Know your Level 1 standing before you self-attest.
If you handle Federal Contract Information (FCI), CMMC 2.0 Level 1 asks you to affirm — every year — that all 17 Foundational practices are in place. There is no partial credit at Level 1: a practice is met or it isn’t. This free self-check walks all 17 (straight from FAR 52.204-21), so you can see exactly where you stand before you sign. No signup, nothing stored.
Walk all 17 practices
Mark each practice Met, Not sure, or Not yet. Your readiness updates live.
CMMC 2.0 Level 1 (Foundational) covers the 17 practices that protect Federal Contract Information (FCI), drawn from FAR 52.204-21. Level 1 requires an annual self-assessment affirming all 17 are met and an annual senior-official affirmation in SPRS — there is no partial credit at Level 1. This is an unofficial readiness aid, not an assessment of record. Handling Controlled Unclassified Information (CUI) instead of FCI moves you up to Level 2 and the full 110 NIST 800-171 controls.
Email me my CMMC L1 readiness summary + a remediation roadmap
We'll send a copy and, if you want, help you take the next step. No spam.
All 17, or it’s a gap
Level 1 is pass/fail by design. Here’s the honest read.
Ready to self-attest
Every Foundational practice met. You can complete the annual self-assessment and the senior-official affirmation in SPRS with a clear conscience — and keep the evidence.
A few gaps
Most Level 1 gaps are quick wins — boundary protection, malware defense, access limits, physical controls. They’re rarely expensive; they just need to actually be done and documented.
Unknowns are gaps too
“Not sure” is not “met.” If you can’t point to how a practice is implemented and who owns it, treat it as open. That’s exactly where a short readiness engagement pays for itself.