Plain-English guides for small defense contractors working through CMMC Level 1 - written for the shop owner doing this without a security team, mapped to the official requirements and systems.
WHERE ARE YOU IN THIS?
- The 15 CMMC Level 1 requirements, explained for small shopsEvery requirement in FAR 52.204-21 translated into what it actually looks like in a 12-person shop - plus the two rules that trip people up.
- FAR 52.204-21, explained: the clause behind CMMC Level 1Who the basic safeguarding clause covers, what its three paragraphs require, how it maps to CMMC Level 1, and why some newer contracts number it 52.240-93.
- Is CMMC Level 1 17 requirements or 15?Why sources disagree on the count, which number is current, and why the discrepancy doesn't change what you need to do.
- CMMC Level 1 vs Level 2: which one are you?FCI vs CUI in plain English, the 10-minute contract-clause test, and the scoping mistakes that cost small contractors real money.
- The 5 most common Level 1 gaps in small shopsShared logins, open permissions, visitor control, the unmanaged router, the unpatched server - each with the fix, the real cost, and who does it.
- The MSP question: what your IT provider can and can't doWhich of the 15 your MSP owns, which you share, and the three that stay yours no matter how good your provider is.
- What counts as evidence: the artifacts nobody tells you to keepThe specific artifact that proves each requirement, the six-year retention rule, and the quarterly habit that makes it painless.
- Preparing for Level 1 before you have a contractThe honest case for getting ready early - and the real cases for waiting - for shops pursuing DoD work they haven't won yet.
- The CMMC compliance deadline, explainedEnforcement started phasing in November 2025. What each phase means, why primes move your date up, and the planning math.
- CMMC Phase 2 is suspended - Level 1 didn't changeWhat the July 13, 2026 suspension actually paused (third-party certification), what stayed the same at Level 1, and why the 15 requirements are still contract terms.
- What the CMMC pause actually means for a small shopThe July 13 memo contract by contract, what stayed in force at Level 1, the three things that don't care about the pause, and what each task-force outcome would mean.
- What CMMC Level 1 actually costsFree to $15,000, honestly itemized: DIY, policy generators, template packages, guided tools, and consultants - and how to pick.
- How to submit your SPRS score, step by stepPIEE accounts, the Cyber Vendor User role, the entry screens, the Affirming Official workflow, and the annual renewal.
- Your CMMC Level 1 affirmation renews every yearThe annual cycle explained - what renews, what "expired" costs you, how to find your date, and what to line up before you re-affirm.
- Affirmed when enforcement started? Your re-affirmation is coming dueFor the late-2025 first wave: why fall 2026 is a renewal cliff, what a lapse costs, and a 30-minute check to get re-affirmed on time.
- What's actually in scope: systems, not headcountLevel 1 is scoped by covered system, not by how many people touch FCI - why 11 of the 15 apply to your building and field devices regardless of headcount.
- When you're the prime: flowing FAR 52.204-21 down to subcontractorsHold the contract directly and sub work out? What paragraph (c) requires, the COTS carve-out, and what you are and aren't responsible for.