Who needs CMMC Level 1?

Short Answer

An organization that handles Federal Contract Information but no Controlled Unclassified Information falls in the Level 1 world. The requirement attaches to a specific contract, and DoD states the required level in the solicitation. Which of your systems handle FCI is the scoping decision you make.

The facts the decision turns on

Level 1 protects Federal Contract Information. If a contract gives you FCI or has you generate it, and no Controlled Unclassified Information is involved, that work sits at Level 1. If CUI is involved, the higher Level 2 requirements apply instead.

The COTS exception

Under 32 CFR 170.3(c) and DFARS 204.7504, CMMC requirements do not apply to a contract exclusively for commercial off-the-shelf items. The exception is narrow. A contract that also covers anything other than COTS items is not exempt on that basis.

32 CFR 170.3(c) also sets a value condition. It applies the CMMC Program to DoD solicitations and contracts valued at greater than the micro-purchase threshold, subject to the phase-in schedule and to waivers. The CMMC clauses in a given solicitation show whether it applies to that contract.

How it is triggered

The requirement appears contract by contract, not through a single company-wide switch. DoD selects the level for each contract (32 CFR 170.3(d)), and the contracting officer states it in the CMMC clauses, DFARS 252.204-7025 and 252.204-7021. On a subcontract, the prime flows the level down (32 CFR 170.23). This reference center covers Level 1. Which of your systems handle FCI is the scoping decision you make.