Almost every CMMC question eventually narrows to one word — the kind of information you handle. Federal Contract Information points to Level 1. Controlled Unclassified Information points to Level 2. Tell those two apart correctly and your level answers itself; get it wrong and you'll either over-build for
Most CMMC guides spend all their time on the 15 requirements and then go quiet at the finish line. But meeting the requirements isn't the last step — making it official is. You have to record your self-assessment in a government system and have a senior person formally
For a lot of small businesses, CMMC stops being an abstraction the day a prime contractor sends a notice, or a clause shows up in a contract, and suddenly cybersecurity compliance is your problem too. If you've just had that moment, here's where to actually start
Quick clarification before anything else, because the letters trip people up: this is about CMMC — the Cybersecurity Maturity Model Certification the Department of Defense now requires — not the CMM (coordinate measuring machine) on your shop floor. Different thing entirely. If a prime contractor or a contract clause just put "
If you've worried that CMMC means buying expensive enterprise security software or hiring a monitoring service, here's some relief: antivirus is a Level 1 requirement, and for most small contractors, the protection already built into your computers is good enough — as long as it's
When you replace an old computer, clear out a storage closet, or hand a used laptop down to a new hire, CMMC has something to say about it — and most contractors are surprised to learn it's a Level 1 requirement, not Level 2. You'll see "
Short answer: no. CMMC Level 1 doesn't require a password manager — and for that matter, no CMMC level does. A password manager is a helpful tool, not a requirement on any control list. It's still one of the easier upgrades a small contractor can make, so
Short answer: yes. CMMC Level 1 doesn't care what you paid for your software, and it doesn't care whether the code is open or closed. It cares about one thing — whether each requirement is actually met. Free tools, open-source tools, and the software already built
If you've gone looking for "CMMC password requirements," you've probably found a wall of rules: twelve-character minimums, special characters, forced rotation, no reusing old passwords, multi-factor authentication everywhere. It's enough to make a small shop think they need to overhaul
Short answer: for CMMC Level 1, yes — and you can almost certainly use regular commercial Box, not the pricier government edition. That last part is where Box is different from most file-sharing tools, and where contractors talk themselves into spending more than they need to. Box is one of
Here's the first thing to clear up: no file-sharing tool is "CMMC compliant," Dropbox included. CMMC certifies companies, not apps. So the real question isn't whether Dropbox has a badge — it's whether you can run your business on Dropbox and still
Short answer: for Level 1, yes — commercial Google Workspace, including the Business Standard plan, can be used to handle your Federal Contract Information. You don't need a special government edition. But "can be used" and "makes you compliant" are two different things, and the