Overview
If you warehouse, kit, distribute, or move goods under a federal contract, your award documents, manifests, inventory records, shipment and tracking data, and delivery paperwork are Federal Contract Information. That triggers FAR 52.204-21 and a CMMC Level 1 self-assessment with an annual SPRS affirmation.
Most logistics and warehousing work stays at Level 1. You move toward Level 2 only when the data you hold is marked CUI, for example sensitive routing or security details for controlled shipments, or marked technical data that travels with the items you store and handle.
Logistics firms often run a warehouse management system, a handful of office PCs, scanners, and an email tenant. Level 1 is very achievable here, but it means named accounts and MFA on the systems that hold federal manifests and inventory, and basic control over who can see shipment data.
Typical contracts you'll see
- Warehousing and storage contracts for federal agencies and the military
- Distribution and kitting task orders under DLA and GSA
- Third party logistics subcontracts to a defense prime
- Freight, drayage, and transportation services on and off installations
- Supply and fulfillment under federal supply schedules
What FCI actually looks like for you
Anything below is Federal Contract Information and triggers FAR 52.204-21. None of it is CUI on its own.
Common pitfalls in this industry
- Running the warehouse management system under a single shared login, which fails FAR 52.204-21 (b)(1)(i) and (ii).
- Emailing manifests and inventory reports from personal accounts, which fails (b)(1)(iii).
- Leaving the receiving office PC logged in and unattended on the warehouse floor, which works against (b)(1)(viii).
- Granting every temp and seasonal worker full access to federal shipment data instead of least privilege.
- Assuming pure pick and pack is out of scope. The FCI in the manifests and contracts is what triggers CMMC.
- Skipping the annual SPRS affirmation after the first one.
Your Level 1 action plan
- 01Inventory the systems that hold federal FCI: the warehouse management system, office PCs, scanners that sync data, email, and backups.
- 02Confirm with the agency or prime whether any shipment or item data is marked CUI. Most general warehousing has none.
- 03Give each user a named account with MFA and set access to least privilege, so temps see only what they need.
- 04Move manifest and inventory exchange onto a paid Microsoft 365 or Google Workspace tenant rather than personal email.
- 05Lock down the receiving office and any PC that holds federal data with per person login and screen lock.
- 06Write a short boundary description: which systems hold federal manifests and inventory and who can access them.
- 07Run the 15 practice self-assessment, document evidence, then have a senior official affirm the score in SPRS and set the annual reminder.
Most common NAICS codes
Use these when searching SAM.gov, filing for set-asides, or checking size standards.
- 493110General Warehousing & Storage
- 488510Freight Transportation Arrangement
- 484110General Freight Trucking, Local
- 484121General Freight Trucking, Long-Distance, Truckload
- 541614Process, Physical Distribution & Logistics Consulting Services
- 423990Other Miscellaneous Durable Goods Merchant Wholesalers
Frequently asked questions
Q.We just warehouse and ship government goods. Do we need CMMC?
Yes, once you hold a federal contract or subcontract. The manifests, inventory records, shipment data, invoices, and delivery documents are Federal Contract Information, and FAR 52.204-21 applies to the systems that hold them. The 15 practices apply to your warehouse management system and office PCs, not to the forklift.
Q.When would a logistics firm be Level 2 instead of Level 1?
When the data you hold is marked CUI, such as sensitive routing or security details for controlled shipments, or marked technical data that travels with the items you store. General warehousing, distribution, and freight that only involve FCI stay at Level 1.
Q.We use temps and seasonal workers. How does that affect access control?
FAR 52.204-21 (b)(1)(i) through (iii) require you to identify users, authenticate them, and limit access to authorized users and the information they need. Give temps named accounts scoped to only the screens and data they need, and disable those accounts promptly when the assignment ends.
Q.Do I need an SSP for Level 1 as a warehousing contractor?
No. Level 1 does not require a System Security Plan under 32 CFR Part 170. You need evidence that each of the 15 practices is met for the systems that hold FCI, plus a short boundary description and a current list of authorized users.
Related clauses
Related terms
Read more in the Library
- CMMC Level 1: All 15 FAR Safeguarding Requirements Explained in Plain English (2026 Guide)Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on — what each control means, what evidence satisfies it, and where teams trip up.
- CMMC Level 1: The Complete 2026 Guide for Small DoD ContractorsThe single page to read first. What CMMC Level 1 is, who it applies to, what's actually required, what it costs, and the fastest honest path through it in 2026.
- How to Do CMMC Level 1 Yourself (Free, Complete Guide) — 2026CMMC Level 1 is self-assessed. You don't need a consultant. Here is the entire DIY path, with every template you'll need, written for the small defense contractors actually doing the work.
- CMMC Level 1 Scoping — How to Draw the Boundary (Free Worksheet) — 2026Treating the whole company as in-scope doubles your work for no compliance benefit. Here's the right way to scope CMMC Level 1.
- What to Tell Your Prime When They Ask for Your SPRS Score (And You're Level 1)If your prime is asking for a 0–110 SPRS score and you're a Level 1 contractor, the answer is not zero. It's that you're a different tier of the regulation. Here's how to say that without losing the contract.
- CUI vs FCI: What's the Difference? (With 12 Real Examples) — 2026FCI triggers CMMC Level 1. CUI triggers CMMC Level 2. Mix them up and you'll either over-spend by $20k or under-comply on a federal contract.