CMMC Level 1 Kit
CMMC Level 1 applies to defense contractors that handle Federal Contract Information (FCI) only, not CUI. At this level, you have to implement 15 requirements from FAR 52.204-21, prove 59 assessment objectives are MET, and affirm continuous compliance in SPRS every year. While it's the foundational level of CMMC, it is still difficult to understand how exactly to implement, prove, and maintain the required cybersecurity posture, especially for small contractors and manufacturers. This kit demystifies the process and offers free resources to help them establish this baseline and stay contract-eligible.
What’s in the compliance kit:
- An ebook covering the fundamentals of CMMC Level 1
- Level 1 compliance checklist and evidence collection spreadsheet
- A customizable public information policy template for FCI
CMMC Level 1 Self-Assessment Guide
This guide walks FCI-only contractors through the what, why, and how of Level 1: how to scope, what FCI looks like in your environment, how to implement and prove the 15 requirements and 59 objectives, and how to submit and affirm in SPRS.
What’s included:
- How to identify FCI and examples of Level 1 contractors
- An overview of what the 15 requirements and 59 objectives actually ask you to implement and prove
- Realistic cost and timeline estimate for Level 1 readiness plus the annual self-assessment
CMMC Level 1 Compliance Checklist
CMMC Level 1 self-assessment verifies that you have implemented 15 basic safeguarding requirements from FAR 52.204-21, using 59 assessment objectives derived from NIST SP 800-171A. This checklist explains what each requirement and objective is actually asking, plus what you have to prove and examples of evidence that would support a MET finding.
What’s included:
- All 15 Level 1 requirements and 59 assessment objectives, grouped into the six CMMC domains
- A plain-language statement of what you have to prove for each requirement, with examples of evidence that supports a MET finding
