Overview
If you design or build sensors, instruments, radios, antennas, power supplies, or electronic subsystems for defense programs, your purchase orders, interface specifications, acceptance test procedures, and program correspondence are Federal Contract Information. That triggers FAR 52.204-21 and a CMMC Level 1 self-assessment with an annual SPRS affirmation.
Defense electronics is a domain where CUI shows up often, because performance specifications, interface control documents, and test results can be marked. Build to print and integration work from unmarked packages is Level 1. When a prime flows down DFARS 252.204-7012 and sends marked technical data, that program is Level 2 and needs a controlled boundary.
The practical pattern is to keep general electronics work at Level 1 and place the one or two programs that involve marked technical data into a separate, documented enclave, rather than dragging the whole company up to Level 2.
Typical contracts you'll see
- Subcontracts to defense primes for sensors, instruments, and electronic subsystems
- DLA buys for electronic assemblies and components
- Depot repair and overhaul of electronic units
- Communications and electronic warfare component subcontracts
- SBIR and STTR Phase I electronics and sensor prototypes
What FCI actually looks like for you
Anything below is Federal Contract Information and triggers FAR 52.204-21. None of it is CUI on its own.
Common pitfalls in this industry
- Treating every defense specification as CUI. CUI must be explicitly marked. Many integration packages are FCI.
- Ignoring a real -7012 flow-down. If marked technical data arrives, that program is Level 2.
- Sharing engineering and test station logins across the team, which fails FAR 52.204-21 (b)(1)(i) and (ii).
- Storing specifications and test data on an open network share readable by every contractor, which fails (b)(1)(iii).
- Letting the same workstation handle program data and public web browsing, which works against (b)(1)(iv) and (v).
- Letting the annual SPRS affirmation lapse.
Your Level 1 action plan
- 01Confirm with each prime in writing whether any -7012 flow-down applies and whether marked technical data is in play.
- 02Inventory the systems that hold program FCI: engineering and test stations, the document and configuration system, email, and backups.
- 03Move program email and document exchange onto a paid Microsoft 365 or Google Workspace tenant with MFA enforced.
- 04Set specification and test data access to least privilege and give every engineer a named account.
- 05If one program sends marked CUI, build a separate enclave for it and keep the rest of the work at Level 1.
- 06Write a one to two page boundary description of where program FCI lives and how it is separated from public systems.
- 07Run the 15 practice self-assessment, capture evidence, then have a senior official affirm the score in SPRS and calendar the annual re-affirmation.
Most common NAICS codes
Use these when searching SAM.gov, filing for set-asides, or checking size standards.
- 334511Search, Detection, Navigation, Guidance & Aeronautical Systems Manufacturing
- 334290Other Communications Equipment Manufacturing
- 334515Instrument Manufacturing for Measuring & Testing Electricity & Electrical Signals
- 334519Other Measuring & Controlling Device Manufacturing
- 335999All Other Miscellaneous Electrical Equipment & Component Manufacturing
Frequently asked questions
Q.We build sensors for a defense program. Are we Level 1 or Level 2?
It depends on the markings. If you build from unmarked specifications and the prime has not flowed down marked CUI, you are Level 1. The trigger for Level 2 is receiving technical data explicitly marked as CUI or Controlled Technical Information under DFARS 252.204-7012. Many defense electronics firms run Level 1 for general work and a small enclave for marked programs.
Q.Our performance specs feel sensitive. Does that make them CUI?
Sensitivity is not the test. CUI is explicitly marked with a CUI banner and category. If a document that should be marked is not, ask the contracting officer rather than guessing. Unmarked specifications and test data received under the contract are FCI and put you at Level 1.
Q.Is our test and configuration system in scope?
Yes, if it holds program POs, specifications, or test data that is FCI. That system, the engineering stations, and the laptops that reach them are part of your Level 1 boundary and must meet the 15 practices: named accounts, MFA, access limited to authorized users, antivirus, and patching.
Q.Do I need an SSP at Level 1?
No. Level 1 does not require a System Security Plan under 32 CFR Part 170. You need evidence the 15 practices are met for the systems that handle FCI, plus a short boundary description and a current list of authorized users.
Related clauses
Related terms
Read more in the Library
- CMMC Level 1: All 15 FAR Safeguarding Requirements Explained in Plain English (2026 Guide)Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on — what each control means, what evidence satisfies it, and where teams trip up.
- CMMC Level 1: The Complete 2026 Guide for Small DoD ContractorsThe single page to read first. What CMMC Level 1 is, who it applies to, what's actually required, what it costs, and the fastest honest path through it in 2026.
- How to Do CMMC Level 1 Yourself (Free, Complete Guide) — 2026CMMC Level 1 is self-assessed. You don't need a consultant. Here is the entire DIY path, with every template you'll need, written for the small defense contractors actually doing the work.
- CMMC Level 1 vs Level 2: Which One Do You Actually Need? (2026 Plain-English Guide)Most small defense contractors are Level 1, not Level 2 — but the wrong answer here costs you a year and tens of thousands of dollars. Here's the single question that decides it.
- CMMC Level 1 Scoping — How to Draw the Boundary (Free Worksheet) — 2026Treating the whole company as in-scope doubles your work for no compliance benefit. Here's the right way to scope CMMC Level 1.
- CUI vs FCI: What's the Difference? (With 12 Real Examples) — 2026FCI triggers CMMC Level 1. CUI triggers CMMC Level 2. Mix them up and you'll either over-spend by $20k or under-comply on a federal contract.