CMMC follows the information onto the job site
A general contractor renovating a hangar or a facilities firm maintaining a barracks may never think of itself as a defense contractor in the sense CMMC was written for. The rule makes no such distinction. It applies based on the information your firm handles, and construction and facilities work on DoD projects often comes with information that triggers it.
This guide explains why the rule reaches you, how to sort what you hold, and what a workable setup looks like for a firm with a trailer, tablets in the field and trades who need the drawings.
Where the rule draws its line
32 CFR 170.3 applies CMMC to DoD contract and subcontract awardees that will process, store or transmit FCI or CUI on contractor information systems. Paragraph (c) extends it to solicitations and contracts, including those for commercial items, except those exclusively for commercially available off-the-shelf items, above the micro-purchase threshold. The text names no industry and excludes none.
The off-the-shelf exception will not help a builder. The FAR defines a COTS item as an item of supply, including construction material, sold in substantial quantities and offered without modification. A contract for building or maintaining a facility is a purchase of work, so it is not solely for COTS items. The lumber yard selling standard materials is a different matter.
Whether a specific contract carries a CMMC level is decided by the program office or requiring activity. During the Phase 2 suspension, solicitations can call only for Level 1 (Self) or Level 2 (Self). DFARS 252.204-7012 and the FAR basic safeguarding clause still apply, and as of early November 2026, no restart date for Phase 2 has been announced.
What counts as FCI on a project
Federal contract information is information not intended for public release that is provided by or generated for the Government under a contract. On a project, that describes much of the paperwork: schedules, submittals, RFIs and responses, meeting minutes, daily reports, pay applications and correspondence with the contracting officer. Simple transactional information needed to process payments is excluded, and so is information the Government has released to the public.
The practical result is that almost any firm performing a DoD construction contract holds FCI somewhere, which puts the 15 basic safeguards in play.
When drawings and specifications are CUI
The DFARS definition of technical information lists "engineering drawings, and associated lists, specifications, standards." Controlled technical information is technical information with military or space application that is subject to controls on access or dissemination, and it meets the criteria for distribution statements B through F. That is why marked drawings of a defense facility can be CUI.
A second category matters on installations. The CUI Registry's DoD Critical Infrastructure Security Information category covers information that would reveal vulnerabilities in DoD critical infrastructure, including "other site-specific information on or relating to installation security." Security system layouts, access control plans and guard force details on a project deserve a hard look under that heading.
Read the markings on what you receive. The clause at DFARS 252.204-7012 tells a contractor to determine whether information required for subcontract performance retains its identity as covered defense information and, if necessary, to consult the contracting officer. If a set of drawings arrives without markings and you suspect it should have them, ask in writing. Keep the answer.
Deciding between Level 1 and Level 2
| What your firm handles | Minimum status | What that means |
|---|---|---|
| FCI only | Level 1 (Self) | 15 requirements, annual self-assessment and affirmation, no plan of action permitted |
| CUI | Level 2 (Self), unless the contract requires more | 110 requirements of NIST SP 800-171 Revision 2, scored in SPRS, annual affirmation |
| Neither on your systems | No CMMC status is needed for that subcontract | Possible when your firm receives only public documents and keeps no project data on its systems |
Program offices select the status for each contract, and the rule sets the minimum for subcontractors. Where a contract requires Level 2, DFARS 252.204-7021 applies that status to all information systems used in performance that process, store or transmit FCI or CUI. That makes a small, well-defined project environment worth designing from the first day of the job.
The site trailer is a facility
Physical requirements apply wherever CUI is. Requirements 3.10.1 through 3.10.5 cover limiting physical access, protecting and monitoring the facility, escorting visitors, keeping logs of physical access, and controlling keys and badges. A trailer on a fenced site has real advantages, and also a door that a dozen people pass through in a day.
Paper needs its own attention. Requirement 3.8.1 covers system media containing CUI, "both paper and digital." Marked plan sets belong in a locked drawer or a locked room when not in use. Requirement 3.8.5 calls for controlling access and maintaining accountability during transport outside controlled areas, and 3.8.3 requires sanitizing or destroying media before disposal. A shredder and a sign-out sheet will do much of this job.
Tablets and phones in the field
A tablet with CUI drawings on it is a mobile device under requirements 3.1.18 and 3.1.19, worth 5 and 3 points in the scoring method. It needs management and encryption, and the encryption must use FIPS-validated cryptography to protect CUI under 3.13.11. Field teams will photograph conditions, mark up sheets and share files, so plan for those habits.
Keep project CUI in a managed application on company-owned devices, and block saving it to consumer cloud accounts or personal photo libraries. A superintendent's personal phone is an external system. It should not hold CUI drawings.
Getting drawings to subcontractors
Your trades are the hard part. Under 32 CFR 170.23, a subcontractor that will process, store or transmit CUI needs Level 2 (Self) at minimum, and one handling only FCI needs Level 1 (Self). DFARS 252.204-7021 requires you, before awarding the subcontract, to ensure the subcontractor has a current status at the level appropriate for the information you are sending it, and to flow the clause down where FCI or CUI is involved.
The strongest move is to send less. Give the drywall subcontractor the sheets it needs, with CUI removed where the customer allows it. Where a trade must see CUI, give it access in your controlled system and stop emailing PDFs. Unmanaged email to a dozen small firms turns a contained problem into a sprawling one.
Every copy of a CUI drawing you send is a compliance obligation you have handed to someone else.
Every copy of a CUI drawing you send is a compliance obligation you have handed to someone else.
A practical setup for a general contractor
- A single controlled workspace for CUI project files, in a cloud service that is FedRAMP Moderate authorized or equivalent
- Named accounts with multifactor authentication for every person who opens that workspace, trades included
- Company-owned, managed tablets and laptops, with storage encrypted and personal cloud accounts blocked
- A written rule that CUI does not move by ordinary email, along with a marked channel for what must
- A locked drawer, sign-out sheet and shredder in each trailer that holds CUI on paper
- A flow-down step in the subcontract process that confirms status before award
- A closeout step that retrieves or destroys CUI on devices and paper when the job ends
If your project management platform will hold CUI, it is a cloud service under the rule, and DFARS 252.204-7012 requires that it meet security requirements equivalent to the FedRAMP Moderate baseline. Check before you upload the first sheet.
When the job ends
Closeout is where CUI tends to scatter. As-built drawings, submittal records and final schedules sit on laptops, in trailer drawers and with every trade that worked the job. Build CUI into your closeout list: retrieve or destroy paper sets, remove files from tablets and phones, close the accounts you opened for trades, and record that it was done.
Requirement 3.8.3 requires media with CUI to be sanitized or destroyed before disposal or reuse, and that includes the tablet you plan to use on the next job. Keep your evidence, because artifacts used for an assessment must be retained for six years from the CMMC Status Date.
Mistakes that recur on defense projects
- Assuming a trade contractor is exempt because the firm builds things and never touches software
- Uploading CUI drawings to a project platform nobody checked for FedRAMP status
- Leaving plan sets on the trailer table overnight
- Emailing the full set to every trade because that is how bid sets have always gone out
Frequently asked questions
It applies if your DoD contract involves FCI or CUI on your information systems and the contract calls for a CMMC level. Work orders, schedules and building information can all be FCI.
Marking is how you will usually know. If you believe information requires protection and the marking is missing or unclear, ask the contracting officer in writing and keep the response.
Often, for much of the job. Working sets with CUI removed and access to controlled sheets through a managed device can shrink the field's footprint, where the customer agrees to that approach.
Purchases solely of commercially available off-the-shelf items are excepted from the clause. If the supplier receives no FCI or CUI, no CMMC status is required for that order.