For defense contractors and subcontractors
CMMC Level 1, in plain English.
The 17 CMMC Level 1 practices, drawn from FAR 52.204-21, each written as a task with a guide and a place to keep the evidence behind your annual self-assessment.
- 14-day free trial
- No credit card
- Cancel anytime
From the CMMC Level 1 checklist
- Limit information system access to authorized users (AC.L1-b.1.i)
- Identify users, processes, and devices (IA.L1-b.1.v)
- Escort visitors and monitor visitor activity (PE.L1-b.1.ix)
- Perform periodic and real-time scans (SI.L1-b.1.xv)
Each task comes with a plain-English guide.
01Why it matters
What's already being asked of you.
01
Contracts are starting to require it
DoD is phasing CMMC into new contracts. Where Federal Contract Information is involved, that means Level 1 and an annual self-assessment affirmed in SPRS.
02
Primes are asking their suppliers
If you sit lower in the supply chain, expect your prime to ask where you stand. Each practice here keeps its evidence attached.
03
The shop floor is part of the scope
Physical access, visitor logs and shared machines count. Tasks cover the office and the facility, not just the laptop.
02What's included
Frameworks that fit how you work.
These are the frameworks that matter most for you. Starter includes one of your choice; Pro and above include all of them.
17 tasks
CMMC Level 1
Access control, identification and authentication, media and physical protection, communications and system integrity.
73 tasks
NIST CSF 2.0
A broader program for when you outgrow Level 1 basics.
30 tasks
Cyber Insurance Readiness
The controls insurers ask about on applications and renewals: MFA, backups, email security, incident response.
03How it works
Three steps, at your own pace.
1
Answer a few questions
A short questionnaire at signup recommends the frameworks that apply to your business. Add or remove any of them later.
2
Work through the tasks
Each task says what to do and why, with a guide written for people without an IT background. Invite teammates or your IT provider to work through them with you.
3
Keep the evidence
Attach screenshots, documents and notes to each task as you finish it. When a processor, insurer, client or auditor asks, export it.
04Good to know
Questions we hear.
What Secure-Stack doesn't do
Level 1 covers Federal Contract Information (FCI). If you handle Controlled Unclassified Information (CUI), you need CMMC Level 2, based on NIST SP 800-171, which Secure-Stack does not cover yet.
- Does Secure-Stack submit my SPRS affirmation?
- No. A senior official at your company affirms the self-assessment in SPRS. Secure-Stack is where you do the work and keep the evidence behind that affirmation.
- We handle CUI. Is this enough?
- No. CUI requires Level 2. Level 1 work still counts, because its practices are a subset of Level 2, but you will need more than Secure-Stack covers today.
Start with the CMMC Level 1 checklist today.
From $50 a month, with a 14-day free trial and no credit card.