Any prime or subcontractor handling FCI or CUI on non-federal systems must meet the CMMC level specified in the solicitation.

If handling FCI only, Level 1 is required. If receiving CUI, Level 2 is required at minimum.

Level 1 (Foundational): Protects FCI, requires 17 practices, annual self-assessment submitted to SPRS. Level 2 (Advanced): Protects CUI, requires all 110 NIST SP 800-171 practices, triennial assessment plus annual affirmation. Level 3 (Expert): Protects high-value CUI, adds selected NIST SP 800-172 requirements, triennial government-led assessment plus annual affirmation.