CMMC Level 1 · FAR 52.204-21
If your company handles Federal Contract Information, you must meet 15 security requirements and affirm them in SPRS every year. Fix&Affirm walks you through each one in plain English, shows exactly what to fix, and gives you the documents to stand behind your affirmation. $97 a year, everything included.
Why it matters now
CMMC took effect in DoD contracts on November 10, 2025. For most small contractors, that means a Level 1 self-assessment.
Under DFARS 252.204-7021, a contracting officer can require a current CMMC Level 1 self-assessment in SPRS before awarding a contract that involves Federal Contract Information, and you must keep it current for the life of the contract.
Your company affirms in SPRS that it meets all 15 requirements, and a senior official repeats that affirmation every year. Level 1 is pass or fail: no partial credit, and no plan of action to cover open gaps.
The Justice Department's Civil Cyber-Fraud Initiative uses the False Claims Act against contractors that misrepresent their cybersecurity. An honest, documented self-assessment is your best protection.
How it works
Each of the 15 FAR 52.204-21 requirements is broken into simple yes or no checks that follow the official assessment objectives. No jargon, no IT degree required.
Every “no” comes with practical steps written for small shops, so you know exactly what to change before you affirm.
Get one professional PDF with your report, System Security Plan, policies, remediation plan and the exact values to enter in SPRS.
Your document pack
One professionally formatted PDF, branded with your company details, that records what you assessed and how you meet each requirement. Keep it on file for your affirming official, your prime contractor, or a government review.
Your result on every requirement and assessment objective, with the evidence you described.
How your company meets each requirement, in one place for your affirming official.
Each open gap with the steps to close it, an owner and a target date.
The exact values to enter in SPRS, and the steps to record your affirmation.
Also included: written security policies covering all 15 requirements.
Pricing
$97 a year, everything included. Start for free and pay only when you want the fixes, the documents and the year-round tools. No consultants, no contracts and no surprises.
Free checklists record gaps. Fix&Affirm closes them and keeps you compliant all year.
Free
$97a year, renews annually
Level 1 is a yearly obligation, so Fix&Affirm is priced by the year, at a fraction of the usual cost.
DoD figure from the cost analysis in the CMMC Program final rule (32 CFR Part 170). Other ranges are typical published prices from consultants and template vendors as of October 2026.
Who it is for
Fix&Affirm never connects to your computers or network. We do not ask for passwords or Controlled Unclassified Information, and your answers are only visible to you when you sign in.
Questions follow the 15 requirements of FAR 52.204-21(b)(1) and the assessment objectives in the DoD CMMC Level 1 Assessment Guide, and the results use the same terms you will see in SPRS.
Where your data lives and how we protect itQuestions
Level 1 applies when you handle Federal Contract Information (FCI): information the government provides or generates under a contract that is not intended for public release. If your contract also involves Controlled Unclassified Information (CUI), you need Level 2. Your contract or your prime contractor will tell you which level applies.
No. FederalShield is an independent company. Fix&Affirm helps you prepare an accurate, documented self-assessment; your company still records the results and the affirmation in SPRS itself, and remains responsible for them.
No. Nothing is installed and nothing connects to your systems. You answer questions about how your company works. We never ask for passwords or Controlled Unclassified Information.
Mark it not applicable and explain why. Not applicable counts as met at Level 1, and your explanation is carried into the documents.
Level 1 does not allow a plan of action, so every requirement must be met before you affirm. Fix&Affirm shows exactly what to fix, and you can update your answers as you go and download a fresh document pack when you are done.
Most small companies can answer all 15 requirements in an afternoon. You can save and come back at any time.
Starting is free: answer all 15 requirements and see your result. The step-by-step fix guides, document pack, evidence storage and reminders are $97 per year, paid securely through Stripe, with a 30-day money-back guarantee. You can cancel at any time from your account.
$97 a year, everything included. Start free, and save and come back at any time.
Training
Self-paced training that helps public sector teams use AI safely: protecting sensitive data, stopping shadow AI, and recognizing AI-driven fraud.
Public sector track
For federal, state and local government employees. Self-paced and interactive, with a certificate on completion.
FederalShield has signed the Cloud Security Alliance AI Trustworthy Pledge, a public commitment to safe, transparent, ethical and privacy-respecting use of AI. It is a pledge, not a certification or audit.
Get in touch
Not sure whether CMMC applies to you, what Level 1 asks for, or how Fix&Affirm works? Send us a message and a person will answer.