A CMMC Level 1 self-assessment covers 15 basic practices for protecting federal contract information. This check lets you see where you stand before you sign the yearly affirmation.
Zippie IT, a veteran-owned company in Meridian, Idaho, built it from the 15 requirements in FAR 52.204-21. It also asks whether your contract involves controlled unclassified information, because that usually means Level 2.
What your CMMC Level 1 self-assessment result means
Level 1 needs all 15 practices in place and evidence to back each one. There is no plan of action for missing items at Level 1, and a company official affirms the result each year.
This is a readiness check, not a CMMC assessment, a certification or an affirmation. Our CMMC readiness assessment measures you against Level 1 or Level 2 and gives you a gap list and a plan.
Send us your results
Want help closing the gaps? Your results are copied into the box below. Add your name, email and phone number and we will get back to you. Please do not include controlled or contract information.
We use your details to respond to your request. If you want details, see our Privacy Policy.
Related services
Frequently asked questions
What is CMMC Level 1?
It is the basic level of the Cybersecurity Maturity Model Certification. It covers 15 practices to protect federal contract information, checked by a yearly self-assessment.
What is the difference between FCI and CUI?
Federal contract information is non-public information from a government contract. Controlled unclassified information is sensitive information the government marks or designates as controlled, and it usually means Level 2.
Can I pass Level 1 with a plan of action?
No. Level 1 does not allow a plan of action. All 15 practices must be in place.
Is this check an official assessment?
No. Only your own company official can affirm Level 1, and only an authorized assessor or the government can produce an official result for Level 2.
Can Zippie IT help?
Yes. Our CMMC readiness assessment finds the gaps, and our managed IT services can fix many of them. Zippie IT is not a C3PAO.