Frequently asked questions
CMMC Level 1, clearly explained.
Practical answers about the 15 safeguarding requirements, preparation tools, evidence, and the limits of CyberSure.
What does CMMC Level 1 cover?
CMMC Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21 for Federal Contract Information (FCI) within the applicable assessment scope. The exact contract and system scope matter. FAR 52.204-21
Does every defense contractor or subcontractor need Level 1?
The required level and assessment scope depend on the specific contract, solicitation, information, and flow-down terms. Review the contract and ask the contracting officer or prime when the requirement is unclear; CyberSure cannot make a legal applicability determination for you. DoD small-business CMMC information
Is the free Readiness Check an official CMMC assessment?
No. It is a preparation aid that records answers in this browser and helps identify items to review. A formal Level 1 self-assessment follows the applicable CMMC procedures and scope; the tool does not certify compliance or submit assessment results to SPRS. 32 CFR 170.15
What information do the free tools send?
The Readiness Check saves answers locally in your browser. If you separately request an emailed result and consent, the email address and unmet requirement identifiers are sent to deliver that email. The Evidence Check runs offline and writes its report on the computer; it does not send the scanned settings. Do not enter secrets or sensitive contract information into support or email.
What is included in the CMMC Level 1 Self-Assessment Kit?
The kit includes a formatted HTML workbook and editable Markdown workbook with the 15-requirement worksheet, plain-English implementation guidance, evidence checklists, self-assessment records, a remediation tracker, an annual-affirmation preparation checklist, and references. It also includes nine fill-in evidence forms in editable DOCX and printable PDF formats. It supports your own preparation and documentation; it is not an official assessment.
Are the annual self-assessment and annual affirmation the same step?
No. The organization conducts and submits its Level 1 self-assessment results in SPRS annually. Separately, an authorized Affirming Official submits the required affirmation in SPRS after an assessment and annually thereafter. CyberSure does not submit either item for you. 32 CFR 170.15 and 170.22
How is Level 2 different from Level 1?
Level 1 addresses the 15 FAR 52.204-21 safeguards for FCI. Level 2 addresses CUI under its applicable CMMC requirements and assessment path. Contract language, data, and system scope determine what applies; do not infer your required level from company size alone. 32 CFR Part 170
Is CyberSure affiliated with the government or does it certify compliance?
CyberSure is a private company and is not affiliated with or endorsed by the U.S. Army, the Department of Defense, or any government agency. This site provides general information, not legal advice, certification, or an official assessment. CyberSure's tools do not certify compliance.
Explore the free Readiness Check or review the CMMC Level 1 Self-Assessment Kit. CyberSure is a private company and is not affiliated with or endorsed by the U.S. Army, the Department of Defense, or any government agency. Information here is general, not legal advice, certification, or an official assessment.