Access Control (AC)
Limit system access to authorized users. Limit access to permitted transaction types. Verify and control external system connections. Control publicly accessible information.
FAR 52.204-2115 Basic RequirementsSPRS Affirmation6-12 Week Engagement
CMMC Level 1 Readiness in Minneapolis
Annual self-assessment readiness for Minnesota DoD contractors and subcontractors handling Federal Contract Information. Fixed-scope engagement, SPRS affirmation, and ongoing annual maintenance.
CMMC Level 1 is the foundational tier of the Cybersecurity Maturity Model Certification 2.0 framework. It applies to Department of Defense contractors and subcontractors that handle Federal Contract Information (FCI) but no Controlled Unclassified Information (CUI). For most Minneapolis manufacturing subs, machine shops, fabricators, and service providers in the DoD supply chain, Level 1 is the starting point, and for many, it's where compliance ends.
McNallan Technology Solutions helps Minneapolis-area DoD contractors implement and document the 15 basic safeguarding requirements that make up CMMC Level 1, then supports the annual SPRS affirmation each year. We don't show up with a binder of templates and disappear. We deploy the controls, train your team, and stay engaged so next year's affirmation isn't a fire drill. This page is part of our broader CMMC compliance practice for Minnesota.
Who needs CMMC Level 1?
You need Level 1 if your DoD contract or subcontract requires it under DFARS 252.204-7021 and the data you handle is limited to FCI. FCI is information provided by or generated for the government under a federal contract, that is not intended for public release. Almost any DoD contract or subcontract produces FCI: a purchase order, a statement of work, a parts drawing tagged "for government use," correspondence about a delivery schedule.
The key distinction is what you don't handle. If your work touches CUI (categories like Controlled Technical Information, export-controlled data under ITAR/EAR, engineering drawings marked CUI, or specifications flagged distribution-restricted), Level 1 is not enough. You need Level 2, and the entry point for that is our CMMC Level 2 consulting in Minneapolis.
If you're unsure which side of that line you're on, check your contracts and ask your prime. CUI can arrive quietly: drawings emailed from a prime, technical data in a shared file library, ITAR-controlled specs in a project folder. Confirm what you receive before you settle on Level 1 as the target.
What CMMC Level 1 actually requires
CMMC Level 1 maps to the 15 basic safeguarding requirements in FAR clause 52.204-21 and through that, to a subset of the practices in NIST SP 800-171 Rev 2. Compliance is determined by an annual self-assessment and a senior official's signed affirmation submitted to SPRS.
Identification and Authentication (IA)
Identify system users, processes, and devices. Authenticate identities as a prerequisite to system access.
Media Protection (MP)
Sanitize or destroy system media containing FCI before disposal or release for reuse.
Physical Protection (PE)
Limit physical access to systems and equipment. Escort visitors, monitor activity, maintain audit logs, and manage physical access devices.
System and Communications Protection (SC)
Monitor and protect communications at external and key internal boundaries. Implement subnetworks for publicly accessible components separated from internal networks.
System and Information Integrity (SI)
Identify and correct system flaws in a timely manner. Provide malicious code protection with current definitions. Perform periodic and real-time scans of files from external sources.
That's the full set. None of them is technically exotic. Every one of them, however, has to be implemented, documented, and verifiable, and that's where most Minneapolis contractors discover they're not as ready as they thought.
What gets in the way for most Minneapolis contractors
Small manufacturers and engineering shops tend to run into the same gaps.
Access control is half-implemented. Domain accounts exist, but everyone's a local admin on their own machine and a third of the workforce shares a single login to the shop floor terminal. Removing local admin and adding individual identities for the shop floor is usually two weeks of focused work, and then a permanent change in how people log in.
External system connections are unmanaged. Personal cloud storage accounts, USB drives traveling between home and work, remote-access tools installed for "the IT guy who used to work here." All of those are uncontrolled external connections to information systems handling FCI. We inventory them and either approve, restrict, or remove them.
The shop has built-in antivirus on most machines, third-party AV on others, and one critical machine that lost its license six months ago. That's not malicious code protection.
Patching is "we'll get to it." Some machines are current, others haven't seen a patch in 14 months because they're production-critical and "we can't take them down." CMMC Level 1 requires timely flaw remediation, and "timely" doesn't survive a 14-month-old missing patch. We build a patch cadence, plan maintenance windows around production, and verify compliance monthly.
Visitor management is a sign-in sheet that hasn't been used since 2019. Physical protection practices require visitor escort, logged physical access, and managed access devices. Most shops have a sign-in clipboard nobody filled in for a year. We rebuild this with a simple, defensible practice that doesn't add overhead.
Nobody owns the policy. CMMC isn't policy-heavy at Level 1 compared to Level 2, but the basic safeguarding practices still require an owner, a documented process, and evidence of execution. We assign internal ownership and document the operating practices in a lightweight policy set that maps directly to the 15 requirements.
Our CMMC Level 1 readiness engagement
- Week 1: Scoping and current-state walkthrough. We meet with your IT and operations leads, inventory information systems that touch FCI, identify the assessable boundary, and map your current security posture to the 15 requirements. You get a documented baseline within the first week.
- Weeks 2-3: Gap remediation. We close the technical gaps: access control, identity, EDR deployment, patch cadence, network boundary configuration, media handling. Most of this is work we'd do anyway as your managed IT and cybersecurity provider; the CMMC project just sequences it and ties each change to a specific FAR 52.204-21 requirement.
- Weeks 4-5: Documentation and policy. We produce a Level 1-appropriate policy set, a brief System Security Plan covering the 15 requirements, and the artifact library (screenshots, configuration exports, training records) that supports your self-assessment.
- Weeks 6-8: Self-assessment and SPRS affirmation. We run the self-assessment with you, walk through each practice and the evidence, and prepare the senior official affirmation for submission to SPRS. The affirmation is your signature, not ours, but we make sure what's being signed is real and defensible.
- Ongoing: Annual maintenance. Level 1 requires annual affirmation. The controls have to keep running, the artifacts have to keep accumulating, and the affirmation has to be renewed. Our managed clients keep the controls running daily, and we run the annual self-assessment as a documented review each year so the affirmation is a 30-minute conversation, not a six-week scramble.
Why McNallan Technology Solutions vs. a compliance-only consultant
Two paths exist for CMMC Level 1 in Minneapolis. You can hire a compliance consultant who writes you a policy set and walks away, leaving your existing IT provider to figure out how to actually run the practices. Or you can engage a firm that delivers the IT and security stack, so the controls and the documentation move together.
The first path tends to produce the same result. A binder of policies, a System Security Plan describing a clean environment, and a real environment that doesn't match it, because the consultant doesn't run IT and your generalist MSP doesn't operate Level 1-grade controls. The affirmation gets signed, and the contractor is exposed to a False Claims Act risk if a prime contractor ever asks for evidence.
The second path is what we do. We run the IT and security program as your managed services provider, we deploy the controls, and we document them in a form that matches operational reality. The annual affirmation is a confirmation of what's been running all year, not a wish list.
If you already have an IT provider you're keeping, we can still help with the consulting piece, but we'll be candid about the gaps in their environment and what it'll take to close them. A self-assessment that doesn't match reality is worse than no affirmation at all.
FAQ
Common questions about CMMC Level 1
How long does CMMC Level 1 readiness take?
Six to twelve weeks from kickoff to SPRS affirmation for a typical small Minneapolis contractor.
For a typical small Minneapolis contractor (one office, modest IT environment), six to twelve weeks from kickoff to SPRS affirmation. Larger environments, multiple sites, or significant remediation needs can extend that to four months.
Do I need a third-party assessor (C3PAO) for Level 1?
No. CMMC Level 1 is annual self-assessment with a senior official affirmation submitted to SPRS.
You do not engage a C3PAO. A senior official of your organization signs the affirmation under penalty of False Claims Act exposure, which is why getting the underlying compliance right matters.
What’s the difference between CMMC Level 1 and Level 2?
Level 1 covers 15 requirements for FCI. Level 2 covers 110 NIST SP 800-171 Rev 2 practices for CUI.
Level 2 is a substantially larger compliance program, and for most CUI handlers it requires a triennial C3PAO third-party assessment, not self-attestation. Your contract language, or the flow-down clause from your prime, tells you which level applies.
What happens if I sign an affirmation and I’m not actually compliant?
A false SPRS affirmation creates False Claims Act exposure for the company and the signing official personally.
The 2024 Penn State settlement and the 2022 Aerojet Rocketdyne settlement both arose from misrepresenting NIST SP 800-171 compliance. Don’t sign an affirmation you can’t defend with evidence.
We already have an MSP. Can they handle CMMC Level 1?
Ask them directly: have they delivered Level 1 readiness before, and can they produce a sample SSP?
If the answer is vague, you’ll be paying them to learn on your project. CMMC Level 1 isn’t technically difficult, but it does have to be done correctly, and a generalist MSP that hasn’t worked through it before will miss things an experienced provider catches.
Get started with CMMC Level 1
If you're a Minneapolis DoD contractor handling FCI and need to be CMMC Level 1 compliant for an upcoming contract, talk to us. A 45-minute scoping call covers your contract requirements, current security posture, and what a fixed-scope readiness engagement would look like for your environment.
This is right for you if:
- You're a DoD contractor or subcontractor in Minneapolis or greater Minnesota
- Your contracts include the DFARS 252.204-7021 clause
- You handle Federal Contract Information (FCI), not CUI
- You need an annual SPRS self-assessment affirmation
- You want the controls to actually run, not just look right on paper
Not sure if Level 1 is the right target? Start with the CMMC compliance hub or read about the NIST SP 800-171 requirements behind Level 2.
Get in touch
Inquire About Our Services
McNallan Technology Solutions works best with growth-focused Minnesota businesses (25+ employees) that view technology as a productivity investment, not a cost to minimize.
Prefer a real conversation? Skip the form and call us directly during business hours.
+1 763-424-3388Working hours
Mon–Fri
Emergency
8:00 AM – 5:00 PM
24/7 on-call support
Tell us what you’re working on
Share a few details and we’ll follow up with next steps and a clear path forward.
"*" indicates required fields