Pick your industry. Get the Level 1 plan that actually fits.
Three contractor populations make up the vast majority of CMMC Level 1 shops. Each has its own contracts, its own version of FCI, and its own pitfalls. Pick yours below.
New to CMMC? Start with the CMMC Level 1 complete guide, the glossary, or the clauses library.
Machine shops & precision manufacturers
Small CNC, precision-machining, and metal-fabrication shops are the single largest population sitting at CMMC Level 1. They typically receive Federal Contract Information (FCI), drawings, purchase orders, delivery schedules, from a DoD prime, but never receive Controlled Unclassified Information (CUI) like technical data marked under DFARS 252.204-7012.
SBIR Phase I awardees
First-time SBIR Phase I winners with a DoD component (AFWERX, NavalX, ARMY xTech, DIU, etc.) almost always sit at CMMC Level 1 for the duration of Phase I. Phase I award documents, kickoff materials, and progress reports are FCI; CUI is rare until Phase II and only when the agency explicitly marks deliverables.
Construction, facilities & base-services subcontractors
Subcontractors performing construction, facility maintenance, janitorial, landscaping, fuel handling, and other base-services work for USACE, NAVFAC, AFCEC, and the GSA Public Buildings Service sit overwhelmingly at CMMC Level 1. The contract paperwork, drawings, and schedules are FCI; CUI is rare unless the project touches a sensitive facility, security system, or critical-infrastructure design.
IT services & managed service providers (MSPs)
Small IT services firms and managed service providers that support federal offices or sit under a DoD prime usually start at CMMC Level 1. Help desk tickets, asset inventories, network diagrams, and contract paperwork are Federal Contract Information (FCI). The line to watch is the moment you store, process, or administer systems that hold marked Controlled Unclassified Information (CUI), because that pushes you to Level 2 and into External Service Provider territory.
Software & application development firms
Small custom software, web, and application development shops building for federal agencies or for a DoD prime usually start at CMMC Level 1. Requirements documents, source code written under contract, tickets, and award paperwork are Federal Contract Information (FCI). You move to Level 2 only when the system you build or operate stores, processes, or transmits marked Controlled Unclassified Information (CUI).
Aerospace & aircraft parts manufacturers
Small aerospace and aircraft parts manufacturers and MRO shops feeding the defense supply chain sit overwhelmingly at CMMC Level 1. Purchase orders, build to print drawings, delivery schedules, and quality records are Federal Contract Information (FCI). You move to Level 2 only when a prime flows down DFARS 252.204-7012 and sends drawings or technical data explicitly marked as Controlled Unclassified Information or Controlled Technical Information.
Metal fabrication & welding shops
Structural and sheet metal fabricators, weld shops, and repair fabricators supplying DoD depots and primes sit squarely at CMMC Level 1. Drawings, weldments, repair orders, and delivery paperwork are Federal Contract Information (FCI). CUI only enters when a prime flows down DFARS 252.204-7012 and sends explicitly marked technical data.
Base operations & facilities O&M contractors
Companies providing base operations support, facilities operations and maintenance, and grounds and building services on federal installations sit overwhelmingly at CMMC Level 1. Task orders, work tickets, schedules, and base access rosters are Federal Contract Information (FCI). CUI is rare and usually limited to sensitive facility, security system, or critical infrastructure documentation.
Logistics, warehousing & distribution contractors
Third party logistics, warehousing, distribution, and supply contractors moving and storing goods for the government sit at CMMC Level 1 for the common case. Contracts, manifests, inventory and shipment records, and delivery paperwork are Federal Contract Information (FCI). CUI is rare and usually tied to sensitive shipment details, routing for controlled items, or marked technical data for what is being stored.
Electronics & circuit card manufacturers
Contract electronics manufacturers building circuit card assemblies, cable harnesses, and electronic components for defense primes start at CMMC Level 1 for build to print work. POs, assembly drawings, bills of material, and test records are Federal Contract Information (FCI). You move to Level 2 when a prime flows down DFARS 252.204-7012 and sends marked Controlled Unclassified Information or Controlled Technical Information.
Management & professional services consultants
Small management, program support, and professional services firms that consult for federal agencies usually start at CMMC Level 1. Contract documents, deliverables, schedules, and program correspondence are Federal Contract Information (FCI). You move to Level 2 only when you store, process, or transmit marked Controlled Unclassified Information (CUI) for the client.
Staffing & workforce services firms
Staffing and staff augmentation firms placing workers on federal contracts start at CMMC Level 1 for their own environment. Contracts, candidate and placement records, timesheets, and invoices are Federal Contract Information (FCI). Where placed staff handle a client's CUI, that obligation sits in the client's scope, while the staffing firm's own systems usually remain Level 1.
Janitorial & custodial services contractors
Janitorial and custodial contractors cleaning federal buildings and military installations sit at CMMC Level 1. The award documents, schedules, base access rosters, and invoices are Federal Contract Information (FCI). The 15 requirements apply to the office laptop and email used to run the contract, not to the cleaning work itself, and CUI is essentially never involved.
Engineering services firms
Engineering services firms providing studies, design, analysis, and technical support to federal agencies often start at CMMC Level 1. Contract documents, deliverables, schedules, and correspondence are Federal Contract Information (FCI). Because engineering deliverables and reference data are frequently marked Controlled Unclassified Information, scoping is critical: marked CUI moves that work to Level 2.
Medical & pharmaceutical supply distributors
Distributors supplying medical equipment, devices, and pharmaceuticals to the VA and military health systems sit at CMMC Level 1 for the common case. Contracts, orders, delivery records, and invoices are Federal Contract Information (FCI). Patient health information carries separate privacy obligations, and CUI under DFARS 252.204-7012 is uncommon for straight supply work.
Defense electronics & instrument makers
Small firms building sensors, instruments, communications gear, and electronic subsystems for defense programs handle Federal Contract Information (FCI) in their POs, specifications, and test data. Because defense electronics design and test data is frequently marked, scoping is critical: marked Controlled Unclassified Information (CUI) or Controlled Technical Information moves that work to Level 2.
Shipbuilding & marine repair contractors
Small shipyards, boat builders, and marine repair and component suppliers serving the Navy and its shipyards handle Federal Contract Information (FCI) in their work orders, drawings, and waterfront paperwork. Build to print and repair work is Level 1. Marked technical data under a DFARS 252.204-7012 flow-down, common on combat systems and sensitive vessels, moves that work to Level 2.
Industrial machinery & equipment suppliers
Manufacturers and overhaul shops supplying machinery, generators, material handling equipment, and ground support equipment to the military sit at CMMC Level 1 for build to print and repair work. POs, drawings, manuals, and delivery records are Federal Contract Information (FCI). Marked technical data under a DFARS 252.204-7012 flow-down moves specific programs to Level 2.
Plastics & rubber products manufacturers
Injection molders, rubber fabricators, and seal and gasket makers supplying the defense supply chain sit at CMMC Level 1 for build to print work. POs, drawings, material certs, and delivery records are Federal Contract Information (FCI). CUI is uncommon and arrives only with a marked technical data package under a DFARS 252.204-7012 flow-down.
Textiles, apparel & uniform manufacturers
Cut and sew shops, uniform makers, and textile manufacturers supplying DLA Troop Support and the military sit cleanly at CMMC Level 1. Contracts, specifications, schedules, and delivery records are Federal Contract Information (FCI). CUI is essentially never involved in standard uniform and field gear production.
PPE & safety equipment suppliers
Manufacturers and suppliers of protective and safety equipment for federal and military buyers sit at CMMC Level 1. Contracts, specifications, orders, and delivery records are Federal Contract Information (FCI). CUI is essentially never involved in standard protective and safety gear supply.
Medical device & instrument manufacturers
Manufacturers of medical instruments, devices, and surgical appliances supplying the VA and military health systems sit at CMMC Level 1 for the common case. Contracts, specifications, drawings, and delivery records are Federal Contract Information (FCI). Patient health information carries separate privacy obligations, and CUI under a DFARS 252.204-7012 flow-down is uncommon for device supply.
Specialty trade subcontractors (electrical, plumbing)
Electrical, plumbing, drywall, roofing, and other specialty trade subcontractors on federal construction sit at CMMC Level 1. Submittals, RFIs, schedules, and base access paperwork are Federal Contract Information (FCI). CUI is rare and limited to sensitive facility, security system, or critical infrastructure work.
HVAC & mechanical contractors
HVAC and mechanical contractors installing and servicing systems on federal facilities sit at CMMC Level 1. Work orders, submittals, schedules, and base access paperwork are Federal Contract Information (FCI). CUI is rare and tied to sensitive facility systems and controls.
Landscaping & grounds maintenance contractors
Landscaping and grounds maintenance contractors working on federal sites and military installations sit at CMMC Level 1. The award documents, schedules, base access rosters, and invoices are Federal Contract Information (FCI). The 15 requirements apply to the office systems used to run the contract, and CUI is essentially never involved.
Environmental & remediation services contractors
Environmental, remediation, and abatement contractors working on federal sites sit at CMMC Level 1 for the common case. Contracts, work plans, schedules, and base access paperwork are Federal Contract Information (FCI). CUI is uncommon and tied to sensitive site, security, or critical infrastructure information.
Telecommunications & networking contractors
Telecommunications, cabling, and networking contractors serving federal sites usually start at CMMC Level 1. Contracts, network diagrams, schedules, and base access paperwork are Federal Contract Information (FCI). You move to Level 2 when you store, process, or administer systems that hold marked Controlled Unclassified Information (CUI).
Cybersecurity & IT security services firms
Small cybersecurity firms that assess, monitor, or support federal clients can be CMMC Level 1 for their own environment when their federal work is Federal Contract Information (FCI) only. Scoping is delicate: the moment you store, process, or administer a client's marked Controlled Unclassified Information (CUI) or security systems, that work is Level 2 and your environment falls into the client's assessment scope as an External Service Provider.
Architecture & design firms
Architecture and design firms producing drawings and design packages for federal facilities often start at CMMC Level 1. Contracts, schedules, and unmarked design deliverables are Federal Contract Information (FCI). Because facility design data is frequently marked, scoping matters: secure facility and security system drawings marked as Controlled Unclassified Information (CUI) move that work to Level 2.
Security & guard services contractors
Guard, patrol, and physical security services contractors on federal sites sit at CMMC Level 1 for the common case. Contracts, post orders, schedules, and access rosters are Federal Contract Information (FCI). CUI is uncommon and limited to sensitive security plans and details marked by the agency.
Training & education services providers
Training and education services firms delivering courseware and instruction to federal agencies usually start at CMMC Level 1. Contracts, courseware, schedules, and rosters are Federal Contract Information (FCI). You move to Level 2 only when you store, process, or transmit marked Controlled Unclassified Information (CUI) in your training content or systems.
Marketing, media & creative services firms
Marketing, communications, and creative services firms serving federal agencies usually sit at CMMC Level 1. Contracts, creative deliverables, schedules, and correspondence are Federal Contract Information (FCI). CUI is uncommon and limited to engagements where the agency provides marked sensitive material.
Trucking & transportation contractors
Trucking, freight, and transportation contractors moving goods for the government sit at CMMC Level 1 for the common case. Contracts, manifests, routing, and delivery records are Federal Contract Information (FCI). CUI is rare and tied to sensitive shipment, routing, or security details the agency marks.
Wholesale & product distribution contractors
Wholesalers and product distributors supplying the government under federal supply schedules sit at CMMC Level 1 for the common case. Contracts, orders, catalog and pricing data, and delivery records are Federal Contract Information (FCI). CUI is rare and tied to marked technical data for specific defense items.
Food services & catering contractors
Dining, catering, and food service contractors on federal sites and military installations sit at CMMC Level 1. Contracts, schedules, headcounts, and base access rosters are Federal Contract Information (FCI). The 15 requirements apply to the office systems used to run the contract, and CUI is essentially never involved.
Vehicle & equipment maintenance contractors
Fleet and equipment maintenance contractors servicing federal vehicles and equipment sit at CMMC Level 1. Contracts, work orders, schedules, and base access paperwork are Federal Contract Information (FCI). CUI is uncommon and tied to marked technical data for specific defense vehicles or systems.
Printing & reprographics contractors
Commercial printers and reprographics firms producing documents and materials for federal agencies sit at CMMC Level 1 for the common case. Contracts, files to print, schedules, and delivery records are Federal Contract Information (FCI). CUI is uncommon and arrives only when the agency sends marked content to print.
Research, development & testing labs
Small R&D firms and testing laboratories on federal research contracts often start at CMMC Level 1. Contracts, progress reports, and unmarked research data are Federal Contract Information (FCI). Because research can drift into marked or export controlled data, scoping matters: marked Controlled Unclassified Information (CUI) moves that work to Level 2.
Office & operating supplies distributors
Distributors of office, janitorial, and operating supplies (MRO) to federal agencies sit at CMMC Level 1. Contracts, orders, catalog and pricing data, and delivery records are Federal Contract Information (FCI). CUI is essentially never involved in commodity supply.
If you receive Federal Contract Information (FCI), POs, drawings, schedules, award docs, RFIs, pay applications, from a DoD prime or directly from the government, and you have never received explicitly marked CUI under DFARS 252.204-7012, you sit at CMMC Level 1. Run the decision tree if you want a 60-second confirmation.