Consultants love selling Information Security Manuals. We've seen $8,000 invoices for 40-page documents that nobody on the contractor's team ever reads. For CMMC Level 1, that's unnecessary. The 15 safeguarding requirements roll cleanly into eight one-page policies. Each one fits on a single sheet, gets signed by the affirming official, and lives in a folder you can produce on demand.
The 8 policies (and what each covers)
Who gets access to what, how access is reviewed, how it's revoked.
How users prove who they are. MFA. Password rules. Service accounts.
How USBs, hard drives, and printed FCI are handled and destroyed.
Visitor logs. Locked doors. Where FCI is physically stored.
Firewall, guest Wi-Fi separation, what crosses the boundary.
Antivirus, patch cycles, monitoring for malicious activity.
What counts as an incident. Who to call. The 72-hour DoD reporting rule.
What employees may and may not do with company devices and FCI.
Rules for policies that actually work
- One page each. If it's longer, it's not getting read.
- Plain English. “Users must lock their screens when away” beats “Users shall ensure session termination upon physical departure from the workstation.”
- Signed and dated. By the affirming official. Re-sign annually.
- Reflects what you actually do. Don't write “quarterly penetration tests” if you don't do them.
- Lives somewhere findable. A shared drive, a /compliance folder, a binder, just not someone's personal laptop.
Get the free pack
All 8 policies, printable, in the Rhetorich style. Sign once, file, done: Open the policy pack →
Full DIY path: The Free DIY CMMC Level 1 Handbook.
FAQ
Do I really need 8 policies?
You need enough policy coverage that every one of the 15 controls is governed by a written statement of intent. Eight one-page policies is the cleanest way to do that. You could combine them into 2 or 3 longer documents, but the eight one-pagers are easier to maintain, sign, and produce on demand.
Can I use ChatGPT to draft them?
You can, but the output will be generic and won't reflect what your company actually does. Our templates give you the structure; you fill in the specifics (your tools, your processes, your roles). A policy that doesn't reflect operational reality is worse than no policy.
How often do these need to be reviewed?
At minimum annually, before your SPRS affirmation. Also when scope changes, when you adopt a new tool, or when an incident reveals a gap.