When You Can Stop at CMMC Level 1

Level 2 is a substantially larger undertaking than Level 1. One hundred and ten practices instead of fifteen, an SSP, a POA&M, SPRS scoring and an annual affirmation.

So the question of whether you can legitimately stay at Level 1 is worth answering carefully rather than hopefully.

The test

You can stay at Level 1 if you handle Federal Contract Information and never receive, generate, process or store Controlled Unclassified Information.

That is a conclusion about your data, not a decision about your budget. If CUI reaches your systems, Level 2 applies whether or not you wanted it to.

Who genuinely stays at Level 1

Services with no technical data exchange. Cleaning, catering, landscaping, facilities work at a defense site. You receive a contract, a schedule and invoices. None of it is technical.

Commodity supply. Standard parts sold from a catalog against a purchase order, where the government or the prime does not send you drawings or specifications.

Staffing and administration where the work does not involve access to technical data or covered systems.

The pattern: no engineering data flows to you.

Who thinks they are Level 1 and is not

The machine shop that gets drawings. The moment a prime sends engineering drawings or specifications so you can make a part, that is almost certainly Controlled Technical Information, which is a CUI category. This is the most common misclassification we see.

Anyone receiving a specification that is not public. Materials specifications, tolerances, test procedures.

IT providers with access to a client’s covered systems. If you administer a system that holds CUI, you handle CUI, even if you never open a file.

Anyone who received an unmarked document that is CUI anyway. Marking is inconsistent. The category decides, not the stamp.

How to keep it true

A Level 1 determination is accurate on the day it is made. Contracts change.

Check every new contract and every flow down. A single new subcontract that carries DFARS 252.204-7012 moves you.

Tell your primes you do not accept CUI. If your business genuinely does not need it, say so in writing and ask them not to send it. A prime that knows will usually redact or withhold rather than escalate your obligations for you.

Have a rule for what to do if CUI arrives anyway. It happens: an engineer attaches a drawing to an email because it was easier. Someone should know to report it rather than file it, because the arrival of CUI in your inbox is the moment your scope changed.

Reassess annually, alongside the affirmation you are signing anyway.

The honest trade

Some companies conclude they could take on CUI work but do not want the obligation, and decline that work deliberately. That is a legitimate business decision and a cheaper one than a Level 2 program built reluctantly.

Others discover they have been handling CUI for two years without knowing. That is the expensive version, and it is why the scoping question is worth an afternoon rather than a guess.