Overview
If your shop writes custom software, builds web applications, or modernizes legacy systems for the government, the requirements, the backlog, the source you produce under contract, and the award documents are Federal Contract Information. That puts you in scope for FAR 52.204-21 and a CMMC Level 1 self-assessment with an annual SPRS affirmation.
The trigger for Level 2 is the data the application handles, not the act of coding. If you are building a public information site, an internal workflow tool, or a prototype that never touches CUI, you stay at Level 1. If the system you deliver or operate will store or process CUI, or the agency flows marked CUI into your development and test environments, that contract is Level 2.
Most early stage software vendors run everything through a single cloud tenant, a code host, and a handful of laptops. That is fine for Level 1, but it has to be locked down: named accounts, MFA, controlled repository access, and a clear boundary so a reviewer can see exactly where federal FCI lives.
Typical contracts you'll see
- Custom application development and modernization task orders for civilian and defense agencies
- Web and portal builds for federal program offices
- Agile development subcontracts under a systems integration prime
- SBIR and STTR software prototypes (Phase I is almost always Level 1)
- Maintenance and enhancement task orders on government owned applications that hold FCI only
What FCI actually looks like for you
Anything below is Federal Contract Information and triggers FAR 52.204-21. None of it is CUI on its own.
Common pitfalls in this industry
- Hosting the code repository and project tooling under personal accounts shared across the team, which fails FAR 52.204-21 (b)(1)(i) and (ii).
- Leaving repositories and cloud projects world readable or open to every contractor, which fails (b)(1)(iii) limit access to authorized users.
- Putting real CUI into development or test environments without re-scoping to Level 2.
- Letting a fractional or 1099 developer use a personal, unencrypted laptop with no MFA.
- Publishing screenshots, architecture, or award details before the agency clears them for public release, which fails (b)(1)(iv).
- Treating the SPRS affirmation as one and done instead of an annual obligation by a senior official.
Your Level 1 action plan
- 01Decide, per contract, whether the system will ever hold CUI. If yes, scope that contract as Level 2 with a separate environment.
- 02Move source control, issue tracking, and CI into accounts with named identities and MFA, and remove access for anyone off the project.
- 03Set repository and cloud project permissions to least privilege, so only authorized team members can read federal code and data.
- 04Encrypt every development laptop and require a screen lock and a passcode on phones used for project work.
- 05Keep production secrets and credentials in a managed secrets store, not in code, chat, or a shared note.
- 06Write a one page boundary description: which tenant, which repos, which environments hold FCI, and who has access.
- 07Run the 15 practice self-assessment, capture evidence, then have a senior official affirm the score in SPRS and set the annual reminder.
Most common NAICS codes
Use these when searching SAM.gov, filing for set-asides, or checking size standards.
- 541511Custom Computer Programming Services
- 541512Computer Systems Design Services
- 541519Other Computer Related Services
- 513210Software Publishers
- 541715R&D in the Physical, Engineering & Life Sciences
Frequently asked questions
Q.We build a public facing website for an agency. Do we need CMMC?
If you hold a federal contract or subcontract to build it, the requirements, your invoices, the source you write under the contract, and the project correspondence are FCI, so FAR 52.204-21 and a Level 1 self-assessment apply. The public nature of the site does not remove the FCI in your own environment.
Q.When does a software contract become Level 2?
When the application stores, processes, or transmits CUI, or when the agency flows marked CUI under DFARS 252.204-7012 into your development, test, or hosting environment. At that point the systems handling CUI are Level 2 and need a separate, controlled boundary. Building software that only handles FCI stays at Level 1.
Q.Does my code repository count as a system in scope?
Yes, if it holds source, tickets, or documents that are FCI for the contract. The repository, the CI pipeline, and the laptops that access them are part of your Level 1 boundary and must meet the 15 practices: named accounts, MFA, access limited to authorized users, and basic protection of the systems.
Q.We are a two person startup. Is the whole company in scope?
Only the systems that process, store, or transmit FCI are in scope. For a small software startup whose only revenue is the federal work, that is effectively the whole company. If you have separate commercial work on separate systems, you can scope just the federal touching environment and document the boundary clearly.
Related clauses
Related terms
Read more in the Library
- CMMC Level 1: All 15 FAR Safeguarding Requirements Explained in Plain English (2026 Guide)Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on — what each control means, what evidence satisfies it, and where teams trip up.
- CMMC Level 1: The Complete 2026 Guide for Small DoD ContractorsThe single page to read first. What CMMC Level 1 is, who it applies to, what's actually required, what it costs, and the fastest honest path through it in 2026.
- How to Do CMMC Level 1 Yourself (Free, Complete Guide) — 2026CMMC Level 1 is self-assessed. You don't need a consultant. Here is the entire DIY path, with every template you'll need, written for the small defense contractors actually doing the work.
- Just Won an SBIR Phase I? Here's Your CMMC Timeline (2026 Edition)Congrats on the Phase I award. Now the question that ambushes most founders: do you need CMMC to start work, or only at Phase II? The honest answer depends on what kind of data the agency hands you on day one.
- CMMC Level 1 vs Level 2: Which One Do You Actually Need? (2026 Plain-English Guide)Most small defense contractors are Level 1, not Level 2 — but the wrong answer here costs you a year and tens of thousands of dollars. Here's the single question that decides it.
- CMMC Level 1 Scoping — How to Draw the Boundary (Free Worksheet) — 2026Treating the whole company as in-scope doubles your work for no compliance benefit. Here's the right way to scope CMMC Level 1.