In-kind grant · Sponsored by Capital Cyber Compliance
CMMC Level 1 Gap Assessment Grant
The CMMC Level 1 Gap Assessment Grant provides an in-kind assessment for defense contractors verifying compliance with the 15 basic safeguarding requirements of CMMC Level 1. This grant is designed for small businesses new to CMMC that need to confirm they meet foundational requirements before pursuing higher certification levels. Sponsored by Capital Cyber Compliance, the grant delivers an in-kind evaluation covering all 6 Level 1 control families at no cost to the recipient.
This grant is designed for small and medium-sized businesses in the DoD supply chain that handle Federal Contract Information (FCI) and need to understand their CMMC Level 1 compliance posture. Recipients receive an in-kind Level 1 gap assessment that evaluates all 15 basic safeguarding requirements of FAR 52.204-21, covering the 6 Level 1 control families.
Grant at a glance
- 15 CMMC Level 1 Requirements Evaluated
- 6 Control Families Assessed
- 100% In-Kind Grant for Qualified Contractors
Sponsor: Capital Cyber Compliance.
Quick answers
Level 1
What is CMMC Level 1?
Level 1 covers the 15 basic safeguarding requirements of FAR 52.204-21, across 6 control families, and protects Federal Contract Information (FCI). Under 32 CFR 170.15 it is met through an annual self-assessment and affirmation.
Phase 2
Does the Phase 2 pause change Level 1?
No. On July 13, 2026, DoD paused the CMMC rollout and suspended Phase 2, pending a 60 day review by its CIO. Level 1 and Level 2 self-assessments, SPRS and the annual affirmation still stand.
SPRS
Where does the self-assessment go?
Your Level 1 results and the affirmation are entered in the Supplier Performance Risk System (SPRS). A senior official affirms compliance, and a false affirmation carries False Claims Act risk.
Why now
Why a gap assessment before I affirm?
To affirm Level 1 you must meet all 15 requirements. A gap assessment shows which requirements you meet and which you do not, before anyone signs.
This grant
What does this grant include?
It includes a full evaluation of all 15 CMMC Level 1 requirements, gap identification, and a prioritized list of compliance gaps by severity. The written report, remediation roadmap, POA&M and SPRS support are not included; remediation help is available separately from Capital Cyber Compliance.
Other help
What other help is there?
Cyber Grants Alliance runs other cybersecurity grant programs, including the CMMC Level 2 Gap Assessment Grant if you handle CUI, the GSA Gap Assessment Grant and the Penetration Testing Grant (not currently available). For programs run by states and manufacturing extension centers, see the list of state CMMC grant programs.
What the grant covers
A focused readiness check for small DoD suppliers whose obligation tops out at Level 1. We show you where you stand so you can complete the annual self assessment and affirmation with confidence.
Included
- Full evaluation of all 15 CMMC Level 1 requirements
- Technical infrastructure review of how you handle FCI
- Policy and procedure assessment
- Operational practices evaluation
- Gap identification across all 6 Level 1 control families
- Prioritized list of compliance gaps by severity
- A clear picture of your self assessment readiness
Not included
- Detailed written assessment report
- Remediation roadmap
- Plan of Action and Milestones (POA&M)
- SPRS submission and affirmation support
Who is this for?
CMMC Level 1 is the floor for doing business with the Department of Defense. If you handle Federal Contract Information but not Controlled Unclassified Information, this is your tier.
Defense Industrial Base (DIB) Contractors
Companies in the defense supply chain that handle FCI and need to meet the Level 1 baseline under FAR 52.204-21.
Small and Mid-Size Manufacturers
Manufacturers and subcontractors supplying DoD work who do not handle CUI and need to confirm their Level 1 compliance posture.
Government Contractors
Businesses pursuing or renewing federal contracts that require demonstrated cybersecurity compliance at the Level 1 baseline.
Suppliers and Subcontractors
Any supplier providing services or products into the DoD supply chain beyond purely commercial off the shelf items.
Not a fit for a CMMC grant?
If your business does not qualify for a CMMC gap assessment grant, you can apply for the Pen Testing Grant instead: an in-kind penetration test, sponsored by Capital Cyber.
How it works
From application to assessment completion in four simple steps.
Apply online
Complete the grant application form. We review eligibility based on your business size, industry and compliance needs.
Grant approval
Once approved, you are connected with an independent certified assessor who coordinates the assessment timeline with your team.
The Level 1 assessment
Your environment is evaluated against all 15 CMMC Level 1 requirements of FAR 52.204-21, across the 6 Level 1 control families: infrastructure, policies and procedures.
Results and next steps
You receive your gap identification with prioritized findings, ranked by severity. You will know exactly where you stand and what to focus on next.
Frequently asked questions
What is a CMMC Level 1 Gap Assessment?
It is a structured review of your environment against the 15 requirements that make up CMMC Level 1. It shows you which practices you already meet and which ones you do not, so you can prepare for your annual self assessment and affirmation with confidence.
Who needs CMMC Level 1?
Almost every company in the DoD supply chain. If you generate or handle Federal Contract Information under a government contract and you are not selling purely commercial off the shelf products, you must meet at least Level 1.
What is the difference between Level 1 and Level 2?
Level 1 protects Federal Contract Information with 15 requirements and an annual self assessment. Level 2 protects Controlled Unclassified Information with 110 NIST SP 800-171 controls. If you do not handle CUI, Level 1 is your requirement. If you do handle CUI, see the CMMC Level 2 Gap Assessment Grant.
How much does this grant cost?
This assessment is provided as an in-kind grant for qualifying small and medium-sized businesses. There is no cost to you for the gap assessment itself. The grant covers an in-kind assessment service. Additional services such as the detailed written report and remediation roadmap are available separately.
Why are the detailed report and remediation roadmap not included?
This grant covers the assessment itself so you can see your gaps clearly. The written report, remediation roadmap, and hands-on support are available as paid services if you want help closing the gaps identified.
How long does the Level 1 assessment take?
Most Level 1 assessments are completed quickly because the scope is focused on 15 requirements. Your assessor will confirm timing after approval, typically within one to two weeks depending on your organization's size and availability.
Apply
Apply for the CMMC Level 1 Gap Assessment Grant
Ready to start? Please provide accurate information about your organization. All fields are required.
What happens after you submit
- We review your application within 5 to 7 business days.
- Once approved, you are connected with an independent certified assessor who coordinates the assessment timeline with your team.
- Your environment is evaluated against all 15 CMMC Level 1 requirements, and you receive your gap identification with prioritized findings.
If your contracts involve Controlled Unclassified Information, explore the Level 2 Gap Assessment Grant instead.
Disclosure: This grant is sponsored by Capital Cyber Compliance through the Cyber Grants Alliance grant program. Grant recipients may be contacted by the sponsoring organization.
Already a grant recipient? Leave a short video testimonial
Ready to apply?
Apply for your in-kind CMMC Level 1 Gap Assessment today. Limited availability for qualifying small and medium-sized businesses.
Or email info@cybergrantsalliance.org or call +1 (888) 323-9991