Do I Need a CMMC Assessment If My Organization Does Not Handle CUI?

No CUI = No Independent Assessment

If your organization only handles Federal Contract Information (FCI) and does not process, store, or transmit Controlled Unclassified Information, you are only required to complete a CMMC Level 1 self-assessment.

Level 1 Self-Assessment Requirements

Level 1 is the simplest tier of CMMC. You need to:

• Implement 15 basic safeguarding requirements from FAR 52.204-21
• Conduct an annual self-assessment
• Enter your results into SPRS
• Submit an annual affirmation of continued compliance

When This Gets Complicated

The challenge is accurately determining whether you handle CUI. Common scenarios where organizations unknowingly handle CUI:

• Technical data with export controls received from a prime contractor
• Engineering drawings with distribution restrictions
• Performance specifications marked as CUI
• Subcontractor data passed through from higher tiers

If you're genuinely FCI-only, Level 1 self-assessment is straightforward and can often be completed internally with minimal external support. However, if there's any doubt about whether you handle CUI, it's worth conducting a data flow analysis to be certain.