Overview
If you assemble circuit cards, build cable and wire harnesses, or manufacture electronic components for defense and aerospace primes, your purchase orders, assembly drawings, bills of material, test procedures, and acceptance records are Federal Contract Information. That triggers FAR 52.204-21 and a CMMC Level 1 self-assessment with an annual SPRS affirmation.
Electronics is a place where the CUI line matters, because design data and test data can be marked. Build to print assembly from unmarked drawings is Level 1. The moment a prime flows down DFARS 252.204-7012 and sends marked technical data, that program is Level 2 and needs a controlled boundary.
Contract manufacturers usually run an ERP or MRP system, engineering and test stations, and an email tenant. Level 1 is achievable, but it means named accounts and MFA on the systems that hold program data, controlled access to drawings and BOMs, and a clean separation from public facing systems.
Typical contracts you'll see
- Circuit card and electronic assembly subcontracts to defense and aerospace primes
- Cable, wire harness, and box build manufacturing for DoD programs
- DLA buys for electronic components and assemblies
- Depot repair and rework of electronic units
- SBIR and STTR Phase I electronics prototypes
What FCI actually looks like for you
Anything below is Federal Contract Information and triggers FAR 52.204-21. None of it is CUI on its own.
Common pitfalls in this industry
- Treating every defense schematic as CUI. CUI must be explicitly marked. Many build to print packages are FCI.
- Ignoring a real -7012 flow-down. If marked technical data arrives, that program is Level 2.
- Sharing one engineering or test station login across the team, which fails FAR 52.204-21 (b)(1)(i) and (ii).
- Storing drawings and BOMs on an open network share that every contractor can read, which fails (b)(1)(iii).
- Letting the same PC handle program data and public web browsing or the company site, which works against (b)(1)(iv) and (v).
- Letting the annual SPRS affirmation lapse.
Your Level 1 action plan
- 01Confirm with each prime in writing whether any -7012 flow-down applies and whether marked CUI or CTI is in play. Most build to print has none.
- 02Inventory the systems that hold program FCI: ERP or MRP, engineering and test stations, the file share, email, and backups.
- 03Move program email and file exchange onto a paid Microsoft 365 or Google Workspace tenant with MFA enforced.
- 04Set drawing and BOM access to least privilege, and give every engineer and operator a named account.
- 05If one program sends marked CUI, build a small separate enclave for it and keep the rest of the floor at Level 1.
- 06Write a one to two page boundary description of where program FCI lives and how it is separated from public systems.
- 07Run the 15 practice self-assessment, capture evidence, then have a senior official affirm the score in SPRS and calendar the annual re-affirmation.
Most common NAICS codes
Use these when searching SAM.gov, filing for set-asides, or checking size standards.
- 334418Printed Circuit Assembly (Electronic Assembly) Manufacturing
- 334412Bare Printed Circuit Board Manufacturing
- 334419Other Electronic Component Manufacturing
- 334511Search, Detection, Navigation, Guidance & Aeronautical Systems Manufacturing
- 335931Current-Carrying Wiring Device Manufacturing
Frequently asked questions
Q.We assemble circuit cards for a defense prime. Level 1 or Level 2?
If you build to unmarked drawings and the prime has not flowed down marked CUI, you are Level 1. The trigger for Level 2 is receiving technical data explicitly marked as CUI or Controlled Technical Information under DFARS 252.204-7012. Many contract electronics manufacturers run Level 1 for most of the floor and a small enclave for the one or two marked programs.
Q.Our schematics are export controlled. Does that make us Level 2?
Export control alone is not the same as CUI under -7012, but most primes treat export controlled technical data as CUI and flow down -7012. If that clause is in your subcontract and you have received marked data, that program is Level 2. Your non marked work can still run at Level 1.
Q.Is our ERP or MRP system in scope?
Yes, if it holds POs, BOMs, or program data that is FCI. The ERP, the engineering and test stations, and the laptops that reach them are part of your Level 1 boundary and must meet the 15 practices: named accounts, MFA, access limited to authorized users, antivirus, and patching.
Q.Do I need an SSP at Level 1?
No. Level 1 does not require a System Security Plan under 32 CFR Part 170. You need evidence that each of the 15 practices is met for the systems that handle FCI, plus a short boundary description and a current list of authorized users.
Related clauses
Related terms
Read more in the Library
- CMMC Level 1: All 15 FAR Safeguarding Requirements Explained in Plain English (2026 Guide)Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on — what each control means, what evidence satisfies it, and where teams trip up.
- CMMC Level 1: The Complete 2026 Guide for Small DoD ContractorsThe single page to read first. What CMMC Level 1 is, who it applies to, what's actually required, what it costs, and the fastest honest path through it in 2026.
- How to Do CMMC Level 1 Yourself (Free, Complete Guide) — 2026CMMC Level 1 is self-assessed. You don't need a consultant. Here is the entire DIY path, with every template you'll need, written for the small defense contractors actually doing the work.
- CMMC Level 1 Is Binary. There Is No Score. Here's What That Means.Level 1 isn't graded on a curve. Every one of the 15 requirements has to be MET — or the whole assessment fails. Here's how the rule actually works, and why that's good news for small contractors.
- CMMC Level 1 Scoping — How to Draw the Boundary (Free Worksheet) — 2026Treating the whole company as in-scope doubles your work for no compliance benefit. Here's the right way to scope CMMC Level 1.
- CMMC Level 1 vs Level 2: Which One Do You Actually Need? (2026 Plain-English Guide)Most small defense contractors are Level 1, not Level 2 — but the wrong answer here costs you a year and tens of thousands of dollars. Here's the single question that decides it.