Who Needs CMMC?

CMMC applies to any organization that processes, stores, or transmits Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) as part of a DoD contract. This includes prime contractors and subcontractors at every tier of the defense supply chain — regardless of company size, revenue, or the dollar value of the contract.

The three categories of affected contractors

• ✓Prime contractors with DoD contracts that include DFARS 252.204-7021
• ✓Subcontractors at any tier who receive FCI or CUI in performance of those prime contracts
• ✓Managed service providers and cloud service providers whose systems process or store CUI on behalf of a contractor

Who is NOT covered by CMMC

• ✓Sellers of COTS (commercial off-the-shelf) products — products sold in substantial quantities to the general public without customization for DoD
• ✓Contractors who exclusively hold commercial item contracts with no FCI or CUI in scope
• ✓Research grants (which have their own separate cybersecurity requirements)

How to tell if you have CUI

CUI is defined by the National Archives CUI Registry. In the defense context, the most common categories include: technical specifications, engineering drawings, contract performance data marked as sensitive, export-controlled technical data (EAR/ITAR), and certain personnel and financial data. If your DoD contract uses the word “CUI” or includes DFARS 252.204-7012, assume you have CUI until proven otherwise.