Most small shops meet CMMC through a letter, not a contract. A prime sends a notice referencing DFARS 252.204-7012, asks for your SPRS score, and mentions a certification level. Nothing about your own paperwork changed, so the first instinct is that this is somebody else's problem. It isn't.
Federal contract requirements flow down. When a prime holds a contract carrying the DFARS safeguarding clause, it is obligated to push equivalent requirements to subcontractors who handle the same information — and those subcontractors push them further down. There is no tier at which the requirement quietly expires. If covered defense information reaches your shop floor, it reaches your obligations.
The question that actually decides it
Not your size, and not your tier. What decides your CMMC level is the kind of information that lands in your systems:
- Federal Contract Information (FCI) only — information provided by or generated for the government under a contract, not intended for public release. Think a purchase order and a delivery schedule. This is Level 1 territory.
- Controlled Unclassified Information (CUI) — the marked drawing, the technical data package, the specification that carries distribution limits. This is Level 2 territory, and it is where third-party assessment enters the picture.
- Neither — you make commercial parts, nothing government-derived touches your systems, and CMMC does not apply to you at all.
Plenty of shops sit in the second category without knowing it, because the drawing arrived as an email attachment and nobody read the banner across the top of it.
"But we're too small"
Size is not an exemption, and the rule was written knowing that most of the defense industrial base is small. What size does change is scope. A twelve-person shop with one engineering workstation and a file share has a far smaller assessment boundary than a 400-person supplier — and a small, honestly drawn boundary is the single biggest lever on what readiness costs you.
If your prime has asked for a score, they are already reporting your readiness upward. The uncomfortable part of flow-down is that your customer often knows where you stand before you do.
What to do this week
Find out which of the three buckets you are in, and get a defensible score on paper. The free calculator below walks the same 110 requirements the DoD Assessment Methodology uses, with the official weights, and gives you the number your prime is asking for. If it comes back negative, that is normal — it is where most shops start.