Services / CMMC Level 1
If your contracts put Federal Contract Information in your hands, someone at your company has to affirm to the Government that all 15 requirements are met. We do the work that makes that affirmation defensible.
Level 1 covers Federal Contract Information — information the Government provides or that is generated for the Government under a contract, and that isn't intended for public release. A delivery schedule, a statement of work, an email carrying a requirement. Nearly every DoD contract at any tier produces it.
No third-party assessor, no certification body, and no such thing as a "Level 1 certified" company. It is a self-assessment your senior official affirms in SPRS. Anyone selling you a Level 1 certificate is selling you something that does not exist.
Each of the 59 objectives is scored MET, NOT MET, or NOT APPLICABLE. One NOT MET fails the entire requirement, and there is no POA&M pathway at Level 1. Nothing gets fixed later.
You don't do Level 1 on the way to Level 2. Which one applies is decided by the data your contract puts in your hands — FCI or CUI. Getting that determination wrong is the single most expensive mistake in this process.
Level 1 imposes no FedRAMP requirement. Microsoft 365 Commercial and Google Workspace are both appropriate for FCI-only environments. If someone has told you otherwise, get a second opinion before you sign the invoice.
Before we assess anything, we establish in writing whether your contracts involve FCI or CUI. We review your clause list, ask what your prime has actually sent you — drawings, specifications, technical data, anything marked or carrying a distribution statement — and have you confirm the required level with your contracting officer.
If the answer is CUI, this is a different engagement: 110 requirements under NIST SP 800-171, a third-party assessment, and DFARS 252.204-7012 obligations. We will tell you that plainly rather than sell you the smaller project.
We see companies who are clearly Level 2 buy Level 1 anyway because a contract is dangling in front of them. That is not a shortcut. It is an affirmation to the federal government that does not match reality.
Roughly six weeks, structured so you finish with artifacts you can maintain without us.
We confirm scope, contacts, and contract posture — then run the FCI/CUI determination and document the answer in writing before any assessment work begins.
Where FCI actually lives: email, shared drives, a quoting system, a folder on somebody's desktop. Who touches it, how many locations, whether there's an on-prem server or specialized equipment. We define the system boundary and write it down.
Users organized by function, policies assigned by group rather than by individual, and awareness training assigned with a per-person completion record — because that record is your evidence.
The bulk of the engagement. Every one of the 59 objectives gets a status and attached evidence, worked against the DoD Level 1 Assessment Guide as the authority. We keep a task log showing how each conclusion was reached.
Configuration work in your Microsoft 365 or Google Workspace tenant, plus the short written artifacts most small companies are missing: an external systems position, a defined patch cadence, a media disposal procedure, and a visitor log you will actually keep.
Your Affirming Official submits the status and signs the affirmation. We walk them through it live, confirm they have access, and make sure they understand exactly what they are signing — a representation to the Government, renewed annually, with records retained six years.
Every square is one of the 59 assessment objectives. Each has to be MET on the day your official affirms — a single NOT MET fails its entire requirement, and Level 1 has no POA&M pathway to fix it later.
That is why remediation sits inside the engagement, not in a report we leave behind.
L2CS is never the Affirming Official and never a signatory to your representation to the Government. That line does not move.
Level 1 looks trivial on paper. In practice the same six gaps turn up on nearly every engagement.
Personal phones on company email, home networks, a bookkeeper's laptop, unmanaged file-sharing accounts. Six objectives ride on this, and almost nobody has thought about it.
A consumer ISP router, no documented ruleset, no review cadence. Eight objectives — the largest single count on the list.
No visitor log, no key register. The cheapest fix on the list and almost always open.
Old laptops in a closet or handed off to employees, with no wipe record and no disposal procedure.
The Windows fleet is covered. The Macs, and the one odd machine in the corner, are not.
You patch — but nothing states the cadence as a number of days, so the objective cannot be evidenced.
Fixed-scope pricing, quoted after discovery. No hourly meters, no surprise change orders — if scope shifts materially, we tell you before we do the work, not after.
From $7,000one-time, per engagement
A complete Level 1 self-assessment engagement: determination, scoping, gap assessment against all 59 objectives, remediation to zero NOT MET, evidence package, and SPRS handoff to your Affirming Official.
Final price scales with headcount, number of locations, and whether the environment is cloud-only. Larger or multi-site engagements are quoted accordingly.
Book a Discovery CallFrom $2,400per year
The affirmation renews every year, and the evidence has to hold up across all twelve months in between. This keeps your posture current and gets you to each annual re-affirmation without a scramble.
Priced by environment size and support cadence. Available alongside an implementation or for organizations already affirmed.
Talk about ongoing supportA short discovery call establishes whether you're looking at Level 1, Level 2, or something in between — before anyone quotes you a number.
Book a Discovery Call