Overview
If you build, repair, clean, mow, fuel, repaint, or otherwise maintain a DoD installation, your contracts almost always sit at CMMC Level 1. The award documents, set-aside paperwork, base-access requests, schedules, RFIs, submittals, and pay applications are all Federal Contract Information (FCI), and that triggers FAR 52.204-21 and a Level 1 self-assessment.
CUI only enters this world in narrow cases: secure-facility design drawings (SCIFs, weapons storage, command centers), critical-infrastructure protection plans, certain ICS / SCADA documentation, and anti-terrorism / force-protection details. Most concrete pours, roofing replacements, grass cuts, and HVAC tune-ups never see CUI.
USACE, NAVFAC, and AFCEC contracting officers have started flowing the CMMC Level 1 self-assessment requirement into solicitations under the 48 CFR CMMC acquisition rule. Subs that show up to a kickoff without a posted SPRS affirmation are increasingly being told to fix it before they can mobilize.
Typical contracts you'll see
- USACE MATOC / IDIQ task orders for construction, repair, and renovation
- NAVFAC Atlantic / Pacific O&M and minor-construction contracts
- AFCEC base operations support and facility-sustainment contracts
- GSA PBS Region task orders on federal buildings co-located with DoD tenants
- Subcontracts under a large facility-services prime (Fluor, KBR, Vectrus, V2X, J&J Worldwide)
- 8(a), HUBZone, WOSB, SDVOSB set-asides for small-dollar construction and trades
What FCI actually looks like for you
Anything below is Federal Contract Information and triggers FAR 52.204-21. None of it is CUI on its own.
When a construction & facilities business is Level 2, not Level 1
Most construction & facilities contractors handle only Federal Contract Information, so Level 1 is the right target. But the level follows the data, not the industry. If a contract hands you Controlled Unclassified Information, marked CUI, controlled technical drawings, export controlled specs, or a contract citing DFARS 252.204-7012, you are at CMMC Level 2, the 110 requirements of NIST SP 800-171.
Not sure which one your contracts put you at? The free 2 minute check reads your situation and tells you your level. Custodia builds both: the Level 1 Accelerator for FCI, and the Level 2 Accelerator for CUI, so you start at the level your contracts actually demand.
Common pitfalls in this industry
- Sending RFIs and submittals from a personal Gmail or a shared crew@ inbox, fails FAR 52.204-21 (b)(1)(i)-(iii).
- Using a single shared laptop in the job trailer with no per-user login, fails (b)(1)(i) and (b)(1)(viii) physical access controls.
- Storing pay applications and base-access rosters in an unlocked file cabinet in the trailer, fails (b)(1)(viii).
- Letting subs and 1099 trades log into the company tenant with the owner's credentials, fails (b)(1)(i)-(ii).
- Assuming that because the work is "just dirt and concrete" CMMC doesn't apply, it does, the moment FCI flows.
- Mistaking a secure-facility project as Level 1, if the drawings are marked CUI, the project is Level 2 and the trailer needs a real boundary.
Your Level 1 action plan
- 01Inventory the contracts: which prime, which contracting agency, any -7012 flow-down, any marked CUI? Most won't have any.
- 02Move project email off personal accounts onto a Microsoft 365 or Google Workspace tenant with MFA enforced, including for the PM, the estimator, and the office manager.
- 03Lock down the trailer laptop: per-user login, screen lock after 15 minutes, antivirus on, drive encrypted.
- 04Pick one cloud folder (SharePoint, OneDrive, Google Drive) for submittals / RFIs / schedules and restrict access to the project team.
- 05Lock the file cabinet that holds pay applications and base-access paperwork; keep a log of who has the key.
- 06Write a one-page boundary description: which laptops, which tenant, which trailer, which file cabinet. This is your scoping artifact.
- 07Run the 15-practice self-assessment, then have the company's senior official post the SPRS score and affirm, and re-affirm annually.
Most common NAICS codes
Use these when searching SAM.gov, filing for set-asides, or checking size standards.
- 236220Commercial & Institutional Building Construction
- 237110Water & Sewer Line & Related Structures Construction
- 237310Highway, Street & Bridge Construction
- 238210Electrical Contractors & Other Wiring Installation
- 238220Plumbing, Heating & Air-Conditioning Contractors
- 561210Facilities Support Services
- 561720Janitorial Services
- 561730Landscaping Services
Frequently asked questions
Q.I just mow grass on an Air Force base. Do I really need CMMC?
If your contract is with the federal government (directly or as a sub to a prime that holds a federal contract), then yes, the award documents, your invoices, and your base-access roster are Federal Contract Information, and FAR 52.204-21 applies. That means a CMMC Level 1 self-assessment and an annual SPRS affirmation. The 15 practices are basic IT hygiene; they apply to the laptop and email you use to send invoices, not to the lawn mower.
Q.Our project is on a SCIF / weapons storage / sensitive facility. Are we still Level 1?
Probably not. If the design drawings, anti-terrorism / force-protection plans, or facility security details are marked CUI under DFARS 252.204-7012, that contract is Level 2 and needs a real CUI boundary, usually a separate folder structure with restricted access and often a GCC High or equivalent tenant. The rest of your portfolio (non-sensitive projects) can stay at Level 1.
Q.We're a sub on a USACE MATOC. Does the prime's CMMC level cover us?
No. CMMC flows down. If you receive FCI from the prime, RFIs, submittals, schedules, daily reports, you have your own FAR 52.204-21 obligation and need your own SPRS affirmation. The prime cannot affirm on your behalf. For Level 2 contracts the same flow-down applies via DFARS 252.204-7012.
Q.Can I keep using personal Gmail for project email if I'm only Level 1?
No. FAR 52.204-21 (b)(1)(i) and (iii) require you to identify users and limit access to authorized users and the information they need. Personal Gmail accounts shared across a crew fail both. The fix is cheap: a paid Google Workspace or Microsoft 365 tenant with MFA on every account, around $6 to $15 per user per month.
Q.What does the trailer / job-site physical security requirement actually mean?
FAR 52.204-21 (b)(1)(viii) requires you to limit physical access to systems and information. In practice for a job trailer: lock the trailer when nobody's in it, lock the file cabinet that holds pay apps and rosters, don't leave the laptop logged in and unattended, and keep a simple visitor log if subs are coming through. That's the standard.
Related clauses
Related terms
Read more in the Library
- CMMC Level 1: All 15 FAR Safeguarding Requirements Explained in Plain English (2026 Guide)Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on, what each control means, what evidence satisfies it, and where teams trip up.
- CMMC Level 1: The Complete 2026 Guide for Small DoD ContractorsThe single page to read first. What CMMC Level 1 is, who it applies to, what's actually required, what it costs, and the fastest honest path through it in 2026.
- How to Do CMMC Level 1 Yourself (Free, Complete Guide), 2026CMMC Level 1 is self-assessed. You don't need a consultant. Here is the entire DIY path, with every template you'll need, written for the small defense contractors actually doing the work.
- CMMC Level 1 Scoping, How to Draw the Boundary (Free Worksheet), 2026Treating the whole company as in-scope doubles your work for no compliance benefit. Here's the right way to scope CMMC Level 1.
- What to Tell Your Prime When They Ask for Your SPRS Score (And You're Level 1)If your prime is asking for a 0 to 110 SPRS score and you're a Level 1 contractor, the answer is not zero. It's that you're a different tier of the regulation. Here's how to say that without losing the contract.
- CMMC Level 1 vs Level 2: Which One Do You Actually Need? (2026 Plain-English Guide)Most small defense contractors are Level 1, not Level 2, but the wrong answer here costs you a year and tens of thousands of dollars. Here's the single question that decides it.