CMMC Level 1, in plain English
DRAFT. pending Compliance review. This page is a plain-English starting point, not legal or compliance advice, and it has not been approved for publishing.
What is it?
CMMC stands for Cybersecurity Maturity Model Certification. It is a Department of Defense program for making sure companies in the defense supply chain protect sensitive information. Level 1 is the entry level.
Level 1 covers Federal Contract Information (FCI): information that is provided by or generated for the government under a contract and is not meant for public release (not including information the government makes public, or simple transactional information such as what’s needed to process payments).
What does Level 1 ask of you?
You work through the 15 requirements in FAR 52.204-21, which CMMC lists as 17 practices (59 assessment objectives). Think of things like controlling who can get into your systems, protecting and updating your devices, and limiting physical access.
Each year, someone accountable at your company, the Affirming Official, affirms the result in SPRS.
Who needs it?
Contractors and subcontractors that handle FCI and whose contracts include CMMC Level 1 requirements. Your contract terms are the source of truth for what applies to you.
Where NexusIQ fits
NexusIQ helps you organize and track your Level 1 work: scoping your FCI, working through the practices in plain English, and preparing an assessment review packet for your Affirming Official.
NexusIQ does not certify or guarantee anything, and it does not make your company compliant. Your company and its Affirming Official are responsible for the accuracy of your assessment and affirmation.
Official sources
Always check the official sources for current requirements.
Want help staying organized?
Book a 20-minute demo.