CMMC Level 1 for $150 a month. Show primes you comply, any time they ask.
Every year a senior official at your company signs an affirmation in SPRS that all 15 Level 1 requirements (17 NIST controls) are met. If one isn't true, that signature is False Claims Act exposure. Garde1 checks each requirement as your evidence comes in and tells you what's missing, so the signature is true when it's made. No SSP, no POA&M, no assessor: Level 1 doesn't need them. Take on CUI later? Upgrade to Level 2 in place, and your evidence and connections carry over.
Fifteen requirements. Most of the work is ours.
Level 1 covers basic safeguards for Federal Contract Information: who can log in, what's on your network, who walks through the door. Software can check most of it. A few things only you can do.
Garde1 handles
- Checking all 15 requirements (17 NIST controls) as your evidence comes in, not once a year
- Telling you in plain English what is missing, and why it matters
- Writing the policies your shop operates by
- A trust center page that shows primes your status, any time they ask
- Keeping the record ready for the day your official affirms
Still yours
- Answer a short set of questions about your shop
- Connect one system, or upload what we ask for
- Fix what is flagged: a password setting, a visitor log, a locked door
- Have your senior official affirm in SPRS once a year
Show primes you comply, any time they ask.
Primes have to confirm your CMMC status before they award. Instead of filling in another questionnaire, publish your status page and invite them. They open it with a one-time code: no account, nothing to install, and you decide what they see.
- Target
- CMMC Level 1
- Requirements
- 15 of 15 met
- Last checked
- Today, as evidence came in
Yes, there are cheaper ways. Here is what you give up.
Level 1 is 15 requirements, and plenty of shops run it from a spreadsheet. The catch is the signature: every year your official affirms in SPRS, and if a requirement wasn't met, that affirmation is False Claims Act exposure.
The DoD guide and a spreadsheet
Free- Who does the work
- You do
- Who decides “met”
- You do
- What primes get
- Your SPRS entry and your word
- The rest of the year
- Checked once, when you affirm
A checklist tool
About $99 a month- Who does the work
- You, one question at a time
- Who decides “met”
- You do
- What primes get
- A screenshot or an export
- The rest of the year
- As current as your last edit
- Who does the work
- Garde1. You connect a system or upload what it asks for
- Who decides “met”
- Your evidence, checked against each requirement
- What primes get
- A live status page they open with a one-time code
- The rest of the year
- Re-checked as your evidence comes in
What Level 1 costs.
The DoD's own estimate of doing it yourself, next to a year of Garde1. Switch to Level 2 if your contract involves CUI.
The DoD’s own estimate of what a small business spends to perform a Level 1 self-assessment and affirm it in SPRS, in staff time.
Garde1 does that work for a third of the cost, and keeps checking all year.
Source: CMMC final rule, Oct 2024Level 1 questions.
How is Level 1 billed?
$150 a month, billed yearly at $1,800. Level 1 is a yearly obligation, so the plan runs on the same cycle as your affirmation.
What does the plan include?
All 15 Level 1 requirements (17 NIST controls) checked as your evidence comes in, your policies, three users, one connected system, and a trust center page you can share with primes.
Does Garde1 affirm for us?
No. The affirmation in SPRS has to come from a senior official at your company. Garde1 makes sure the record behind that signature is true.
What if we take on CUI later?
Upgrade to Level 2 in place. Your evidence and connections carry over, and the Level 2 requirements are added on top.
Not sure which level you need?
Answer three questions at garde1.com/level-check and you will know.