Overview
If you run base operations support, facilities O&M, or building and grounds services on a DoD or federal site, your award documents, work orders, preventive maintenance schedules, service tickets, and base access rosters are Federal Contract Information. That triggers FAR 52.204-21 and a CMMC Level 1 self-assessment, affirmed annually in SPRS.
CUI shows up only in narrow cases for this work: security system drawings and access control configurations, anti terrorism and force protection plans, utility and industrial control system documentation for critical facilities, and similar sensitive material. Most O&M, custodial, HVAC, and grounds work never touches marked CUI.
Contracting offices at USACE, NAVFAC, AFCEC, and GSA are flowing the Level 1 self-assessment requirement into base services solicitations. Subs that arrive at mobilization without a current SPRS affirmation are increasingly told to fix it before they can start.
Typical contracts you'll see
- Base operations support (BOS) contracts and task orders
- Facilities support services and O&M under NAVFAC, AFCEC, and USACE
- Preventive and corrective maintenance contracts on federal buildings
- Custodial, grounds, pest control, and refuse contracts on installations
- Subcontracts under a large facility services prime such as KBR, Vectrus, V2X, or J&J Worldwide
What FCI actually looks like for you
Anything below is Federal Contract Information and triggers FAR 52.204-21. None of it is CUI on its own.
Common pitfalls in this industry
- Running the contract from a shared crew inbox or personal email, which fails FAR 52.204-21 (b)(1)(i) and (iii).
- Using one shared office or trailer PC with no per person login, which fails (b)(1)(i) and (ii).
- Storing base access rosters and pay applications in an unlocked cabinet, which fails (b)(1)(viii).
- Letting 1099 trades and subs use the owner's credentials to reach the company tenant.
- Assuming custodial or grounds work is too low tech to be in scope. The FCI in the paperwork is what triggers CMMC.
- Treating a sensitive facility project as Level 1 when the security or facility drawings are marked CUI.
Your Level 1 action plan
- 01Inventory the contracts: which agency or prime, any -7012 flow-down, any marked CUI. Most base services work has none.
- 02Move contract email off personal and shared accounts onto a paid Microsoft 365 or Google Workspace tenant with MFA enforced.
- 03Give the PM, schedulers, and office staff named accounts, and lock down the office or trailer PC with per person login and screen lock.
- 04Pick one cloud folder for schedules, tickets, and reports, and restrict access to the project team.
- 05Lock the cabinet that holds access rosters and pay applications, and keep a simple visitor log where subs come through.
- 06Write a one page boundary description: which laptops, which tenant, which office or trailer, which cabinet.
- 07Run the 15 practice self-assessment, then have a senior official post and affirm the SPRS score and re-affirm annually.
Most common NAICS codes
Use these when searching SAM.gov, filing for set-asides, or checking size standards.
- 561210Facilities Support Services
- 561720Janitorial Services
- 561730Landscaping Services
- 238220Plumbing, Heating & Air-Conditioning Contractors
- 561621Security Systems Services (except Locksmiths)
- 562111Solid Waste Collection
Frequently asked questions
Q.We do base operations support. Is the whole contract Level 1?
Usually yes. Base operations and facilities O&M produce Federal Contract Information in the task orders, tickets, schedules, and access rosters, which puts the contract at Level 1. The exception is work tied to sensitive facilities or security systems where drawings or plans are marked CUI under DFARS 252.204-7012, which is Level 2 for that portion of the work.
Q.Does the prime's CMMC status cover us as a base services sub?
No. CMMC flows down. If you receive FCI from the prime, such as schedules, tickets, and rosters, you have your own FAR 52.204-21 obligation and need your own SPRS affirmation. The prime cannot affirm for you.
Q.Our project is at a SCIF or a security control center. Are we still Level 1?
Probably not for that project. If the facility security drawings, access control configurations, or force protection plans are marked CUI, that work is Level 2 and needs a controlled boundary. The rest of your non sensitive base services portfolio can stay at Level 1.
Q.What does the physical access requirement mean for a job trailer?
FAR 52.204-21 (b)(1)(viii) requires you to limit physical access to systems and information. For a trailer that means locking it when it is empty, locking the cabinet that holds rosters and pay apps, not leaving the PC logged in and unattended, and keeping a visitor log when subs come through.
Related clauses
Related terms
Read more in the Library
- CMMC Level 1: All 15 FAR Safeguarding Requirements Explained in Plain English (2026 Guide)Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on — what each control means, what evidence satisfies it, and where teams trip up.
- CMMC Level 1: The Complete 2026 Guide for Small DoD ContractorsThe single page to read first. What CMMC Level 1 is, who it applies to, what's actually required, what it costs, and the fastest honest path through it in 2026.
- How to Do CMMC Level 1 Yourself (Free, Complete Guide) — 2026CMMC Level 1 is self-assessed. You don't need a consultant. Here is the entire DIY path, with every template you'll need, written for the small defense contractors actually doing the work.
- CMMC Level 1 Scoping — How to Draw the Boundary (Free Worksheet) — 2026Treating the whole company as in-scope doubles your work for no compliance benefit. Here's the right way to scope CMMC Level 1.
- What to Tell Your Prime When They Ask for Your SPRS Score (And You're Level 1)If your prime is asking for a 0–110 SPRS score and you're a Level 1 contractor, the answer is not zero. It's that you're a different tier of the regulation. Here's how to say that without losing the contract.
- CMMC Level 1 vs Level 2: Which One Do You Actually Need? (2026 Plain-English Guide)Most small defense contractors are Level 1, not Level 2 — but the wrong answer here costs you a year and tens of thousands of dollars. Here's the single question that decides it.