Question 1

What is CMMC Level 1?

Accepted Answer

CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense program that checks whether contractors protect government information. Level 1 is the foundational level. It covers 15 basic safeguarding requirements from FAR 52.204-21, such as controlling who can access your systems, using strong passwords, keeping malware protection up to date, and limiting physical access to your equipment.

Question 2

Does my company need CMMC Level 1?

Accepted Answer

If you hold or are bidding on a DoD contract or subcontract that involves Federal Contract Information (FCI), you will likely need Level 1. FCI is information the government provides, or that you create under a contract, that is not meant for public release, such as order details, drawings, or specifications. Your contract or your prime contractor will tell you which level is required.

Question 3

What's the difference between Level 1 and Level 2?

Accepted Answer

Level 1 protects FCI, covers 15 requirements, and uses an annual self-assessment. Level 2 protects Controlled Unclassified Information (CUI), covers 110 requirements, and often requires an assessment by a certified third party. AffirmReady is built for Level 1 only. If your contracts involve CUI, you will need Level 2 support beyond what AffirmReady provides.

Question 4

What is an SPRS affirmation?

Accepted Answer

SPRS (Supplier Performance Risk System) is the DoD system where you record your Level 1 self-assessment results. A senior official at your company then affirms that you meet all 15 requirements. You access SPRS through the PIEE portal.

Question 5

How often do I have to do this?

Accepted Answer

Every year. Level 1 requires an annual self-assessment and an annual affirmation in SPRS.

Question 6

What if I don't meet every requirement yet?

Accepted Answer

At Level 1, you need to meet all 15 requirements before you affirm. Unlike Level 2, there is no allowance for open action items. AffirmReady shows you what's already in place, what's missing, and clear steps to close the gaps before you affirm.

Question 7

What does AffirmReady do?

Accepted Answer

AffirmReady walks you through the 15 Level 1 requirements in plain language with guided walkthroughs, an evidence register, policy templates, and reminders. It helps you complete your self-assessment and get ready to submit your annual SPRS affirmation. It's built for small shops, not IT departments.

Question 8

Does AffirmReady make me compliant or guarantee a contract?

Accepted Answer

No. AffirmReady is an organizational and educational tool. Compliance comes from the safeguards your company actually has in place, and any readiness summary reflects only the information you enter. Your SPRS affirmation is a legal statement made by your company, not by AffirmReady, so we recommend talking with qualified legal counsel or a cybersecurity professional before you submit it.

Question 9

Is AffirmReady a certified assessor or part of the government?

Accepted Answer

No. AffirmReady is not a CMMC Third-Party Assessment Organization (C3PAO), a Registered Provider Organization, or a government agency, and is not affiliated with or endorsed by the Department of Defense or The Cyber AB.

Question 10

I'm not an IT person. Can I still use this?

Accepted Answer

Yes. That's who we built it for. Each requirement is explained in everyday terms with clear steps, so an owner or office manager can work through it. If you have an IT provider, you can invite them into your account to help.

Question 11

Where does my evidence live?

Accepted Answer

In your own systems. AffirmReady does not store your evidence files. The evidence register records only what each item is, who owns it, when to review it, and where you keep it.

Question 12

Does AffirmReady connect to my Microsoft 365 or other systems?

Accepted Answer

No. AffirmReady never connects to, signs in to, or scans your Microsoft 365, Google Workspace, or other systems. Some plans include guided Microsoft 365 self-checks that show you how to review your own settings.

Question 13

Can I enter CUI in AffirmReady?

Accepted Answer

No. AffirmReady is designed for FCI only. Please don't enter Controlled Unclassified Information, classified information, or export-controlled data (such as ITAR or EAR data) anywhere in the app. If you handle CUI, your company likely needs CMMC Level 2.

Question 14

Can I add other people to my account?

Accepted Answer

Yes. The account owner can invite others as Owner, Editor, or Read-only, so your office manager, business partner, or IT provider can help with the work.

Question 15

What is the Readiness Check?

Accepted Answer

The Readiness Check is a free, short questionnaire at affirmready.com/readiness-check. It gives you a quick picture of where you stand on Level 1 and what to focus on first. You only need to give your email if you'd like a summary sent to you.

Question 16

How does the free trial work?

Accepted Answer

When AffirmReady launches, Core includes a 14-day free trial. You'll add a payment method at signup, and we'll remind you before the trial ends. If you don't cancel before then, your monthly subscription starts automatically and your payment method is charged the plan price.

Question 17

How does billing work?

Accepted Answer

AffirmReady is a monthly subscription at the price shown at checkout, plus applicable taxes. It renews automatically each month until you cancel. If we ever change prices, we'll give you at least 30 days' notice before it affects your next renewal.

Question 18

Can I cancel anytime?

Accepted Answer

Yes. You can upgrade, downgrade, or cancel anytime through the billing portal in your account. Cancellation takes effect at the end of your current billing period, and you keep access until then. Fees already paid aren't refundable, including for partial months, except where required by law.

Question 19

What happens to my information if I cancel?

Accepted Answer

You can export your data while your account is active and for 30 days after cancellation, after which it may be deleted. You can keep using templates and documents created in AffirmReady for your company's internal purposes, even after your subscription ends.

Question 20

How are payments handled?

Accepted Answer

Payments are processed securely by Stripe. AffirmReady never stores full card or bank account numbers.

Question 21

Is my information secure?

Accepted Answer

Every account is required to use multi-factor authentication with an authenticator app. We encrypt data in transit and at rest, and we never sell your information or use it to train AI models. Because AffirmReady doesn't store your evidence files, your most sensitive records stay in your own systems.

Question 22

How do I get help?

Accepted Answer

Email support@affirmready.com, Monday through Friday, 8 AM to 5 PM Eastern. We reply within one business day. You can also use the help bubble on any page or browse our help articles. Please don't type passwords or sensitive company information into the chat.

Frequently Asked Questions

About CMMC Level 1

About AffirmReady

Pricing, Billing, and Support