Which CMMC level do I need as a services sub who only gets emails and spreadsheets from the prime?

Your company might only need CMMC Level 1 if you only handle Federal Contract Information (FCI), even if the prime contractor is at Level 2, but the government ultimately determines the required CMMC level for the contract. The prime contractor receives the CMMC requirement from the government, and then flows that requirement down to its subcontractors. You should communicate with your prime contractor to understand the specific CMMC requirements for your subcontracted work.

CMMC Level 1 covers the 15 requirements of FAR 52.204-21 for basic safeguarding of covered contractor information systems. This level is typically for companies that only handle FCI. CMMC Level 2 involves the 110 requirements of NIST SP 800-171 Revision 2, which is required for handling Controlled Unclassified Information (CUI). To verify if the data you handle is only FCI and not CUI, you should consult with your prime contractor. They are responsible for identifying and marking CUI. Your prime contractor should be able to clarify the data types you are handling and the corresponding CMMC level required for your specific scope of work.

Your prime contractor is responsible for informing you of the CMMC level required for your subcontract, but the government's contracting officer makes the final determination for the prime contract. Helen is right that the prime contractor flows down the requirement. The prime contract will state the required CMMC level, and that level is determined by the type of information handled on the contract. You need to ask your prime to show you the relevant clauses in their prime contract that specify the CMMC level and any CUI handling requirements. If your work truly only involves FCI, then CMMC Level 1, which covers the 15 requirements of FAR 52.204-21, would be sufficient. If you handle CUI, then Level 2 is required, which means implementing NIST SP 800-171 Revision 2. The prime is responsible for properly marking CUI, so they are the ones who can tell you if the data you receive is CUI.

A subcontractor can be at CMMC Level 1 even if the prime is Level 2, but the prime is responsible for accurately assessing the data being flowed down. Marcus is right that the prime needs to provide you with the prime contract's CMMC requirements. The prime contractor is responsible for identifying CUI and ensuring it is marked as such before it is shared. If the prime determines that the student names, contact info, and attendance records you manage do not meet the definition of CUI, then CMMC Level 1 would be appropriate for your specific subcontract. Your prime should have a process to flow down the correct CMMC level based on the information you will process, store, or transmit.