Plain-English guides for small defense contractors working through CMMC Level 1 - written for the shop owner doing this without a security team, mapped to the official requirements and systems.
WHERE ARE YOU IN THIS?
- The 15 CMMC Level 1 requirements, explained for small shopsEvery requirement in FAR 52.204-21 translated into what it actually looks like in a 12-person shop - plus the two rules that trip people up.
- Is CMMC Level 1 17 requirements or 15?Why sources disagree on the count, which number is current, and why the discrepancy doesn't change what you need to do.
- CMMC Level 1 vs Level 2: which one are you?FCI vs CUI in plain English, the 10-minute contract-clause test, and the scoping mistakes that cost small contractors real money.
- The 5 most common Level 1 gaps in small shopsShared logins, open permissions, visitor control, the unmanaged router, the unpatched server - each with the fix, the real cost, and who does it.
- The MSP question: what your IT provider can and can't doWhich of the 15 your MSP owns, which you share, and the three that stay yours no matter how good your provider is.
- What counts as evidence: the artifacts nobody tells you to keepThe specific artifact that proves each requirement, the six-year retention rule, and the quarterly habit that makes it painless.
- Preparing for Level 1 before you have a contractThe honest case for getting ready early - and the real cases for waiting - for shops pursuing DoD work they haven't won yet.
- The CMMC compliance deadline, explainedEnforcement started phasing in November 2025. What each phase means, why primes move your date up, and the planning math.
- CMMC Phase 2 is suspended - Level 1 didn't changeWhat the July 13, 2026 suspension actually paused (third-party certification), what stayed the same at Level 1, and why the 15 requirements are still contract terms.
- What the CMMC pause actually means for a small shopThe July 13 memo contract by contract, what stayed in force at Level 1, the three things that don't care about the pause, and what each task-force outcome would mean.
- What CMMC Level 1 actually costsFree to $15,000, honestly itemized: DIY, policy generators, template packages, guided tools, and consultants - and how to pick.
- How to submit your SPRS score, step by stepPIEE accounts, the Cyber Vendor User role, the entry screens, the Affirming Official workflow, and the annual renewal.
- What's actually in scope: systems, not headcountLevel 1 is scoped by covered system, not by how many people touch FCI - why 11 of the 15 apply to your building and field devices regardless of headcount.
- When you're the prime: flowing FAR 52.204-21 down to subcontractorsHold the contract directly and sub work out? What paragraph (c) requires, the COTS carve-out, and what you are and aren't responsible for.