You Answered "No" to a CMMC Requirement. What Now?

You worked through the 15 requirements and some of them came back “no.” That’s normal — most contractors find gaps on a first pass. What matters is what you do next, and Level 1 handles this differently from what people expect.

There’s no partial credit at Level 1

This is the part that surprises people. At Level 2 there’s a formal mechanism — a Plan of Action and Milestones — that lets you be assessed with some gaps outstanding, provided you have a credible plan to close them.

Level 1 has no such mechanism. The rule is explicit: no POA&Ms are permitted for CMMC Level 1 (32 CFR § 170.15(a)(1)). You need a MET result on all of the security requirements.

So a “no” doesn’t mean partially compliant or compliant-with-a-plan. It means not yet compliant, and the honest reflection of that in SPRS is a score that says so.

That sounds harsh. In practice it’s manageable, because Level 1 gaps are usually small.

The percentage on your dashboard is not a grade

If you’re using any tool that shows readiness as a percentage — ours included — be careful with it. 80% isn’t a near-pass. It’s a not-compliant with most of the work done.

The percentage is useful for seeing how much is left. It is not useful as a number to report, and it isn’t what goes to SPRS.

Most Level 1 gaps are configuration, not purchases

Before you budget for anything, look at what the gap actually is. The common ones:

Shared accounts. An office@ or shipping@ login several people use. Fix: individual accounts. Cost: possibly a per-seat licence, often nothing.

Former employees still enabled. Fix: disable the accounts, and write down a process so it happens at offboarding. Cost: nothing.

Anonymous file sharing links. “Anyone with the link” sharing turned on in OneDrive, Google Drive or Dropbox. Fix: restrict to your organisation. Cost: nothing.

Updates deferred. Fix: turn automatic updates on. Cost: nothing, plus the mild inconvenience of restarts.

No disposal process. Old computers in a cupboard, or given away without wiping. Fix: a written process and a wipe or destruction before anything leaves. Cost: nothing, or a few dollars for a drive-destruction service.

Visitors unmanaged. Fix: a sign-in sheet and an escort practice. Cost: a notebook.

Public-facing system on the same network. A guest Wi-Fi or public kiosk sharing the network with the machines handling FCI. Fix: separate the guest network, which most business routers do in a few clicks. Cost: usually nothing.

Work through your “no” answers against that list before you assume any of them require spending.

Triage in the right order

First, the ones that are free and immediate. Disabling dormant accounts and turning off anonymous sharing take minutes and close real gaps.

Second, the ones that need a decision but no money. Writing an offboarding process, adopting a visitor log, agreeing who may install software.

Third, the ones that cost something. Usually a small number, usually small amounts.

Most contractors find the first pass closes two thirds of the gaps in an afternoon.

Don’t submit until it’s true

The temptation when a contract is pending is to submit a compliant score and fix things afterwards. Don’t.

Your submission is backed by an affirmation from a senior person in your company, and that affirmation is a statement to the government. A score that overstates your position is a false statement, and the exposure attaches whether or not anyone comes to check. Who can be your affirming official covers that in more detail.

If a prime is applying pressure, tell them what’s outstanding and when it’ll be closed. That is a much better conversation than the one that follows a submission that turns out to be wrong.

Record what you fixed

When you close a gap, write down what it was, what you changed, and when. That record is part of the evidence you’re required to retain for six years — see what records you need to keep — and reconstructing it later is far harder than noting it at the time.

The bottom line

A “no” means not yet, and Level 1 gives you no partial-credit mechanism to lean on. The good news is that most Level 1 gaps are settings and practices rather than purchases, and a focused afternoon closes most of them.

Fix them, record what you did, then submit a score that’s true.