CMMC Level 1, done in about 21 days.
For small defense subcontractors who handle Federal Contract Information. We write your policies, build your evidence binder and walk you through the SPRS affirmation, so what you post holds up if anyone checks.
The affirmation is signed by someone at your company.
Level 1 is a yearly self-assessment. A senior official at your company affirms the result in SPRS, and the evidence has to back it up for six years. Most small shops already do most of the 15 requirements. The gap is usually the paperwork.
What LOGZONE paid to settle False Claims Act allegations. It had posted a perfect self-score of 110; a 2024 DIBCAC review found -170. No admission of liability.
How long a Level 1 self-assessment lasts. It expires one year after it's done, with no reminder.
Items Level 1 lets you leave for later. All 15 must be met. There's no plan-of-action allowance at Level 1.
Three steps. About 21 days.
Your IT person, if you have one, stays. We handle the written side: the policies, the proof and the affirmation.
Fit check
A free 20-minute call. We confirm whether Level 1 applies to your work and where you stand on the 15 requirements.
Build
We write your policies and assemble an evidence binder for every requirement: screenshots, logs and records, organized the way a reviewer would ask for them.
Affirm
We walk your senior official through the SPRS affirmation and give you a PDF of the record, so you can show your prime your status.
Fixed prices, agreed up front.
The readiness check is credited in full toward setup.
Readiness check
Where you stand on all 15 requirements and exactly what's missing.
- Credited toward setup
- Written gap list
Level 1 setup
- Written policies
- Evidence binder
- Guided SPRS affirmation
- About 21 days
Yearly renewal
The annual re-assessment, binder update and affirmation, before your current one expires.
The Level 1 checklist
The 15 safeguarding requirements from FAR 52.204-21, in plain English, with what you'd show as proof. Check each one you could prove today.
| # | Requirement | What you'd show |
|---|---|---|
| 1 | Only authorized people and devices get onto company systems | A current list of users and company devices |
| 2 | People can only do what their role needs | Who has admin rights, and why |
| 3 | Control connections to outside systems | A short rule on personal devices and outside accounts |
| 4 | Nothing from contracts gets posted publicly | Who approves website and social posts |
| 5 | Every user and device is identified | No shared logins; one account per person |
| 6 | Verify identity before access | Password or sign-in settings |
| 7 | Wipe or destroy media before disposal or reuse | Disposal log or shredding receipts |
| 8 | Limit physical access to equipment and work areas | Locked areas and who has keys |
| 9 | Escort visitors, log visits, manage keys and badges | Visitor log and key list |
| 10 | Protect the network edge | Firewall or router settings |
| 11 | Keep public-facing systems separate from internal ones | Guest Wi-Fi or website hosted apart from office systems |
| 12 | Find and fix security flaws promptly | Update and patch history |
| 13 | Antivirus protection is in place | Antivirus on every device |
| 14 | Antivirus stays updated | Auto-update turned on |
| 15 | Scan regularly, including downloads and attachments | Scan settings or a recent scan report |
Source: FAR 52.204-21(b)(1). General guidance, not legal advice.
Common questions
Does Level 1 apply to my company?
Level 1 applies when you handle Federal Contract Information on a DoD contract or subcontract. We confirm this on the fit check by looking at your work and your contract language.
What if we receive CUI, like controlled drawings or specs?
Then you likely need Level 2, which is a larger project. We'll tell you on the fit check and refer you to a qualified Level 2 partner.
Do you replace our IT person or provider?
No. Your IT stays responsible for the technical side. We handle the written side: policies, evidence and the affirmation, and we coordinate with your IT where needed.
Is this a certification?
Level 1 is a self-assessment that your company affirms in SPRS. We prepare you and your evidence so the affirmation is accurate and supported. We don't issue certifications, and no one can guarantee a contract award.
Our prime asked for our "SPRS score." What do we send?
Level 1 has no score, only met or not met. The usual proof for a prime is a PDF or screenshot of your affirmed Level 1 record, which we help you produce.
Find out where you stand in 20 minutes.
Free, no obligation. If you're already covered, we'll tell you.