Overview
If you perform electrical, plumbing, drywall, roofing, concrete, or other specialty trade work as a subcontractor on federal construction, your submittals, RFIs, schedules, daily reports, and base access paperwork are Federal Contract Information. That triggers FAR 52.204-21 and a CMMC Level 1 self-assessment with an annual SPRS affirmation.
Specialty trade work is overwhelmingly Level 1. CUI enters only in narrow cases: secure facility electrical and security system drawings, critical infrastructure details, and anti terrorism or force protection plans. Most trade work on a federal project never sees marked CUI.
Trade subs often run a job trailer, a couple of laptops, and a lot of paper submittals. Level 1 covers the systems that hold FCI: the email and file systems for submittals and schedules, the trailer laptop, and the controlled paperwork on site.
Typical contracts you'll see
- Electrical, plumbing, and mechanical subcontracts on federal construction
- Drywall, roofing, flooring, and finishes subcontracts
- Concrete and structural subcontracts on USACE and NAVFAC projects
- Subcontracts under a general construction prime
- Set aside trade subcontracts (8(a), HUBZone, SDVOSB)
What FCI actually looks like for you
Anything below is Federal Contract Information and triggers FAR 52.204-21. None of it is CUI on its own.
Common pitfalls in this industry
- Sending submittals and RFIs from a personal or shared crew inbox, which fails FAR 52.204-21 (b)(1)(i) and (iii).
- Using a single shared trailer laptop with no per person login, which fails (b)(1)(i) and (ii).
- Leaving pay applications and access rosters in an unlocked trailer or cabinet, which fails (b)(1)(viii).
- Letting 1099 trades use the owner's credentials to reach the company tenant.
- Assuming trade work is out of scope because it is hands on. The FCI in the paperwork is what triggers CMMC.
- Treating a secure facility project as Level 1 when the drawings are marked CUI.
Your Level 1 action plan
- 01Inventory the contracts: which prime, which agency, any -7012 flow-down, any marked CUI. Most trade work has none.
- 02Move project email off personal and shared accounts onto a paid Microsoft 365 or Google Workspace tenant with MFA enforced.
- 03Lock down the trailer laptop with per person login and screen lock, and give office staff named accounts.
- 04Pick one cloud folder for submittals, RFIs, and schedules, and restrict access to the project team.
- 05Lock the cabinet that holds pay applications and access rosters, and keep a visitor log.
- 06Write a one page boundary description: which laptops, which tenant, which trailer, which cabinet.
- 07Run the 15 practice self-assessment, then have a senior official post and affirm the SPRS score and re-affirm annually.
Most common NAICS codes
Use these when searching SAM.gov, filing for set-asides, or checking size standards.
- 238210Electrical Contractors & Other Wiring Installation Contractors
- 238220Plumbing, Heating & Air-Conditioning Contractors
- 238310Drywall & Insulation Contractors
- 238160Roofing Contractors
- 238110Poured Concrete Foundation & Structure Contractors
Frequently asked questions
Q.I am just an electrical sub on a base project. Do I need CMMC?
Yes, if you receive Federal Contract Information from the prime or agency. Submittals, RFIs, schedules, and base access rosters are FCI, and FAR 52.204-21 applies to the systems that hold them. The 15 practices apply to the laptop and email you use to run the job, not to the conduit and wire.
Q.Does the prime's CMMC status cover us as a trade sub?
No. CMMC flows down. If you receive FCI from the prime, you have your own FAR 52.204-21 obligation and need your own SPRS affirmation. The prime cannot affirm on your behalf.
Q.Our project is at a secure facility. Are we still Level 1?
Maybe not for that project. If the electrical, security system, or facility drawings are marked CUI under DFARS 252.204-7012, that work is Level 2 and needs a controlled boundary. The rest of your non sensitive trade work stays at Level 1.
Q.Can I keep using personal email for submittals at Level 1?
No. FAR 52.204-21 (b)(1)(i) and (iii) require identified users and access limited to authorized users. A paid Microsoft 365 or Google Workspace tenant with MFA, a few dollars per user per month, fixes it.
Related clauses
Related terms
Read more in the Library
- CMMC Level 1: All 15 FAR Safeguarding Requirements Explained in Plain English (2026 Guide)Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on — what each control means, what evidence satisfies it, and where teams trip up.
- CMMC Level 1: The Complete 2026 Guide for Small DoD ContractorsThe single page to read first. What CMMC Level 1 is, who it applies to, what's actually required, what it costs, and the fastest honest path through it in 2026.
- How to Do CMMC Level 1 Yourself (Free, Complete Guide) — 2026CMMC Level 1 is self-assessed. You don't need a consultant. Here is the entire DIY path, with every template you'll need, written for the small defense contractors actually doing the work.
- CMMC Level 1 Scoping — How to Draw the Boundary (Free Worksheet) — 2026Treating the whole company as in-scope doubles your work for no compliance benefit. Here's the right way to scope CMMC Level 1.
- What to Tell Your Prime When They Ask for Your SPRS Score (And You're Level 1)If your prime is asking for a 0–110 SPRS score and you're a Level 1 contractor, the answer is not zero. It's that you're a different tier of the regulation. Here's how to say that without losing the contract.
- CMMC Level 1 vs Level 2: Which One Do You Actually Need? (2026 Plain-English Guide)Most small defense contractors are Level 1, not Level 2 — but the wrong answer here costs you a year and tens of thousands of dollars. Here's the single question that decides it.