If you hold a defense contract or subcontract that involves Federal Contract Information (FCI), CMMC Level 1 is the floor you have to meet. It's the most approachable level of the Cybersecurity Maturity Model Certification program, but "approachable" doesn't mean optional or informal. Every requirement has to be fully met, you assess yourself every year, and a senior official at your company signs off on the result.

This article walks through who needs Level 1, how FCI reaches you, the 15 safeguards in plain language, how the self-assessment and affirmation work, and the mistakes we see most often.

Who needs Level 1?

Level 1 applies when your contract requires CMMC Level 1 (Self) and your information systems process, store, or transmit FCI in performance of that contract.

FCI is defined in FAR 52.204-21 as information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service.…