Keep reading — what this actually means for your shop
GRYHAT
Free · 12 questions · no sales call

Your prime sent you a clause. Now you have to answer it.

CMMC Level 1 is 15 requirements you are expected to self-attest to — under penalty of the False Claims Act. Most contractors have no idea which ones they already fail. Find out in 90 seconds, before you sign something you cannot back up.

Get my readiness scoreNo payment. No obligation. Score shown on screen.
15safeguarding requirements at Level 1, from FAR 52.204-21
Annualself-assessment, affirmed by a company officer
Flow-downrequirements pass from primes to subcontractors

The score is not the point. The gap is.

A number tells you nothing you can act on. This shows you the exact practices you miss, what each one means in plain English, and which order to fix them in — quick wins first, so you can show progress before your next contract review.

AC.L1-3.1.1
Authorized access control
AC.L1-3.1.2
Transaction & function control
AC.L1-3.1.20
External connections
AC.L1-3.1.22
Control public information
IA.L1-3.5.1
Identification
IA.L1-3.5.2
Authentication
MP.L1-3.8.3
Media disposal
PE.L1-3.10.1
Limit physical access
PE.L1-3.10.3
Escort visitors
PE.L1-3.10.4
Physical access logs
PE.L1-3.10.5
Manage physical access devices
SC.L1-3.13.1
Boundary protection
SC.L1-3.13.5
Public-access system separation
SI.L1-3.14.1
Flaw remediation
SI.L1-3.14.2
Malicious code protection
SI.L1-3.14.4
Update malicious code protection
SI.L1-3.14.5
System & file scanning

The 15 safeguarding requirements in FAR 52.204-21 map to 17 assessable practices across 6 domains: Access control, Identification & authentication, Media protection, Physical protection, System & communications protection, System & information integrity. We score the finer-grained version so you know exactly what to fix.

Start with the list nobody handed you.

All 15 requirements in plain English, with a column for what counts as evidence for each one. Most people fill it out in about twenty minutes and know exactly where they stand. No call, no obligation — it is a one-page PDF.

We send the checklist and follow up about compliance work. See our Privacy Policy.

Want your actual score?

The checklist tells you what the requirements are. This tells you which onesyou miss. Twelve questions, written for a business owner rather than an auditor, and a gap report that puts the fixes in order — quick wins first. Nothing is stored until you ask for the report.

1 / 16

Do you hold or bid on DoD contracts or subcontracts?

Straight answers

The questions contractors ask before they start.

  • What is CMMC Level 1?CMMC Level 1 covers Federal Contract Information (FCI) and is met through an annual self-assessment, affirmed by a company officer. It does not require a third-party assessor.
  • Is Level 1 fifteen requirements or seventeen practices?Both numbers are correct and it trips people up constantly. FAR 52.204-21 lists 15 basic safeguarding requirements, and that is how the CMMC rule enumerates Level 1. The CMMC model breaks one of them — the physical protection requirement covering visitor escorts, physical access logs, and access devices — into separate assessable practices, which is where 17 comes from. We assess against the finer-grained 17 because it tells you precisely what to fix; you affirm against the 15.
  • Do I need CMMC if I am only a subcontractor?Usually yes. CMMC requirements flow down from primes to subcontractors. If your contract or purchase order carries the clause, it applies to you regardless of your size.
  • What is the difference between FCI and CUI?FCI is information provided by or generated for the government under a contract that is not intended for public release. CUI is controlled unclassified information and is marked as such. Handling CUI moves you to Level 2, which carries a third-party assessment requirement.
  • How long does Level 1 compliance take?For most small contractors the gap is measured in weeks, not quarters. The majority of Level 1 practices are process and documentation rather than hardware purchases.
  • Is this assessment really free?Yes. You get your score on screen immediately and the full gap report by email. There is no payment step and no obligation to book a call.