Who needs CMMC Level 1?

Short Answer

An organization that handles Federal Contract Information but no Controlled Unclassified Information falls in the Level 1 world. The requirement attaches to a specific contract that includes the CMMC clause. Whether it applies to you is a determination you make based on your contracts and the information they involve.

The facts the decision turns on

Level 1 protects Federal Contract Information. If a contract gives you FCI or has you generate it, and no Controlled Unclassified Information is involved, that work sits at Level 1. If CUI is involved, the higher Level 2 requirements apply instead.

The COTS exception

A contract or subcontract solely for commercial off-the-shelf items is exempt from CMMC, and so is a micro-purchase below the threshold. The exemption is narrow. It does not cover a contract where you also receive or generate FCI.

How it is triggered

The requirement appears contract by contract, through the CMMC clauses in your solicitations, not through a single company-wide switch. This reference center covers Level 1. Deciding which level a given contract calls for is a determination you make.