Free framework self-check
CMMC Level 1 Self-Check
A government contract may require you to protect Federal Contract Information (FCI) even when you do not handle CUI. This free self-check asks ten questions about basic safeguarding before your annual Level 1 self-assessment. Current DoD guidance identifies 15 security requirements aligned with FAR 52.204-21; ten questions cannot verify all of them.
- The risk
- The tool suggests possible gaps from your answers. It does not verify controls or provide an audit, certification or legal advice.
How the self-check works
- You give a first name, company and work email. Your session is stored and a resume link is sent by email.
- An external AI service uses your intake details to draft ten questions about the framework. You answer in your own words; no documents are uploaded.
- You receive a short summary of potential gaps and a suggested order of work, based only on your answers.
- Use the summary to discuss open questions with your team. If you need a professional review, contact us before sharing records or confidential information.
The summary comes from your answers, not a review of your systems. It cannot be used as an audit or certification result.
Who it is for
Contractors handling FCI only and preparing their annual Level 1 self-assessment and affirmation. It is intended for business owners, IT administrators and the people responsible for contract compliance. If your work includes CUI, check whether Level 2 applies instead. Use the contract's actual information-handling requirements rather than guessing from the size of your company.
Basic safeguarding of Federal Contract Information
The five themes covered
- Access and user accounts
- Whether access is limited to approved people, processes and devices. Consider shared accounts, administrator permissions and access removal when people leave. Think about both office systems and cloud services used to store or share FCI.
- Media and physical protection
- How devices, removable media and physical work areas are protected. Consider visitor access, who can reach equipment and what happens to information before media is discarded or reused. Include remote work arrangements where relevant.
- System boundaries and connections
- Which systems process, store or transmit FCI and how connections are controlled. Think about external services and public-facing systems. Your review needs a clear picture of the environment; a small network can still have important outside connections.
- Malicious code and patching
- How your team identifies and corrects system flaws and uses protection against malicious code. Consider who checks alerts and applies updates. A purchased security product is useful only if it is maintained and used.
- Identification and authentication
- How users and devices identify themselves before access is allowed. Consider unique identities and the checks used to confirm them. Review the accounts actually in use, including supplier support accounts, rather than relying only on a policy.
From self-check to assessment
A preparation review checks the safeguarding practices in your environment and helps organize unresolved questions. For example, an old employee account may still have access to a shared project folder. We can help your team identify that gap and plan the correction. This conversation does not submit results to SPRS or perform the official annual self-assessment.
Your organization completes its Level 1 self-assessment and required affirmation. AuditPartners helps with preparation; the free tool does not provide a certification or official status.
Guides and assessment services
The next step
Start the CMMC Level 1 self-check
Ten questions, answered in your own words. Sessions are stored so you can resume; session pages are not indexed.