QuotedPartAnswers · Updated 2026-10-30
CMMC Level 1 or Level 2: which does my shop need?
Price one of your own parts: Drop a STEP model or PDF drawing — about 90 seconds, no account.
Your part priced in about 90 seconds, no account.
If you handle only Federal Contract Information (FCI), you need CMMC Level 1: 15 requirements and an annual self-assessment. If you handle Controlled Unclassified Information (CUI), you need Level 2: the 110 requirements of NIST SP 800-171, assessed by a self-assessment or by a third party depending on the contract. The contract decides which one applies, and the prime has to tell you. If a print says CUI, you are in Level 2.
See how QuotedPart connects to your workflow with its API, MCP server, autonomous quoting and shop-specific learning.
The decision tree
Ask these in order. Question one: does your contract or subcontract involve work for the Department of Defense at any tier? If no, CMMC doesn't apply through that contract. Question two: do you receive or generate information that is provided by or generated for the government under a contract, that is not meant for public release? That is FCI, and it puts you at Level 1 at least. Question three: do any prints, models, specifications or emails carry a CUI marking, or does the contract (usually via DFARS 252.204-7012) say you will handle CUI? If yes, Level 2.
FCI is broad: a purchase order and a drawing for a government program usually count. CUI is narrower and is marked: a banner, a "Controlled by" line, and often an export-control category. Don't guess: ask the prime, in writing, what level the contract requires and which of the documents you'll receive are CUI.
| Level 1 | Level 2 | |
|---|---|---|
| Information protected | Federal Contract Information | Controlled Unclassified Information |
| Requirements | 15 basic practices | 110 requirements of NIST SP 800-171 |
| Assessment | Annual self-assessment, results in SPRS | Self-assessment or third-party (C3PAO) assessment per the contract; repeated every three years |
| Affirmation | Required annually | At each assessment and annually |
| Plan of action for gaps | Not permitted: every requirement must be met | Limited, with a 180-day closeout |
| Cloud services that touch the data | No special rule stated | FedRAMP Moderate or equivalent for providers that process, store or transmit CUI |
Examples from job-shop work
A shop turns fasteners for a distributor that resells to the military on a standard commercial print with no markings and no mention of defense: probably no CMMC requirement through that order, and the prime's flowdown clauses will say so if there is one. A shop machines brackets for a defense prime on a PO that cites DFARS 7012, and the prints are unmarked: at least FCI, and you should ask the prime whether the drawings are CUI. A shop machines housings for a weapons system from a CUI-marked drawing package: Level 2.
These are illustrations of how to read the contract, not rulings. Flowdown clauses in the PO control, and the prime is responsible for telling you what's marked.
What it costs and what to do first
Level 1 is within reach of most small shops: it covers basics such as access control, user identification, media sanitizing, physical protection and boundary protection, and you attest to it in SPRS. Level 2 is a real program: written policies, a system security plan, a plan for incidents, logging, multi-factor authentication, encryption and more, over a defined set of systems. Many small shops either build a small, separate enclave for CUI or decline CUI work.
Start with a scoping exercise: list where FCI and CUI enter, live and leave (email, shared drive, quoting tool, CAM, CNC machines on the network, subcontractors). Fewer places is cheaper. Check the dates in the contract and on the DoD CIO's CMMC page, because the dates when requirements appear in solicitations have been the part that moves; we haven't verified current phase-in dates, so don't rely on this page for them.
Sources and limits
Claims are dated where they can change. Product calculations are examples from the stated inputs, not a promise about a customer's quote. Competitor wording is attributed to the source shown.
- CMMC Level 1 (Self): FCI, 15 requirements, annual self-assessment and affirmation, no POA&Ms permitted, results in SPRS. — source (checked 2026-10-30)
- CMMC Level 2 (Self): CUI, all 110 NIST SP 800-171 requirements, repeated every three years, annual affirmation, conditional status with a POA&M closed in 180 days, cloud providers FedRAMP Moderate or equivalent. — source (checked 2026-10-30)
Questions
Who tells me which level I need?
Your customer, through the contract. A prime contractor must flow down the requirements; ask in writing.
Can I do Level 1 myself?
Level 1 is a self-assessment, but it has to be accurate and affirmed by a company official. Fix gaps before you attest.
Price one of your own parts
Drop a PDF drawing or a STEP file. QuotedPart reads the print, measures the model and prices it in seconds, on default shop rates you can change.
Your STEP file or PDF drawingDrop a PDF drawing, a STEP file or both
Free. No account, no email. Priced at our default US rates until you set yours.
Related QuotedPart guides
Answers
What does CUI on a drawing mean for my machine shop?
CUI (Controlled Unclassified Information) on a print means the government has marked the data for protection. What the marking looks like, what a shop must do with it, and what changes in how you quote.
Answers
What CMMC means for a small machine shop
A contract-first explanation of CMMC Level 1 and Level 2, scoping, systems and the first actions a small defense supplier can take.
Answers
A customer cancelled an order part-way through: what can I charge?
Charge for what you've spent and what you can't recover, stage by stage: material, programming and setup, machining done, finishing. A cancellation schedule on a 100-piece bracket order and the clause wording to put in your terms.
Answers
A customer compares your quote to Xometry's: how do you compete?
How to compare your price with a marketplace quote on the same basis, which jobs to stop chasing, and what a local shop can offer that an instant quote doesn't. With a priced 6061 bracket.