Common Cyber
CMMC Level 1 Managed Services
Level 1 is an annual obligation. The 15 safeguarding requirements have to stay in place, the evidence has to stay current, and the self-assessment and affirmation come around every year. Managed services keep all of it running between affirmations.
Our Level 1 managed services process
Four steps keep Level 1 in place year over year — assess, configure, document, and maintain.
1. Assess
We review your environment and confirm the 15 FAR 52.204-21 safeguarding requirements against how you actually operate.
2. Configure
We implement and tune the safeguarding controls so they operate correctly across your systems and workflows.
3. Document
We capture the evidence and records your annual self-assessment and SPRS affirmation rest on.
4. Maintain
We keep controls, evidence, and ownership current year over year, so each annual affirmation is ready rather than reconstructed.
What do Level 1 managed services cover?
We operate and maintain the 15 FAR 52.204-21 safeguarding requirements as an ongoing service, so the annual self-assessment is supported by evidence that is current rather than reconstructed.
- Ongoing management of the 15 safeguarding requirements
- Evidence collection and documentation upkeep
- Monitoring and control review
- Support for the annual self-assessment
- Preparation for the annual SPRS affirmation
Why does Level 1 need managing?
Level 1 self-assessments and affirmations recur annually. Between them, systems change, people move, and evidence goes stale.
A self-assessment has to be true on the day it is made. Managed services keep controls, evidence, and ownership operating year-round so the next affirmation is straightforward rather than a scramble.
Who performs the work?
A CMMC Registered Practitioner (RP) on the Common Cyber team supports Level 1 managed services, alongside our federal authorization and security engineering experience.
Common Cyber is not a C3PAO and does not perform certification assessments. Level 1 involves no third-party assessor.
Can you take over from another provider?
Yes. You can enter managed services after implementing Level 1 internally, with us, or with someone else. We start from what is in place, not from what was planned.
What stays your responsibility?
You retain legal, executive, and contractual accountability for your compliance posture.
Your Affirming Official submits the annual affirmation in SPRS and is accountable for its accuracy. Common Cyber provides operating support and evidence discipline; that accountability cannot be transferred to a services provider.
Why call for a quote?
Level 1 managed services are scoped to your environment and the recurring work it requires. We price the service to what your organization actually needs rather than publishing a single figure.
Call +1 786-607-2913 or request a quote below, and we will scope Level 1 managed services to your organization.
Scoped to your environment.
Level 1 scope depends on how many people and systems touch Federal Contract Information. We scope the work and give you a quote — no single published figure.
CMMC Level 1 Managed Services
Ongoing management of your Level 1 safeguarding controls, evidence, and the annual self-assessment and affirmation cycle.
Frequently asked questions
How often does a Level 1 self-assessment recur?
Level 1 self-assessments and affirmations recur annually. These are set by the CMMC program and by your contract, not by Common Cyber.
Is this managed IT?
No. Common Cyber sustains Level 1 safeguarding controls, evidence, and oversight. It is not positioned as a general managed IT provider.
How much do Level 1 managed services cost?
The service is scoped to your environment and the recurring work it requires, so it is priced to your organization rather than published as a single figure. Call +1 786-607-2913 or request a quote.
Do you take over the affirmation?
No. Your Affirming Official submits the annual affirmation in SPRS and is accountable for its accuracy. We keep the controls and evidence current so that affirmation rests on evidence.
Discuss Level 1 Managed Services
A clear next step
Keep Level 1 current, year over year.
Managed services keep your safeguarding controls, evidence, and annual affirmation in place.
Discuss Level 1 Managed Services