Does CMMC Apply to My Company?

Start with your contracts, not your industry. Whether these requirements reach you is determined by specific DFARS clauses in your awards and subcontracts, and you can check it this afternoon.

If your contracts contain 252.204-7012, you handle Covered Defense Information and you already owe NIST SP 800-171 Revision 2 safeguarding. If they contain 7019 and 7020, you owe a self-assessment and a posted SPRS score. If they contain 7021, CMMC requirements were contemplated — though the September 2026 class deviation directs contracting officers to strip those out for now.

Two things trip people up. Subcontractors are frequently in scope through flow-down even when they never contract with DoD directly. And handling only Federal Contract Information rather than CUI does not put you outside the regime — it places you at a different level of it.

The four clauses that decide

Read them in this order. Each answers a different question, and the answers compound.

• FAR 52.204-21 — basic safeguarding of covered contractor information systems. Its presence means you hold Federal Contract Information and owe the 17 Level 1 practices.
• DFARS 252.204-7012 — safeguarding covered defense information and cyber incident reporting. Its presence means CUI, NIST SP 800-171 Revision 2, and 72-hour incident reporting.
• DFARS 252.204-7019 — notice of NIST SP 800-171 DoD assessment requirements. You must have a current self-assessment on record to be eligible for award.
• DFARS 252.204-7020 — NIST SP 800-171 DoD assessment requirements. You must post your score to SPRS and give the government access to assess if it chooses.
• DFARS 252.204-7021 — the CMMC clause. Currently being removed from solicitations and contracts under Class Deviation 2026-O0025 Revision 3.

Note what survives that list. Four of the five are untouched by the suspension. See program status for exactly what changed.

FCI or CUI — and why it sets your level

The clause tells you that something applies. What decides how much applies is which category of information you actually hold.

Federal Contract Information is information not intended for public release, provided by or generated for the government under a contract. Almost every federal contractor holds it. It maps to Level 1: 17 practices, annual self-assessment, no System Security Plan required.

Controlled Unclassified Information must map to a category in the National Archives CUI Registry, and in defense work it usually arrives as Controlled Technical Information — a drawing, a specification, a technical data package. It maps to Level 2: 110 requirements, assessed against 320 objectives, with a score posted to SPRS.

The difference is large enough to be worth an afternoon of certainty. We work through the test in detail on FCI vs CUI.

Flow-down: in scope without a DoD contract

This is the most common way companies discover they are in scope, and usually the least welcome. A prime holding 252.204-7012 is obliged to flow the requirement down to subcontractors who will handle covered defense information. You may never have seen a DoD contract; you signed a subcontract, and the clause came with it.

The obligation does not dilute as it descends. A tier-three supplier machining to the same drawing owes the same safeguarding as the prime that sent it. What changes is leverage, and the practical question of who absorbs the cost. See flow-down requirements.

Genuine exemptions

There are fewer than people hope, and two that matter.

Commercially available off-the-shelf items. Acquisitions solely for COTS items are generally excluded. The test is what is being acquired, not who is selling it — a company can sell COTS on one contract and custom machined parts on another, and be exempt on the first and fully in scope on the second.

No controlled information at all. If nothing you hold is FCI or CUI, neither level applies. This is real but rarer than assumed: a purchase order with delivery terms is usually FCI, which puts you at Level 1 rather than outside the regime.

What is not an exemption: being small, being a sub-tier supplier, working only from customer-supplied drawings, or never having been asked before.

If you are in scope, what happens next

In order, and the order matters:

1. Establish which category you hold — FCI, CUI, or both. This sets everything downstream.
2. Find where it lives. Scope is the largest cost driver in the whole exercise. See finding CUI in your environment.
3. Score yourself honestly against the requirements that apply. The calculator will give you a working figure in about ten minutes.
4. Write the System Security Plan if you are at Level 2. Requirement 3.12.4 is unscored, and its absence voids the assessment entirely.
5. Post and maintain the score. A score that was accurate when posted and is no longer accurate is the specific shape of False Claims Act risk.

If you would rather not do step two cold, that is where a readiness assessment starts.

Two sectors reach the wrong answer more often than the rest. Architecture, engineering and construction firms hold installation drawings and site security plans that are CUI by category without ever touching a weapons system — see CMMC for AEC firms.

If the answer is FAR 52.204-21 only, your next step is the CMMC Level 1 requirements. If DFARS 252.204-7012 appears, work through the CMMC readiness checklist.