" /> CMMC Level 1 Gap Analysis Tool 2026: free 17-practice self-assessment
Veiledning

CMMC Level 1 Gap Analysis Tool: Free Self-Assessment of the 17 Practices (2026)

Free CMMC Level 1 gap analysis: 17 questions on FAR 52.204-21, a readiness score, the practices you would fail and what fixes each one with a price. Four minutes, before you affirm in SPRS.

Oppdatert · okt 2026 By ITSECOPS Gratis · Ingen påmelding

Free tool · Updated 6 October 2026

In short: Free CMMC Level 1 gap analysis: 17 questions on FAR 52.204-21, a readiness score, the practices you would fail and what fixes each one with a price. Four minutes, before you affirm in SPRS.

Since the CMMC rule took effect, Level 1 contractors self-assess every year and a senior official affirms the result in SPRS under 32 CFR 170.22; a false affirmation is a False Claims Act exposure, and the 2026 settlements show the DOJ is using it. Class Deviation 2026-O0025 Revision 3 of 3 September 2026 kept Level 1 in Phase 1 while Phase 2 is suspended, so Level 1 is the gate most primes check first.

How it works

  1. Answer 17 questions: One per practice, as counted in the CMMC Level 1 Assessment Guide (the 15 FAR requirements). About four minutes.
  2. See your score: A readiness percentage, a bar per family and the three practices you would fail today, free and without an email.
  3. Unlock the plan: The full table: fix per practice, the ITSECOPS fixed-fee price, the typical US consultancy price, and a copy by email within one business day.

Frequently asked questions

What does CMMC Level 1 cost to fix?

A 10-user FCI-only contractor typically spends $2,000 to $8,000 to reach a defensible annual self-assessment; the ITSECOPS Level 1 package (self-assessment workbook, evidence folder, affirmation record) is a fixed fee in the lower half of that range. The tool prices each practice separately so you only pay for what fails.

Do I need a C3PAO for Level 1?

No. Level 1 is an annual self-assessment with an affirmation in SPRS. ITSECOPS is a readiness consultancy, not a C3PAO, and the tool is built for the self-assessment.

Is a Partly answer a fail?

Under the assessment guide a practice is MET or NOT MET; there is no partial credit. The tool shows Partly as a gap with half the remediation cost so you can prioritise.

Does this cover Level 2?

No. Use the CMMC Level 2 gap analysis tool for the 110 NIST SP 800-171 requirements and the SPRS score calculator for your current score.

Related

CMMC Level 2 gap analysis tool · SPRS score calculator · CMMC consultants, fixed fees · CMMC compliance services · Client testimonials

Trenger du hjelp til å ta dette i bruk i din bedriftsmiljø?

Vi gjør compliance-guider om til implementerte kontroller. Snakk med en ingeniør.

Bestill en konsultasjon
Popular guides and pricingCybersecurity price comparison 2026  ·  EDR pricing per endpoint  ·  MDR pricing per device  ·  Veeam vs Acronis vs Datto  ·  Remote IT support pricing  ·  White-label help desk pricing  ·  24/7 SOC monitoring cost  ·  Top MDR providers  ·  White-label NOC and SOC for MSPs  ·  Top ISO 27001 consulting firms  ·  ISO 27001 implementation plan  ·  CMMC readiness services  ·  Top CMMC consulting firms  ·  ISO 42001 AI certification  ·  Global laptop provisioning and MDM  ·  Security stack recommender  ·  Managed IT services Norway