Before you spend a dollar on CMMC Level 1, here's the question worth answering: what shape are you actually in, and is fixing it a weekend or a mortgage? For most small shops the honest answer is reassuring - the gaps are predictable, and the fixes are mostly free. The same five gaps come up again and again. Here they are, what each one costs to close, and who does the closing.
None of these should scare you. The point of naming them isn't to sell you fear - it's the opposite. If you know the five most likely holes and can see that four of them cost nothing but a few hours, "getting compliant" stops feeling like a five-figure project and starts feeling like a to-do list. Most of a CMMC Level 1 self-assessment is just walking these five honestly and writing down what you find.
Gap 1: The shared login
What it is: one account that the whole shop floor uses, or a machine everyone signs into with the same password. It's the single most common Level 1 failure in small shops, and it quietly fails two requirements at once - individual identity and authorized access.
The fix: individual accounts for every person on every shared machine, and kill the shared login. Cost: $0. Time: an afternoon. Who: your IT person or MSP, or you if you manage your own machines.
Gap 2: Permissions where everyone can open everything
What it is: one file server or SharePoint site where any logged-in employee can reach the contract folder, the drawings, the quotes - everything. The requirement is that people reach only what their job needs, and "everyone can open everything" is the default most systems ship with until someone changes it.
The fix: scope access by role - contract information lives in specific folders, and only the roles that need it hold access. Cost: $0. Time: an afternoon of permission settings. Who: whoever administers your file storage, usually your MSP - though only you can tell them who should have access. This is the gap where the shop and the MSP have to talk; the MSP can't guess your org chart.
Gap 3: No visitor control
What it is: visitors, vendors, and delivery drivers move through your facility without an escort, a sign-in sheet, or any record - and nobody tracks who holds keys and door codes. It's the one requirement no amount of good cloud setup touches, because it's entirely physical.
The fix: a sign-in sheet at the entrance, an escort habit, and a one-page inventory of keys and codes. Cost: $0. Time: an hour to set up, plus a five-minute all-hands to start the habit. Who: you and your team, on-site. This one can't be delegated to an MSP - it lives at your front desk. It's also the cheapest fix on this entire list and one of the most commonly missing.
Gap 4: The router nobody manages
What it is: your boundary with the internet is the box your ISP dropped off, still on factory settings, with an admin password nobody knows. A firewall you can't log into isn't "monitoring and controlling" anything - it's just sitting there.
The fix: log into it (call the ISP if the password's a mystery), change the admin password to something only you control, confirm the firewall is on, and turn off remote administration. Cost: $0 in the common case - occasionally $60-100 if the ISP box turns out to be genuinely unmanageable and needs replacing with a small-business router. Time: about two hours including the phone call. Who: your IT person or MSP.
Gap 5: The server that never gets patched
What it is: your workstations auto-update, but the file server - the machine holding the most contract information - rarely gets touched, because updating it means a restart and a restart means downtime. So it drifts, months behind on security patches.
The fix: patch it now (after hours, since it'll restart), then adopt a monthly 30-minute routine - update the server, confirm the workstations kept current, log one line. Cost: $0. Time: 30 minutes now, 30 minutes a month ongoing. Who: your IT person or MSP, with a standing calendar reminder.
Add it up
| GAP | HARD COST | TIME | WHO |
|---|---|---|---|
| Shared login | $0 | An afternoon | IT / MSP |
| Open permissions | $0 | An afternoon | MSP + you |
| No visitor control | $0 | An hour + a habit | You, on-site |
| Unmanaged router | $0-100 | Two hours | IT / MSP |
| Unpatched server | $0 | 30 min + monthly | IT / MSP |
Total hard cost for the typical shop with all five gaps: a router, at most. The real spend is two to four weekends of attention, spread however you like. That's the honest shape of Level 1 remediation for a small shop, and it's why the cost of compliance is so different from what the five-figure consultant quotes imply. The requirements were written as basic hygiene. For most shops, they're genuinely basic to fix.
Which of the five do you have?
You can probably already guess two or three of these just from reading. The free 5-question check tells you for sure - it samples these exact gaps and gives you an instant read, no email required. Two minutes, and you'll know whether your list is one item or all five - and either way, now you know what each one costs.
Where does your shop stand right now?
Five yes/no questions, instant grade, no email required. Know before you're asked.
Take the free 5-question check