If you sell anything to the Department of Defense, directly or as a subcontractor, you have probably heard the term CMMC more times than you can count. Many small and mid-sized suppliers still feel unsure about what it demands, what it costs, and whether it applies to them at all.
The good news is that Level 1 is the most approachable tier of the Cybersecurity Maturity Model Certification program. It is built on basic cyber hygiene, the kind of habits any well-run business should already practice. Even better, many of these safeguards have been contractually required since 2016 under the Federal Acquisition Regulation.
At CMIT Solutions of Silicon Valley & Pleasanton, we help defense suppliers across the Bay Area turn compliance language into practical, everyday IT routines. This guide walks through what Level 1 is, who needs it, and each of the 15 requirements in plain English.
What Is CMMC Level 1?
CMMC is the Department of Defense’s framework for verifying that contractors protect sensitive information. It has three levels, and each one matches the type of data a company handles.
- Level 1 (Foundational): Protects Federal Contract Information, often called FCI.
- Level 2 (Advanced): Protects Controlled Unclassified Information, called CUI, and aligns with NIST SP 800-171.
- Level 3 (Expert): Adds enhanced protections against advanced persistent threats for the most sensitive programs.
Level 1 is the entry point. It applies to any company that handles FCI but not CUI. Compliance is demonstrated through an annual self-assessment, and a senior company official must affirm the results in the Supplier Performance Risk System, known as SPRS.
What Counts as Federal Contract Information?
Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release. Think of things like:
- Contract performance details and deliverable schedules
- Internal emails discussing the scope of work
- Statements of work and pricing information
- Technical or administrative data shared during delivery
FCI is not classified, and it is not necessarily CUI. It is simply information that should not be left exposed. If you hold a DoD contract or subcontract, you almost certainly hold FCI.
Why 15 Requirements and Not 17?
You will see both numbers in the wild, and the difference confuses many people. Level 1 is based on the 15 basic safeguarding requirements listed in FAR clause 52.204-21. CMMC translates those 15 requirements into 17 practices, because a few requirements split into more than one practice during the mapping.
For this article, we follow the 15 FAR requirements and note where they expand into additional CMMC practices. Either way, the underlying expectations are the same.
Where Does CMMC Stand Today?
The Department of Defense has finalized its rules to bring CMMC into contracts through a phased rollout that began in late 2025. Over time, more solicitations will list a required CMMC level, and prime contractors will need proof that their subcontractors comply.
Suppliers who prepare early avoid last-minute scrambles and lost bids. Because Level 1 relies on fundamentals, it is also the best time to build a security foundation that supports future growth into Level 2.
The 15 CMMC Level 1 Requirements in Plain English
The requirements fall into six families: access control, identification and authentication, media protection, physical protection, system and communications protection, and system and information integrity. Here is each one explained without the jargon.
Access Control (4 requirements)
- Limit system access to authorized users.
Only people who need access to your systems should have it. That means unique accounts for each person, no shared logins, and prompt removal of access when someone leaves. A documented IT offboarding checklist makes this requirement much easier to prove. - Limit access to the types of transactions and functions users are allowed to perform.
Not everyone needs administrator rights. Give employees only the permissions their job requires. An office coordinator should not be able to install software or change firewall settings. - Verify and control connections to external systems.
Know which outside systems connect to yours, including personal devices, partner networks, and cloud applications. Set rules for what is allowed and block the rest. - Control information posted or processed on publicly accessible systems.
Before anything goes on your website or social media, someone should confirm it does not contain FCI. Assign a person to review public postings and keep a simple approval process in place.
Identification and Authentication (2 requirements)
- Identify users, processes, and devices.
Every user and device that touches your network should be uniquely identifiable. If something goes wrong, you need to know exactly who or what was involved. - Authenticate those identities before granting access.
Prove that people are who they claim to be. Strong passwords are the minimum, and multi-factor authentication is far better. Adopting zero trust security principles goes beyond this requirement and protects you against credential theft.
Media Protection (1 requirement)
- Sanitize or destroy media containing FCI before disposal or reuse.
Old laptops, hard drives, USB sticks, and printed documents all count. Wipe drives with approved tools or physically destroy them, and shred paper. Keep a record of what was destroyed and when.
Physical Protection (4 requirements)
- Limit physical access to systems, equipment, and operating environments.
Servers, workstations, and network gear should sit behind locked doors, badge readers, or keyed access. Only authorized staff should be able to walk up to them. - Escort visitors and monitor visitor activity.
Guests, vendors, and cleaning crews should never roam freely in areas with FCI. Assign an escort and keep visitors visible. - Maintain audit logs of physical access.
Keep a visitor log or use electronic badge records. You should be able to answer who entered a sensitive area and when. - Control and manage physical access devices.
Keys, keycards, and fobs must be tracked, issued deliberately, and collected when employees leave. Re-key or deactivate lost devices right away.
System and Communications Protection (2 requirements)
- Monitor, control, and protect communications at network boundaries.
A properly configured firewall is the heart of this requirement. It should watch traffic going in and out of your network and block anything suspicious. Professional network management and monitoring keeps those defenses configured and current. - Separate publicly accessible systems from internal networks.
If you host a public website or guest Wi-Fi, keep it on a separate network segment from the systems that hold FCI. That way a problem on the public side cannot spread inward.
System and Information Integrity (4 requirements)
- Identify, report, and correct system flaws in a timely manner.
Patch your operating systems, applications, and firmware promptly. Unpatched software is one of the most common ways attackers get in. - Protect against malicious code, keep protections updated, and scan regularly.
Run antivirus or endpoint protection on all devices, keep definitions current, and schedule routine scans. In CMMC, this requirement expands into three separate practices covering protection, updates, and scanning.
How the Annual Self-Assessment Works
Level 1 does not require a third-party audit. Instead, your company performs a self-assessment every year and posts the results to SPRS. A senior official then affirms that the company has met the requirements. That affirmation is a formal statement, so accuracy matters.
Here is a practical way to approach it:
- Define your scope: Identify every system, device, and location that stores, processes, or transmits FCI.
- Compare practices to reality: For each requirement, record what you do today and how you can prove it.
- Fix the gaps: Prioritize quick wins such as enabling multi-factor authentication and updating patch schedules.
- Document everything: Keep policies, logs, and screenshots as evidence.
- Affirm and repeat: Submit your results, then schedule the next review for twelve months later.
Common Mistakes Defense Suppliers Make
Even companies that take security seriously stumble in predictable places. Watch for these:
- Shared accounts: A single login used by several employees breaks identification requirements.
- Forgotten former employees: Old accounts that stay active are an open door.
- Personal devices: Employees accessing FCI from unmanaged phones or laptops create unmonitored connections.
- No evidence: Doing the right thing without documenting it makes the self-assessment hard to defend.
- Ignoring patches: Delaying updates for weeks or months leaves known vulnerabilities exposed.
- Assuming it only applies to primes: Subcontractors at every tier are expected to protect FCI.
How Level 1 Connects to Broader Cybersecurity
Level 1 is intentionally basic, and attackers do not limit themselves to basic techniques. Suppliers face the same threats as every other business, and often more, because defense supply chains are attractive targets.
Consider how these risks overlap with your compliance work:
- Credential theft through email account takeover can expose FCI sitting in a mailbox.
- Convincing AI-powered phishing attacks can trick even trained employees.
- Trusted staff with legitimate access create insider threat risks that access controls alone cannot fully solve.
- Connected software tools raise API security best practices questions that Level 1 does not directly address.
Meeting the 15 requirements gives you a floor, not a ceiling. Treat it as the starting point for a stronger program.
Building Level 1 Compliance Into Daily IT Operations
Compliance works best when it becomes routine instead of an annual fire drill. These habits keep you ready all year.
Access and Identity Habits
- Review user accounts every quarter and remove anyone who no longer needs access.
- Require multi-factor authentication on email, VPN, and cloud applications.
- Use named accounts for everyone, with administrator privileges limited to IT staff.
Network and Device Habits
- Keep firewall firmware and rules current.
- Segment guest Wi-Fi from your business network.
- Maintain an inventory of every device that connects to systems with FCI.
Patch and Protection Habits
- Automate operating system and application updates wherever possible.
- Deploy endpoint protection on every workstation and server.
- Schedule weekly scans and review alerts promptly.
Physical and Media Habits
- Lock server rooms and network closets.
- Log visitors and issue visitor badges.
- Use a documented process, with certificates of destruction, for retired equipment.
Many suppliers find that outsourcing these tasks to dedicated managed IT services is more reliable than asking an overloaded office manager to handle them. A provider can monitor, patch, and document continuously, which is exactly what an assessor or prime contractor wants to see.
Why Backup and Recovery Still Matter
CMMC Level 1 does not list backups as one of the 15 requirements, but protecting FCI means little if a ransomware attack locks you out of your own systems. Contract deadlines do not pause for outages.
Reliable secure data backup paired with a tested disaster recovery plan protects your ability to deliver. It is also smart to rehearse your ransomware recovery planning so you know how long restoration would really take.
The Role of Cloud and Productivity Tools
Most suppliers now store contract documents in cloud platforms and collaborate through email and shared drives. That convenience introduces compliance questions. Where is data stored? Who can access it? Are external sharing links controlled?
Choosing the right business cloud services and configuring your business productivity applications correctly helps you enforce access limits and external connection controls. It also helps to understand cloud data sovereignty, since location and jurisdiction can matter for government work.
Voice and video tools deserve attention as well. Properly configured unified communications solutions keep conversations about contract details from leaking through unmanaged apps.
Hardware, Aging Systems, and Procurement
Old equipment is a compliance risk. Machines that can no longer receive security updates make it impossible to satisfy the flaw remediation requirement. Review aging hardware risks before they become an audit headache.
When it is time to replace equipment, consistent IT hardware procurement ensures new devices arrive configured with the right security settings from day one.
Manufacturers face extra complexity because production systems often run older software. A careful approach to manufacturing IT modernization can improve security without halting the shop floor.
Protecting Intellectual Property Alongside FCI
Many defense suppliers in the Bay Area are engineering and technology firms that also hold valuable design data. FCI is only part of what needs protection. Learn more about protecting engineering intellectual property in a world where AI tools can accidentally expose sensitive files.
Insurance, Mergers, and Business Risk
Compliance also affects your finances. Insurers increasingly ask about security controls before issuing or renewing coverage, and many of the questions mirror CMMC practices. Understanding cyber insurance requirements can help you strengthen your position at renewal time.
If you are growing through acquisition, cybersecurity due diligence matters too. Acquiring a company that mishandles FCI can bring its compliance problems into yours.
Getting Help and Building a Roadmap
Preparing for compliance does not have to be overwhelming. A step-by-step plan makes it manageable:
- Assess: Identify where FCI lives and which systems touch it.
- Prioritize: Fix the highest-risk gaps first.
- Implement: Apply technical controls and written policies.
- Monitor: Track patches, accounts, and alerts continuously.
- Review: Reassess annually before you affirm in SPRS.
Strategic IT compliance support and strategic IT guidance can shorten this journey, especially for teams without an in-house security specialist. Day-to-day issues, such as locked accounts or failed updates, are easier to handle with responsive help desk support standing by.
Budget predictability matters too. Transparent managed IT packages let you plan for security as a fixed operating cost instead of an unpredictable expense. If you want proof that this approach works, review real client case studies from local organizations, and learn about the trusted technology partners behind the tools we deploy.
When you are ready to get to know the people behind the service, meet the experienced local IT team that supports businesses across the region. For general technology help, our Silicon Valley IT support overview is a good place to start.
Keeping Up as Requirements Evolve
CMMC will continue to change as rules, contract language, and threat conditions evolve. Companies that treat security as a living program adapt more easily than those that treat it as a checklist. Part of that mindset is staying open to keeping up with technology changes and understanding the outdated infrastructure costs that can quietly drain budgets and weaken security.
Conclusion: Make Level 1 a Competitive Advantage
CMMC Level 1 may be the simplest tier, but it still carries real weight. Meeting the 15 requirements protects your contracts, your reputation, and the defense supply chain that depends on you. The practices are common sense: limit access, verify identities, protect your space, defend your network, patch your systems, and prove you are doing it.
Suppliers who build these habits now will be ready for whatever comes next, whether that is a new contract clause, a prime contractor questionnaire, or a step up to Level 2. The cost of waiting is far higher than the cost of preparing.
If you want help turning these requirements into a workable plan, the team at CMIT Solutions of Silicon Valley & Pleasanton is ready to assess your environment, close your gaps, and support you year-round. Schedule a free consultation and take the first step toward confident, documented compliance.
Frequently Asked Questions
