CMMC Level 1, in plain English
DRAFT. pending Compliance review. This page is a plain-English starting point, not legal or compliance advice, and it has not been approved for publishing.
What is it?
CMMC stands for Cybersecurity Maturity Model Certification. It is a Department of Defense program for making sure companies in the defense supply chain protect sensitive information. Level 1 is the entry level.
Level 1 covers 17 basic practices for protecting Federal Contract Information (FCI): information that is provided by or generated for the government under a contract and is not meant for public release. [Compliance to review wording]
What does Level 1 ask of you?
You work through the 17 practices (59 assessment objectives), which are drawn from FAR 52.204-21. Think of things like controlling who can get into your systems, protecting and updating your devices, and limiting physical access. [Compliance to confirm descriptions before we state more]
Each year, someone accountable at your company, the Affirming Official, affirms the result. [Compliance to confirm current rule details and timing]
Who needs it?
Contractors and subcontractors that handle FCI and whose contracts include CMMC Level 1 requirements. Your contract terms are the source of truth for what applies to you. [Compliance review pending]
Where NexusIQ fits
NexusIQ helps you organize and track your Level 1 work: scoping your FCI, working through the practices in plain English, and handing a packet to your Affirming Official.
NexusIQ does not certify or guarantee anything, and it does not make your company compliant. Your company and its Affirming Official are responsible for the accuracy of your assessment and affirmation. [wording pending approval by Seth and Compliance]
Always check the official sources for current requirements. [Compliance to add links to the official DoD CIO CMMC resources and FAR 52.204-21 text]