Overview
If you build, repair, clean, mow, fuel, repaint, or otherwise maintain a DoD installation, your contracts almost always sit at CMMC Level 1. The award documents, set-aside paperwork, base-access requests, schedules, RFIs, submittals, and pay applications are all Federal Contract Information (FCI) — and that triggers FAR 52.204-21 and a Level 1 self-assessment.
CUI only enters this world in narrow cases: secure-facility design drawings (SCIFs, weapons storage, command centers), critical-infrastructure protection plans, certain ICS / SCADA documentation, and anti-terrorism / force-protection details. Most concrete pours, roofing replacements, grass cuts, and HVAC tune-ups never see CUI.
USACE, NAVFAC, and AFCEC contracting officers have started flowing the CMMC Level 1 self-assessment requirement into solicitations under the 48 CFR CMMC acquisition rule. Subs that show up to a kickoff without a posted SPRS affirmation are increasingly being told to fix it before they can mobilize.
Typical contracts you'll see
- USACE MATOC / IDIQ task orders for construction, repair, and renovation
- NAVFAC Atlantic / Pacific O&M and minor-construction contracts
- AFCEC base operations support and facility-sustainment contracts
- GSA PBS Region task orders on federal buildings co-located with DoD tenants
- Subcontracts under a large facility-services prime (Fluor, KBR, Vectrus, V2X, J&J Worldwide)
- 8(a), HUBZone, WOSB, SDVOSB set-asides for small-dollar construction and trades
What FCI actually looks like for you
Anything below is Federal Contract Information and triggers FAR 52.204-21. None of it is CUI on its own.
Common pitfalls in this industry
- Sending RFIs and submittals from a personal Gmail or a shared crew@ inbox — fails FAR 52.204-21 (b)(1)(i)–(iii).
- Using a single shared laptop in the job trailer with no per-user login — fails (b)(1)(i) and (b)(1)(viii) physical access controls.
- Storing pay applications and base-access rosters in an unlocked file cabinet in the trailer — fails (b)(1)(viii).
- Letting subs and 1099 trades log into the company tenant with the owner's credentials — fails (b)(1)(i)–(ii).
- Assuming that because the work is "just dirt and concrete" CMMC doesn't apply — it does, the moment FCI flows.
- Mistaking a secure-facility project as Level 1 — if the drawings are marked CUI, the project is Level 2 and the trailer needs a real boundary.
Your Level 1 action plan
- 01Inventory the contracts: which prime, which contracting agency, any -7012 flow-down, any marked CUI? Most won't have any.
- 02Move project email off personal accounts onto a Microsoft 365 or Google Workspace tenant with MFA enforced — including for the PM, the estimator, and the office manager.
- 03Lock down the trailer laptop: per-user login, screen lock after 15 minutes, antivirus on, drive encrypted.
- 04Pick one cloud folder (SharePoint, OneDrive, Google Drive) for submittals / RFIs / schedules and restrict access to the project team.
- 05Lock the file cabinet that holds pay applications and base-access paperwork; keep a log of who has the key.
- 06Write a one-page boundary description: which laptops, which tenant, which trailer, which file cabinet. This is your scoping artifact.
- 07Run the 15-practice self-assessment, then have the company's senior official post the SPRS score and affirm — and re-affirm annually.
Most common NAICS codes
Use these when searching SAM.gov, filing for set-asides, or checking size standards.
- 236220Commercial & Institutional Building Construction
- 237110Water & Sewer Line & Related Structures Construction
- 237310Highway, Street & Bridge Construction
- 238210Electrical Contractors & Other Wiring Installation
- 238220Plumbing, Heating & Air-Conditioning Contractors
- 561210Facilities Support Services
- 561720Janitorial Services
- 561730Landscaping Services
Frequently asked questions
Q.I just mow grass on an Air Force base. Do I really need CMMC?
If your contract is with the federal government (directly or as a sub to a prime that holds a federal contract), then yes — the award documents, your invoices, and your base-access roster are Federal Contract Information, and FAR 52.204-21 applies. That means a CMMC Level 1 self-assessment and an annual SPRS affirmation. The 15 practices are basic IT hygiene; they apply to the laptop and email you use to send invoices, not to the lawn mower.
Q.Our project is on a SCIF / weapons storage / sensitive facility. Are we still Level 1?
Probably not. If the design drawings, anti-terrorism / force-protection plans, or facility security details are marked CUI under DFARS 252.204-7012, that contract is Level 2 and needs a real CUI boundary — usually a separate folder structure with restricted access and often a GCC High or equivalent tenant. The rest of your portfolio (non-sensitive projects) can stay at Level 1.
Q.We're a sub on a USACE MATOC. Does the prime's CMMC level cover us?
No. CMMC flows down. If you receive FCI from the prime — RFIs, submittals, schedules, daily reports — you have your own FAR 52.204-21 obligation and need your own SPRS affirmation. The prime cannot affirm on your behalf. For Level 2 contracts the same flow-down applies via DFARS 252.204-7012.
Q.Can I keep using personal Gmail for project email if I'm only Level 1?
No. FAR 52.204-21 (b)(1)(i) and (iii) require you to identify users and limit access to authorized users and the information they need. Personal Gmail accounts shared across a crew fail both. The fix is cheap: a paid Google Workspace or Microsoft 365 tenant with MFA on every account, around $6–$15 per user per month.
Q.What does the trailer / job-site physical security requirement actually mean?
FAR 52.204-21 (b)(1)(viii) requires you to limit physical access to systems and information. In practice for a job trailer: lock the trailer when nobody's in it, lock the file cabinet that holds pay apps and rosters, don't leave the laptop logged in and unattended, and keep a simple visitor log if subs are coming through. That's the standard.
Related clauses
Related terms
Read more in the Library
- CMMC Level 1: All 15 FAR Safeguarding Requirements Explained in Plain English (2026 Guide)Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on — what each control means, what evidence satisfies it, and where teams trip up.
- CMMC Level 1: The Complete 2026 Guide for Small DoD ContractorsThe single page to read first. What CMMC Level 1 is, who it applies to, what's actually required, what it costs, and the fastest honest path through it in 2026.
- How to Do CMMC Level 1 Yourself (Free, Complete Guide) — 2026CMMC Level 1 is self-assessed. You don't need a consultant. Here is the entire DIY path, with every template you'll need, written for the small defense contractors actually doing the work.
- CMMC Level 1 Scoping — How to Draw the Boundary (Free Worksheet) — 2026Treating the whole company as in-scope doubles your work for no compliance benefit. Here's the right way to scope CMMC Level 1.
- What to Tell Your Prime When They Ask for Your SPRS Score (And You're Level 1)If your prime is asking for a 0–110 SPRS score and you're a Level 1 contractor, the answer is not zero. It's that you're a different tier of the regulation. Here's how to say that without losing the contract.
- CMMC Level 1 vs Level 2: Which One Do You Actually Need? (2026 Plain-English Guide)Most small defense contractors are Level 1, not Level 2 — but the wrong answer here costs you a year and tens of thousands of dollars. Here's the single question that decides it.