The distinction between the two levels has not changed. How you demonstrate them has.
Level 1 covers federal contract information. That is information provided by or generated for the government under a contract, not intended for public release. It is the lower bar, 15 basic safeguarding practices, and it has always been self assessed annually.
Level 2 covers controlled unclassified information. CUI is the sensitive category, and Level 2 maps to all 110 controls in NIST SP 800-171. This is the one that used to require a third party assessment for most contracts.
What changed in September 2026
Under DFARS Class Deviation 2026-O0025 Revision 3, both levels can now be satisfied by self assessment through November 2028. A self attested Conditional status is valid for 180 days, after which it converts to Final status valid for three years.
So the practical difference between the levels is no longer who assesses you. It is how much work is involved. Fifteen practices against 110 controls is a large gap, and it is why scoping matters so much.
Working out which one applies
Look at your contract for the clauses. DFARS 252.204-7012 indicates CUI, which points at Level 2. Its absence usually means Level 1 territory, but do not rely on absence alone, because flow down from a prime can bring obligations that are not obvious in your own paperwork.
If you genuinely cannot tell, ask your contracting officer or your prime in writing. That question is cheaper than guessing in either direction. Guessing low leaves you exposed. Guessing high means doing 110 controls when you needed 15.
The scoping point that saves the most money
Most firms that think they need Level 2 across the whole business do not. If controlled unclassified information can be confined to a defined enclave, only that enclave carries the 110 controls. The rest of your environment sits outside the boundary.
Getting that boundary right before you start is worth more than any other decision in this process, and it is much harder to change once you have built around it.