Who it applies to
Prime contractors and subcontractors whose information systems process, store or transmit FCI or CUI in performance of a DoD contract with the CMMC requirement (32 CFR 170.3).
Flowdown to subcontractors
Primes must flow the CMMC requirement down to subcontractors that handle FCI or CUI, at the level that matches the information they handle (DFARS 252.204-7021).
The COTS exemption
CMMC does not apply to contracts or subcontracts solely for commercially available off-the-shelf (COTS) items (32 CFR 170.3).
A simple decision path
- Only FCI? → Level 1.
- CUI? → Level 2.
- CUI on a highest-priority program designated by DoD? → Level 3.
Notes for small businesses
- Scope tightly: keep FCI and CUI in as few systems as you can.
- If you only handle FCI, start with Level 1.
- Use the free tools: Quick Score and the compliance checklist.
- Compare the CMMC levels.