Small does not mean exempt. It does change the arithmetic.

Which level applies

It follows the information, not the company. Federal Contract Information alone puts a contract at Level 1, which is the fifteen safeguards in Federal Acquisition Regulation 52.204-21. Controlled Unclassified Information puts it at Level 2, which is all 110 National Institute of Standards and Technology (NIST) SP 800-171 requirements. A small firm can hold both at once, and the determination is in the contract language rather than in anything about the business.

What the government models it at

For a small entity the rule models Level 1 self-assessment at $5,977 a year and Level 2 self-assessment at $34,277. A Level 2 certification assessment by an accredited third party is modelled at $101,752. None of those figures include remediation, and the rule is explicit that they are not market prices for assessor services.

Those numbers are the reason the schedule moved. When the Department of War suspended Phase 2 on 13 July 2026, the cost of third-party assessment for small and mid-sized suppliers, against a small pool of accredited assessors, was central to the case for reviewing it. The safeguarding obligations were not suspended and neither was self-assessment.

The lever

Enclave scoping. Most small suppliers have Controlled Unclassified Information spread across general file shares, personal drives and email, because nobody ever decided it should not be. Pulling that handling into a defined set of systems is almost always cheaper than securing and evidencing the whole environment, and it reduces assessment cost, remediation cost and ongoing evidence work at the same time. For a firm without a dedicated security team it is the difference between a programme that is affordable and one that is not.