Question 1

What is CMMC Level 1?

Accepted Answer

CMMC Level 1 is the foundational cybersecurity tier for defense contractors handling Federal Contract Information (FCI). It requires annual self-assessment against 15 basic safeguarding practices drawn from FAR 52.204-21. No third-party assessor is required at Level 1.

Question 2

How many practices are in CMMC Level 1?

Accepted Answer

There are exactly 15 practices in CMMC Level 1, drawn from FAR 52.204-21. They span 6 security domains: Access Control, Identification and Authentication, Media Protection, Physical Protection, System and Communications Protection, and System and Information Integrity.

Question 3

Is the Level 1 assessment really free?

Accepted Answer

Yes. CMMCTrack Level 1 self-assessment is free with no credit card and no time limit. The full workflow, all 15 practices, gap tracking, remediation plans, and compliance report export, is included at no cost. An optional AI drafting add-on is available for $49 one-time if you want AI-written remediation plans.

Question 4

Do I need a C3PAO for CMMC Level 1?

Accepted Answer

No. CMMC Level 1 is a self-assessment. You complete it in-house and then affirm the results annually. A Certified Third-Party Assessment Organization (C3PAO) is only required for Level 2 certification-level reviews, not Level 1.