CMMC Level 1, in plain English
Everything here is written for the person who has to deal with CMMC but did not sign up for a career in cybersecurity. No acronyms left unexplained.
Start here
If CMMC just landed on your desk, read these first.
- CMMC Phase 2 Is Suspended. Here's What Still Applies to Level 1.The pause is real. For Level 1 contractors, nothing changed.
- Your Prime Sent You a Cybersecurity Questionnaire. Now What?A prime just emailed you a spreadsheet. How to answer it.
- Plain English CMMC Level 1 GuideThe whole framework in ordinary language, start to finish.
- CMMC Level 1 for Small Businesses: Where to Actually StartA prime sent you a notice. Here is the first thing to do.
- CMMC Level 1 vs. Level 2: Which One Do You Need?Most small contractors need Level 1. Here is how to be sure.
- FCI vs. CUI: The One Distinction That Decides Your CMMC LevelOne distinction decides your level. How to tell them apart.
- CMMC Glossary: 30 Terms Translated for Non-Technical Business OwnersC3PAO, SPRS, POA&M, FCI — thirty terms, translated.
What Level 1 actually requires
The 15 requirements, grouped the way CMMC groups them.
- You Answered "No" to a CMMC Requirement. What Now?No partial credit at Level 1. What a gap really means.
- CMMC and Remote Workers: Home Offices, Laptops and Personal DevicesHome offices, company laptops, and the personal-phone problem.
- CMMC Access Control Explained: What Small Businesses Actually Need to DoWho can get into your systems, and what they can do there.
- CMMC Identification & Authentication: Password Requirements in Plain EnglishKnowing who is using your systems, and proving it.
- CMMC Media Protection: Handling Contract Information the Right WayOne requirement, and it is mostly about what you throw away.
- CMMC Physical Protection: Securing Your Office Without a Security GuardLocked doors and visitor sign-in count as cybersecurity here.
- CMMC System & Communications Protection: Network Security BasicsThe boundary between your network and everything else.
- CMMC System Integrity: Antivirus, Updates, and Malware ProtectionAntivirus, updates and scanning — four you probably already do.
Can I use the software I already have?
Specific tools, answered directly. The short version is usually yes.
- Does Microsoft 365 Meet CMMC Level 1? (And Do You Need GCC High?)Commercial M365 is fine. GCC High solves a problem you don’t have.
- Does Google Workspace Meet CMMC Level 1?Commercial Workspace is fine. One setup mistake is not.
- Is Dropbox CMMC Compliant? What Level 1 Contractors Need to KnowNo tool is "CMMC compliant". Here is the Dropbox-specific catch.
- Can You Use Box for CMMC? A Plain-English BreakdownYou almost certainly do not need the government edition.
- Can You Use Free or Open-Source Software and Still Pass CMMC Level 1?Yes — but there is a real catch hiding in the word free.
- CMMC Level 1 Doesn't Require Special Government SoftwareThere is no such thing as a CMMC-certified product.
- Antivirus and CMMC Level 1: What Counts as "Good Enough"?What is already built into your computers is usually enough.
- CMMC Password Requirements: What Level 1 Actually Asks ForAlmost none of the rules you have read apply at Level 1.
- Do You Need a Password Manager for CMMC Level 1?Not required. Still one of the easier upgrades to make.
- Data Destruction and CMMC: How to Retire Old Drives the Right WayRetiring an old laptop is a Level 1 requirement, not Level 2.
Filing it, and deciding whether you need help
Meeting the requirements is not the last step.
- How to Submit and Affirm Your CMMC Level 1 Self-Assessment in SPRSRecording your score in SPRS and getting it signed, start to finish.
- Who Can Be Your Affirming Official — and What They're SigningWho signs it, and what that signature actually commits you to.
- What Records Do You Need to Keep for CMMC Level 1?Six years of evidence. What counts, and where to keep it.
- What Does CMMC Level 1 Actually Cost?No licence fee, no assessor. Budget time, not money.
- Do You Need a Consultant for CMMC Level 1? An Honest AnswerProbably not — and the reason is structural, not a sales line.
- How to Choose a CMMC Consultant: A Small Business GuideIf you do want help, how to buy it without overpaying.
If you run a shop
Two industries with Level 1 wrinkles of their own.
- CMMC for Electronics and PCB Assembly ShopsGerber files and BOMs are where scoping gets interesting.
- CMMC for Machine Shops: What Level 1 Actually Means for Your ShopNot the coordinate measuring machine. What it means on your floor.
- CMMC Level 1 for Machine Shops: Tools, Software, and a Step-by-Step PathDrawings, tolerances and technical data are all contract information.
Stop reading about it and work through it
CMMCheck walks you through all 15 Level 1 requirements as plain questions about how your business already works. Free to start, no card.
Start free