All companies in the defense industrial base will require certification if they handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). CMMC Level 1 is for companies that will handle FCI only.  CMMC Levels 2 to 5 is for companies that will handle both FCI and CUI.