CMMC Level 1,
in plain English.
The federal compliance internet was written by consultants who get paid by the page. This library is written by the engineers actually shipping the work — for the small defense contractors who just want to bid, win, and stay compliant.
- 15
- Safeguarding requirements
- 1
- Annual SPRS affirmation
- 7 days
- To a bid-ready package
Three questions. Three answers.
You don't need a $20k 3PAO to start. You need to know whether CMMC L1 applies to you, what it asks for, and how to file the answer. Start anywhere.
- 01
Do I need it?
If your contract mentions FAR 52.204-21 or FCI, the answer is probably yes. The decision tree gets you to a definitive answer in two minutes.
Take the decision tree - 02
What does it require?
Fifteen basic safeguarding requirements. No score, no maturity model — pass or fail. Here is what each one actually asks of your business.
Read the 15 requirements - 03
How do I file?
Self-assess, post your SPRS affirmation, hand a one-page summary to any prime asking. We'll show you the exact path — seven days, no consultants.
See the 7-day path
Do you actually need CMMC?
Before you spend a dollar: a flowchart of who is covered, who is exempt, and what FCI really means in your contracts.
- 01CMMC Level 19 min readDo I Even Need CMMC? A 4-Question Decision Tree for 2026
Half the small businesses asking about CMMC don't actually need it — and the other half need it more urgently than they realize. Four questions and you'll know where you stand.
May 11, 2026 - 02CMMC Level 19 min readCUI vs FCI: What's the Difference? (With 12 Real Examples) — 2026
FCI triggers CMMC Level 1. CUI triggers CMMC Level 2. Mix them up and you'll either over-spend by $20k or under-comply on a federal contract.
May 13, 2026 - 03CMMC Level 18 min readWhat Is FCI? The 90-Second Definition That Decides Your CMMC Level (2026)
FCI is the routine non-public information you handle under a federal contract. It's what triggers CMMC Level 1 — and it's almost certainly already in your inbox.
May 11, 2026 - 04CMMC Level 112 min readCMMC Level 1 vs Level 2: Which One Do You Actually Need? (2026 Plain-English Guide)
Most small defense contractors are Level 1, not Level 2 — but the wrong answer here costs you a year and tens of thousands of dollars. Here's the single question that decides it.
May 11, 2026 - 05Regulations9 min readDFARS 252.204-7012 vs CMMC: Which One Applies to Me? (2026 Guide)
DFARS 7012 says 'protect CUI to NIST 800-171.' CMMC says 'prove it.' One is the rule. The other is the audit. Here's how they fit together.
May 13, 2026 - 06SBIR & Small Business10 min readJust Won an SBIR Phase I? Here's Your CMMC Timeline (2026 Edition)
Congrats on the Phase I award. Now the question that ambushes most founders: do you need CMMC to start work, or only at Phase II? The honest answer depends on what kind of data the agency hands you on day one.
May 11, 2026
What CMMC Level 1 actually is
The 15 safeguarding requirements, the binary pass/fail model, and how FAR, NIST, and CMMC actually fit together.
- 01CMMC Level 114 min readCMMC Level 1: All 15 FAR Safeguarding Requirements Explained in Plain English (2026 Guide)
Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on — what each control means, what evidence satisfies it, and where teams trip up.
May 3, 2026 - 02CMMC Level 18 min readCMMC Level 1 Is Binary. There Is No Score. Here's What That Means.
Level 1 isn't graded on a curve. Every one of the 15 requirements has to be MET — or the whole assessment fails. Here's how the rule actually works, and why that's good news for small contractors.
May 11, 2026
How to file it and stay bid-ready
Run the self-assessment, post your SPRS score, and respond to a prime asking for proof — without paying a 3PAO.
- 01CMMC Level 17 min readThe CMMC Level 1 Self-Assessment Checklist (Free, Printable PDF) — 2026
Every CMMC Level 1 requirement, in plain English, on a printable page. No email gate. No upsell. Just the checklist.
May 13, 2026 - 02SPRS & Affirmation9 min readWhat to Tell Your Prime When They Ask for Your SPRS Score (And You're Level 1)
If your prime is asking for a 0–110 SPRS score and you're a Level 1 contractor, the answer is not zero. It's that you're a different tier of the regulation. Here's how to say that without losing the contract.
May 11, 2026