If your company does work for the Department of Defense — or for a prime contractor who does — you've probably heard the letters CMMC and tuned out. I don't blame you. The official documents are written for auditors, not for the owner of a 20-person machine shop. So here's the plain-English version: what Level 1 actually asks, who needs it, and a checklist you can start on this week.
What CMMC is, in one paragraph
CMMC — the Cybersecurity Maturity Model Certification — is the DoD's way of making sure the companies in its supply chain protect sensitive information. It has three levels. Level 1 covers basic safeguarding of Federal Contract Information (FCI): the everyday contract details that aren't classified but aren't public either. Level 1 is a self-assessment — you check your own practices and attest to them annually. Higher levels, for companies handling Controlled Unclassified Information (CUI), require more practices and, in many cases, an outside assessment.
The timeline that matters: the CMMC acquisition rule takes effect November 10, 2026. From that date, DoD contracts can require CMMC as a condition of award, phased in over several years. If you bid on DoD work, this is coming to your contracts.
Who needs Level 1
If your company handles only FCI — basic contract information — Level 1 is your target. That's most small subcontractors. If you handle CUI (technical drawings, specifications, export-controlled data), you're looking at Level 2, which is a much bigger lift built on all 110 practices in NIST SP 800-171. When in doubt, ask your prime contractor or contracting officer which level your contracts will require. Don't guess.
The 15 Level 1 practices, translated
Level 1 is built on 15 basic safeguarding practices from the federal acquisition rules (FAR 52.204-21). Here's what each one actually means for a small business:
| # | The requirement | In plain English |
|---|---|---|
| 1 | Limit system access to authorized users | Everyone gets their own login. No shared accounts, no "the office password." |
| 2 | Limit access to the types of transactions users may perform | People only get the access their job needs. The front desk doesn't need admin rights. |
| 3 | Verify and control connections to external systems | Know what's connecting to your network — and approve it before it does. |
| 4 | Control information posted on public systems | Don't post contract details or internal info on your public website or social media. |
| 5 | Identify users and devices before granting access | Usernames and passwords at minimum; [multi-factor authentication](/services#faq) is the expectation everywhere it can be turned on. |
| 6 | Sanitize media before disposal or reuse | Wipe or destroy old hard drives before they leave the building. Deleting files isn't enough. |
| 7 | Limit physical access to systems | Lock the server room. Visitors don't wander the office unescorted. |
| 8 | Manage visitor access and audit logs | Know who was in your building and who logged into what. |
| 9 | Escort visitors and monitor activity | Same idea, applied to people: guests are accompanied. |
| 10 | Keep systems patched and updated | Install security updates on a schedule, not "when someone gets to it." |
| 11 | Protect systems from malicious code | Real, managed [endpoint protection](/services#faq) — not the free antivirus that came with the PC. |
| 12 | Update malicious code protection | That protection has to actually update itself and report in. |
| 13 | Scan systems periodically and in real time | Scans run on their own, and someone sees the results. |
| 14 | Control and monitor remote access | Remote connections are secured, logged and limited to people who need them. |
| 15 | Protect the confidentiality of FCI in transit and at rest | Encryption on laptops and email where contract information lives or travels. |
Read down that list and you'll notice something: none of it is exotic. It's the same basic hygiene we put in place for every client, whether or not they touch government work. The difference with CMMC is that you have to be able to show it, and attest to it, every year.
Where small contractors usually fall short
- Shared logins and no multi-factor authentication. This is the most common gap we see, and the cheapest to fix.
- No patching schedule. Updates happen "when Windows feels like it," which means they don't.
- Consumer-grade antivirus with no central reporting. You can't prove protection you can't see.
- No record-keeping. Level 1 is a self-assessment, but you should be able to back up every "yes" with evidence if anyone asks.
- Old equipment walking out the door with data still on it.
Your first five steps
- 1Confirm which level your contracts will require — ask your prime or contracting officer in writing.
- 2Give every user their own login and turn on multi-factor authentication everywhere it exists.
- 3Put patching and antivirus on a managed schedule with reporting, so you can show it's happening.
- 4Write down your physical access rules — who has keys, how visitors are handled — and follow them.
- 5Keep a simple evidence folder: screenshots, policies, logs. When it's time to attest, you'll be glad it's there.
One honest caution: Level 1 is a self-assessment, but it's a legal attestation. Checking boxes you haven't actually done is a false claim, and the Department of Justice has brought cases against contractors for exactly that. Do the work first, then attest.
Where we fit
We work with regulated organizations — healthcare, finance and defense contractors — on Tier 3 — Enterprise, which includes security and compliance consulting and policy management. We're consultants, not auditors: we help you put the practices in place and keep the evidence straight, so when assessment time comes, there's nothing to scramble for.
If CMMC is headed for your contracts and you're not sure where you stand, talk to us or call 585-205-8430. We'll tell you plainly what's already fine and what needs work.