Loading…
CMMC Level 1
A practical, contractor-friendly path to consistent security basics: scope the data, implement the baseline, and keep evidence from drifting.
Readiness and support only. We do not provide certification.
Summary
Contractors and subcontractors who handle Federal Contract Information (FCI) and need a security baseline that is consistent, defendable, and maintainable.
Unclear scope, shared accounts, unmanaged devices, inconsistent patching, and “tribal knowledge” documentation that disappears when one person is out.
A clear scope, a structured baseline, and evidence you can maintain—plus optional monthly management so security doesn’t drift.
Level 1
A readiness program is not a pile of tools. It’s repeatable systems.
Most contractors think Level 1 readiness is a checklist you complete once. In reality, it is closer to a baseline you maintain. The goal is to show that you consistently safeguard FCI by using structured identity, device standards, secure configurations, and predictable routines.
The hard part for growing teams is not motivation—it's structure. When systems are built organically over years, security gets distributed across random settings, personal habits, and “we usually do it this way” workflows. That’s fine—until contracts, partners, or internal leaders need proof and consistency.
Level 1 projects go sideways when teams don’t define scope. "Scope" does not have to be complicated. It’s a plain-English map of where FCI is created, stored, shared, and processed—and which users and systems touch it.
Scoping prevents two expensive failure modes. The first is over-scoping: treating every workstation, app, and network as equally sensitive, which increases cost and slows work. The second is under-scoping: missing the real data paths, then discovering late that key systems were never brought into a baseline.
Practically, scoping looks like answering questions such as: Which mailbox or shared drive contains contract files? Who sends them outside the organization? Do vendors have access? Which devices are used offsite? Once you can answer those questions, the baseline becomes much easier to design.
Contractors often hear "evidence" and assume it means writing documents for the sake of writing documents. We treat evidence as a side effect of real operations. If your team has a defined onboarding process, device standards, patching routines, backup reporting, and ticketing, you naturally generate proof that controls exist.
The goal is not to produce a massive binder. The goal is to keep a small set of artifacts current: who has access, how devices are managed, what the baseline configuration is, and what happens when something breaks. That kind of evidence is easier to maintain because it aligns with how the business already operates.
Most Level 1 issues are predictable. Shared logins and shared mailboxes hide ownership. Vendor accounts accumulate and never get removed. Remote access gets set up “for convenience.” Devices drift because there is no standard build and no reporting. Backups exist, but nobody has performed a restore test in months.
The fix is not heroics. It’s a few structural decisions: identity policy, device standards, who owns patching, who owns vendor access, and a weekly/monthly rhythm for reviewing what changed.
Level 1 is also where good decisions compound: once identity and device visibility are clean, everything else becomes easier— audits, evidence gathering, and long-term maintenance.
Details
We start by collecting the minimum facts needed to avoid guessing: users, devices, email/identity provider, file storage, remote access methods, and any vendor connections. Then we map where FCI lives and how it moves.
The deliverable is clarity: what is in scope, what is high risk, and what the baseline should look like for your business. This also sets expectations internally so leadership understands what changes are required and why.
Next we implement the baseline controls that produce the biggest risk reduction: MFA, admin separation, device standards, patching routines, backup scope, and basic logging. We also put lightweight documentation in place so ownership is clear.
The most important constraint is not technical—it’s operational. The baseline must match how your team works, otherwise it will drift. We bias toward simple systems you will actually maintain.
Approach
We start with practical scoping. We look for where sensitive data lives, how users access it, and which systems are truly “in scope.” This prevents wasted spend and helps you focus on what matters.
Then we document the current baseline: identity, endpoints, email, backups, and the operational workflows that keep these controls consistent.
Next, we prioritize gaps that reduce risk quickly and improve evidence: access control, device standards, patching, monitoring, and documentation.
This is where contractors usually go wrong—buying tools without fixing fundamentals. Our bias is toward simple, repeatable systems that your team can keep running.
Checklist
If you want a fast self-check, use this as a practical baseline. You don’t need to be perfect to start. The point is to get out of “unknown” and into “controlled.” Each item below is valuable because it produces repeatable behavior and clear evidence.
When this baseline is in place, you get two benefits at once: fewer incidents and faster proof. Your team can show what is real without scrambling.
Start
Start with a free risk review so you know what is in scope, what is high risk, and what to fix first.
FAQ