NAICS Code Does Not Decide Your CMMC Level, the Data Does
There is a common misconception that a specific NAICS code automatically maps to a specific CMMC level. It does not. Your CMMC level depends entirely on what kind of information flows through your specific contract: Federal Contract Information (FCI) only means Level 1, and any Controlled Unclassified Information (CUI) means Level 2. That said, certain NAICS families correlate strongly with CUI exposure because of what the work itself typically involves.
| NAICS Code | Typical Work | Common CMMC Exposure |
|---|---|---|
| 336411, 336412, 336413 | Aircraft, aircraft engine, and aircraft parts manufacturing | Often Level 2: technical data packages and drawings are frequently CUI |
| 541330 | Engineering services | Often Level 2 when working from government-furnished technical data |
| 541712 | R&D in physical, engineering, and life sciences | Often Level 2, especially on test data and research findings tied to a program |
| 332999 | Miscellaneous fabricated metal product manufacturing | Varies: Level 1 if working from public specs, Level 2 if handling export-controlled or program-specific drawings |
| 541511, 541512, 541519 | Custom computer programming and systems design | Varies widely, depending entirely on whether the system processes CUI |
| 561210, 561990 | General facilities and administrative support services | Often Level 1, typically FCI only with no CUI access |
The Three Questions That Actually Determine Your Level
- Does your contract include DFARS clause 252.204-7012?
- Does your prime or contracting officer provide you with CUI markings, a DD Form 254, or specific handling instructions?
- Do you create, receive, store, or transmit technical data, drawings, or program information beyond basic administrative or contract-status information?
If the answer to any of these is yes, you are very likely Level 2, regardless of what your NAICS code says. If the answer to all three is no, Level 1 is the more likely fit.
Why This Matters for Small Subs Specifically
Primes in manufacturing and engineering NAICS families are increasingly flowing down CMMC requirements before the DoD's own enforcement fully catches up, because their own compliance depends on their supply chain's compliance. If your NAICS code sits in a CUI-heavy category, expect that flow-down sooner rather than later, and build your self-assessment before it becomes a bid disqualifier.