CMMC Level 1: do it yourself, use a platform, or hire a consultant?
There are three honest ways to get to a posted SPRS affirmation for CMMC Level 1. All three are legitimate. They differ on cost, on how much of your time they take, and on how defensible the result is. Here is the straight comparison so you can pick the right one.
| Path | Typical cost | Time from you | Best for |
|---|---|---|---|
| Do it yourself | Free (plus the book if you want a guide) | A weekend to a couple of weeks | Owners with a competent IT person and time to read |
| Use a guided platform | $249/month Self Service, or $397/month with an officer | Most finish the build in 3 to 5 business days | Owners who want it done fast and defensible without becoming an expert |
| Hire a consultant | Roughly $6,000 to $18,000 for a Level 1 engagement | Several weeks, on the consultant's schedule | Owners who want it fully off their plate and have the budget |
Do it yourself
Level 1 is a self-assessment of 15 basic practices. With a clear checklist and templates, an owner with some IT help can complete it without paying anyone.
- ✓No software or service cost
- ✓You learn your own environment, which helps every year after
- ✓Free templates and a step-by-step handbook are available
- •Takes real founder time, often 40 to 80 hours the first time
- •Easy to mis-scope FCI versus CUI and pick the wrong level
- •No one checks your work before you affirm in SPRS
Use a guided platform
A platform walks you through the 15 requirements in plain English, drafts your System Security Plan and affirmation from your answers, reviews your evidence, and gets you SPRS ready, with a credentialed officer available on the higher tier.
- ✓Fast and guided, with no blank pages
- ✓Generates the SSP, affirmation, and a bid ready package
- ✓Evidence is reviewed, so your self-assessment is more defensible
- ✓Keeps your posture watched and preps the annual re-affirmation
- •A monthly cost, though far below a consultant
- •You still answer the questions about your own business
Hire a consultant
A consultant runs the assessment for you and hands back documentation. It is the most hands off path and the most expensive, and the affirmation in SPRS is still legally yours to make.
- ✓Least time from you
- ✓Useful if you may need Level 2 within a year
- •By far the most expensive path for a Level 1 self-assessment
- •You can be left without a repeatable process for next year
- •Quality varies widely, and the affirmation risk stays with you
How to choose in one minute
- Pick do it yourself if you have an IT person, a few spare evenings, and you want to spend zero dollars. Start with the free checklist and the field guide.
- Pick a platform if you want it done in a week, defensible, and watched all year without hiring anyone. That is what Custodia is built for.
- Pick a consultant if you want it fully off your plate, have the budget, and may need Level 2 within a year.
Frequently asked questions
What is the cheapest way to get CMMC Level 1?+
Doing it yourself is the cheapest, because Level 1 is a self-assessment of 15 basic practices that you are allowed to complete and affirm on your own. The cost is your time plus a few dollars per user per month for a business email tenant with MFA. A guided platform costs more than free but far less than a consultant, and a consultant is the most expensive path for a Level 1 self-assessment.
Do I need to hire a consultant or a C3PAO for CMMC Level 1?+
No. Level 1 is self-assessed and self-affirmed. A C3PAO third party assessor is not involved at Level 1, and you are not required to hire a consultant. C3PAOs and consultants are common at Level 2, which is a different tier with marked Controlled Unclassified Information. For Level 1 you choose between doing it yourself, using a platform, or hiring help for convenience.
Is a platform or a consultant better for a small business?+
For most small businesses at Level 1, a platform hits the balance of speed, cost, and defensibility: it guides you, drafts your documents, reviews your evidence, and keeps your posture current for the annual re-affirmation, at a fraction of a consultant's fee. A consultant makes sense if you want the work fully off your plate, have the budget, and may move to Level 2 soon.
Whoever does the work, who signs the SPRS affirmation?+
A senior official of your company, the Affirming Official, signs the affirmation in SPRS. That responsibility cannot be delegated to a consultant or a platform. Tools and consultants help you prepare a defensible self-assessment, but the affirmation, and the False Claims Act exposure that comes with a knowingly false one, stays with your company's senior official.
Not sure which path is yours?
Take the free 4 minute check to see exactly where you stand on the 15 requirements, then start the 7 day platform trial if you want it done with you. No credit card required.