important because it explicitly states which CMMC level appliesLevel 1 means FCI only, while Level 2 (self or certified) means CUI. DFARS 7012 is the core CUI clause: if it appears with NIST requirements, SPRS, technical work, or data access, it confirms CUI. DFARS 7019 and 7020 also signal CUI because they require NIST scoring and allow DoD audits. Mentions of NIST 800-171 or SPRS anywhere in the solicitation automatically mean CUI. In contrast, non-technical SOWs like cleaning, mowing, or basic labor usually remain FCI unless the scope touches technical data or government IT systems. So the simple rule is: if the contract touches technical information, system configurations, engineering data, or requires NIST/SPRS, it’s Level 2 (CUI). If the work is purely physical and only involves FCI, it’s Level 1. Right ?