If your business handles U.S. Department of Defense (DoD) contracts, you’ve likely heard about the Cybersecurity Maturity Model Certification (CMMC) framework. For many contractors, CMMC Level 1 is the first step toward compliance—but before you can implement security controls, you need to answer a critical question:

What parts of my business actually fall under CMMC Level 1?

Scoping—the process of defining which systems, people, and processes handle Federal Contract Information (FCI)—is the foundation of compliance. Get it wrong, and you could either waste resources applying controls where they aren’t needed or, worse, leave dangerous gaps that jeopardize your contracts. Before scoping your environment, you must understand the data you’re safeguarding:

Federal Contract Information (FCI): The Focus of CMMC Level 1

FCI is non-public information provided by or generated for the government under a contract. Think of procurement details, contract terms, or internal reports—anything not meant for public release.

CMMC Level 1 applies only to FCI and requires 17 basic security controls (like password policies and malware protection). If FCI is all you handle, this is your starting point.

Controlled Unclassified Information (CUI): A Stricter Standard

CUI is sensitive but unclassified data that requires stricter protections (e.g., technical blueprints, export-controlled data, or personally identifiable information).

If your contracts involve CUI, you’ll need CMMC Level 2 or higher—which means 110+ controls from NIST SP 800-171. Don’t assume Level 1 covers CUI; misclassifying data is a costly mistake.

How to Scope Your CMMC Level 1 Deployment

Step 1: Identify Where FCI Lives

Start by reviewing contracts and asking:

• Where is FCI stored (e.g., shared drives, email servers, cloud storage)?
• Who accesses it (employees, subcontractors)?
• How is it transmitted (email, file-sharing tools)?

Example: If your team uses Microsoft 365 for DoD contract emails, those accounts and devices are in scope.

Step 2: Map Your Systems

Draw boundaries around:

• In-scope systems: Hardware, software, and networks that touch FCI.
• Out-of-scope systems: Infrastructure that never interacts with FCI (e.g., HR payroll systems).

Pro Tip: Over-scoping wastes time and money; under-scoping risks compliance. Document every decision.

Step 3: Align with CMMC Level 1 Controls

The 17 controls focus on basics like:

• Access control (limiting who can see FCI)
• Malware protection (antivirus software)
• Incident response (reporting breaches)

SnapGRC Insight: Our platform auto-maps your assets to CMMC controls, so you can see gaps at a glance.

Step 4: Assess and Fix Gaps

Conduct a self-assessment (or use a tool like SnapGRC to automate it).

Remediate weaknesses (e.g., enabling multi-factor authentication).

Step 5: Maintain Compliance

CMMC isn’t one-and-done. Regularly:

• Review access logs.
• Update policies.
• Train employees.

SnapGRC Advantage: Our system tracks compliance in real time and alerts you to lapses.

3 Common CMMC Scoping Mistakes (and How SnapGRC Helps Avoid Them)

1. Assuming CUI Falls Under Level 1

Risk: Failing to meet stricter Level 2 requirements.
Fix: Classify data early. SnapGRC’s workflow guides you through this process.

2. Overlooking Subcontractors

Risk: Third-party vendors handling FCI can create compliance gaps.
Fix: Use SnapGRC to manage vendor risk assessments and document their compliance.

3. Poor Documentation

Risk: Auditors demand proof of controls.
Fix: SnapGRC auto-generates audit-ready reports, so evidence is always on hand.

How SnapGRC Simplifies CMMC Compliance

Manually scoping and tracking compliance is tedious and error-prone. SnapGRC’s platform helps by:
✔ Mapping controls to CMMC requirements with pre-built frameworks.
✔ Generating real-time compliance dashboards to track progress.
✔ Preparing audit-ready documentation with a few clicks.

Final Thoughts

Scoping CMMC Level 1 doesn’t have to be overwhelming. By leveraging tools like SnapGRC, you can streamline compliance—and focus on winning contracts, not paperwork.

Need help getting started?