We have an L2 enclave with an internet facing DMZ that hosts multiple web services for customers. These services:

1. Have all of the L2 controls implemented.
2. Provide different classifications of information (public, FCI, CUI).

My question is if a service provides only FCI information, are customers that are L1 compliant allowed to connect to that service even if it is hosted in an L2 enclave?

We are wondering as we have been advised that all systems connecting to our L2 enclave are required to be L2 compliant.