What It Actually Takes to Get a Small Business CMMC Level 1 Ready

November 4, 2026

Today a client of ours filed their CMMC Level 1 self-assessment and annual affirmation in SPRS. They've officially achieved CMMC Level 1 compliance, and I built the package that got them there. It's one of the projects I'm proudest of, so I want to walk through what it actually takes, because "CMMC" scares a lot of small businesses more than it needs to.

What CMMC Level 1 Actually Is

If you work with the Department of Defense and handle Federal Contract Information (FCI), you're expected to protect it. FCI is information the government provides or generates under a contract that isn't meant for public release. Think contract details, schedules, and correspondence, not classified material.

CMMC Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21. They're the fundamentals: limit system access to authorized users, control what those users can do, verify identities, sanitize media before you get rid of it, control physical access, keep malware protection current, and patch flaws in a timely way, among others.

One thing I want to be precise about: Level 1 is a self-assessment. There's no third-party auditor handing out a certificate. The company assesses itself against those requirements, records the result in SPRS (the Supplier Performance Risk System), and a senior official affirms that it's accurate. Then they do it again every year. That's why I say "achieved compliance," not "certified." People in that world notice the difference.

The Controls Are the Easy Part

Here's what surprised me. Most of the technical controls weren't the hard part. A well-run, MSP-managed environment already does a lot of what Level 1 asks for. What a lot of small businesses don't have is the paper that proves it.

Level 1 isn't "do you have security?" It's "can you show it?" The person signing that affirmation is putting their name on a statement to the federal government. They need to be able to point to something real for every requirement.

What Went Into the Package

For this client, I built the package from the ground up. It had three main pieces:

Policies. I wrote their policies so the way the environment is supposed to be run is written down, not just understood.
Evidence. I collected evidence for the requirements, so every "yes, we do that" has something behind it.
Assessment documentation. I put together the documentation that walks through the requirements and how the client meets each one, so the self-assessment is something they can stand behind.

The goal was simple. When the client sat down to file, they shouldn't be guessing. Everything they needed should already be in front of them.

Making It Repeatable

I didn't want this to be a one-off. While building it, I also wrote internal standards and process documentation at my MSP so the next client who needs CMMC Level 1 doesn't start from a blank page. It also feeds into the broader compliance work I do across HIPAA, PCI-DSS, CMMC, and NIST 800-171, where the goal is to standardize controls and documentation across clients instead of reinventing them every time.

And because the affirmation is annual, the package isn't finished just because it was filed. It's a living set of documents that has to stay true as the environment changes.

Owning the Outcome

Small defense contractors usually don't have a compliance department. They have a business to run, and they're counting on their IT partner to know this stuff. That's exactly why it matters to me. When a client trusts us with their environment, I take ownership of whether it can actually hold up when someone asks for proof, not just whether the tickets get closed.

Seeing them file today was a good day. If you're a small business staring down CMMC Level 1 and don't know where to start, start with the 15 requirements, be honest about where you stand, and write it down. That's most of the battle.