All companies in the defense industrial base will require certification; this includes both prime and subcontractors and all business sizes.

However, certification is not required if the company does not handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).