CMMC Level 1,
in plain English.

Half the small businesses asking about CMMC don't actually need it, and the other half need it more urgently than they realize. Four questions and you'll know where you stand.

FCI triggers CMMC Level 1. CUI triggers CMMC Level 2. Mix them up and you'll either over-spend by $20k or under-comply on a federal contract.

FCI is the routine non-public information you handle under a federal contract. It's what triggers CMMC Level 1, and it's almost certainly already in your inbox.

Most small defense contractors are Level 1, not Level 2, but the wrong answer here costs you a year and tens of thousands of dollars. Here's the single question that decides it.

DFARS 7012 says 'protect CUI to NIST 800-171.' CMMC says 'prove it.' One is the rule. The other is the audit. Here's how they fit together.

Congrats on the Phase I award. Now the question that ambushes most founders: do you need CMMC to start work, or only at Phase II? The honest answer depends on what kind of data the agency hands you on day one.

You're not an IT person. You won a contract. The prime is asking weird questions. Here's exactly what they need, in English, without the acronym soup.

The single page to read first. What CMMC Level 1 is, who it applies to, what's actually required, what it costs, and the fastest honest path through it in 2026.

Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on, what each control means, what evidence satisfies it, and where teams trip up.

Level 1 isn't graded on a curve. Every one of the 15 requirements has to be MET, or the whole assessment fails. Here's how the rule actually works, and why that's good news for small contractors.

CMMC and NIST 800-171 are not the same thing. The difference decides whether your weekend is 5 days of paperwork or a $50K assessment.

CMMC Level 1 is self-assessed. You don't need a consultant. Here is the entire DIY path, with every template you'll need, written for the small defense contractors actually doing the work.

What counts as evidence for CMMC Level 1? Here are practical examples for all 15 requirements, plus what not to rely on.

Most Level 1 contractors already live in Microsoft 365. Here is the practical checklist to turn M365 into defensible Level 1 evidence.

Remote work does not break CMMC Level 1. It changes the evidence you keep: managed devices, MFA, home-office rules, and a clear FCI boundary.

If you are a DoD sub handling FCI, Level 1 can flow down. Here is what the prime needs, what SPRS shows, and what not to overpromise.

Treating the whole company as in-scope doubles your work for no compliance benefit. Here's the right way to scope CMMC Level 1.

Eight one-page policies cover every CMMC Level 1 control. Here's the list, with free templates, no 40-page manual required.

Your SSP is the one document a prime will actually ask for. Here is the free template that gets you a defensible one in 60 minutes.

Every CMMC Level 1 requirement, in plain English, on a printable page. No email gate. No upsell. Just the checklist.

If your prime is asking for a 0 to 110 SPRS score and you're a Level 1 contractor, the answer is not zero. It's that you're a different tier of the regulation. Here's how to say that without losing the contract.

Posting your SPRS affirmation is the action that makes you bid-ready. Here's the exact 8-step walkthrough.

Year-one DIY CMMC is easy. Year two is where most contractors quietly lose compliance. Here's how to not be one of them.

32 CFR Part 170 is the rule that made CMMC real. Here's exactly what it requires of a Level 1 contractor, without the legalese.

32 CFR 170 created CMMC. 48 CFR is the rule that puts it into your contract. Here's what to look for in the next solicitation that lands in your inbox.

FCA exposure on CMMC is real, but not in the way most vendors describe it. Here's what actually triggers it at Level 1, and what doesn't.