CMMC Level 1 readiness, without the six-figure engagement.
A guided, self-service self-assessment for small DoD and SBIR contractors that handle Federal Contract Information. Answer 15 plain-language questions, see exactly where you stand, and get a clear path to close every gap.
Mapped to Microsoft 365 controls. Built and supported by TeamLogic IT. You keep ownership of your attestation.
Level 1 Assessment
15 requirementsLimit access to authorized users
AC.L1-b.1.i
Authenticate identities (MFA)
IA.L1-b.1.vi
Identify and correct flaws (patching)
SI.L1-b.1.xii
Overall result
Not yet eligible: 1 requirement NOT MET
What CMMC Level 1 actually is
The rules are strict, but the bar is clear.
CMMC Level 1 is a self-assessment against 15 basic safeguarding requirements from FAR 52.204-21. The requirements are not vague. Once you know them, you can check each one honestly.
Level 1 protects FCI, not CUI
Level 1 covers Federal Contract Information only. The moment Controlled Unclassified Information is involved, you are a Level 2 case. We check this first, before anything else.
All 15, or none
There is no partial credit and no plan-of-action grace period. Every one of the 15 requirements must be met, or genuinely not applicable, by contract award. Fourteen of fifteen is a failing result.
Every year
Level 1 is an annual self-assessment plus an annual affirmation by your senior official in SPRS. A Level 1 status lasts one year, then you do it again.
How it works
Four steps from unsure to audit-ready.
Self-service where it makes sense, expert help where it matters. You drive the assessment; we close the gaps with you.
- 01
Qualify and scope
Confirm you handle FCI only, then define what is in scope. A tighter scope means a smaller, cheaper assessment. If CUI is involved, we route you to the right path instead.
- 02
Self-assess the 15
Answer each requirement in plain language. Every item carries help on how to check it and the evidence to keep. Status and recommended actions update as you go.
- 03
Gap session and remediation
Review the gaps with TeamLogic IT. We help you configure Microsoft 365, fix what is missing, and collect the evidence each requirement needs.
- 04
You affirm in SPRS
When all 15 are met or not applicable, your senior official affirms compliance in SPRS. You own that affirmation. We never sign or submit it for you.
The 15 controls
Six areas, fifteen plain-language questions.
These are the fifteen questions you will answer, grouped by area. Each one is written in plain English, with the reason it matters.
AC
Access Control
- Do you make sure each person signs in with their own account (no shared or generic logins), and remove their access when they leave?
- Do you give each person access to only what their job needs, instead of admin or full access for everyone?
- Do you control how people connect from outside, such as personal devices, other companies' accounts, or third-party apps?
- Do you review and approve anything before it is posted publicly (website, social media), so contract information is never made public?
IA
Identification & Authentication
- Does every person and device have its own unique sign-in name or ID?
- Do people verify their identity with multi-factor authentication (more than just a password) before they can sign in?
MP
Media Protection
- Do you securely wipe or destroy drives, devices, and paper before throwing them away or reusing them?
PE
Physical Protection
- Do you physically secure your computers, equipment, and work areas so only authorized people can reach them?
- Do visitors sign in and get escorted, and do you keep track of who holds keys or badges?
SC
System & Communications Protection
- Do you protect your network with a firewall and use secure remote access such as a VPN?
- If you host any public-facing systems, do you keep them separate from your internal network? (Often not applicable if you only use cloud services.)
SI
System & Information Integrity
- Do you keep computers and software updated with security patches on a regular schedule?
- Do you run anti-virus or anti-malware on every computer?
- Does your anti-virus update itself automatically so it can catch new threats?
- Does your anti-virus scan continuously and run regular scans, including files from email and USB drives?
Our approach
You own the attestation. We own the readiness.
CMMC Level 1 is a self-assessment by law. Your senior official affirms compliance in SPRS under penalty of the False Claims Act. We keep that line bright on purpose: honest gap output and real evidence on our side, the affirmation firmly on yours.
Why honesty is the whole point
The Department of Justice actively pursues false cybersecurity attestations. A clean report you cannot back up is a liability, not a win. This tool is built to surface real gaps so you can fix them before you affirm.
What you do
- Answer the 15 requirements honestly
- Apply the fixes for any gaps
- Have your senior official affirm in SPRS
- Renew the assessment each year
What TeamLogic IT does
- Guide the self-assessment and scoping
- Configure Microsoft 365 controls with you
- Help collect and retain the evidence
- Prepare you for the affirmation, never sign it
FAQ
Straight answers to the common questions.
Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release. Controlled Unclassified Information is more sensitive and carries specific safeguarding and marking rules. Level 1 covers FCI only. If you touch CUI, you need Level 2, which is a larger assessment.
Yes. There is no partial credit and no plan-of-action-and-milestones option at Level 1. All 15 requirements must be met, or genuinely not applicable, by the time of assessment and by contract award.
For FCI-only Level 1, commercial Microsoft 365 Business Premium is generally sufficient. GCC and GCC High are considerations for CUI and Level 2. We will not push you toward expensive licensing you do not need.
No. CMMC Level 1 is a self-assessment. Your own senior official affirms compliance in SPRS. We provide readiness, remediation, and evidence support only. Keeping that boundary protects you legally.
Level 1 is an annual self-assessment with an annual affirmation in SPRS. A Level 1 status is good for one year.
Both numbers describe the same thing. DoD consolidated the requirements into 15 aligned to FAR 52.204-21. Older guides describe 17 because one requirement maps to three in NIST SP 800-171. We use the canonical 15 and keep the practice IDs for traceability.
See where you stand on all 15, today.
Create an account and run the self-assessment in one sitting. No sales call required to find out where your gaps are.