CMMC Level 1 Free Assessment
DoD contracts require CMMC L1 self-assessment starting November 15, 2025. Upload your policies, let Certi map evidence to all 15 FAR 52.204-21 controls, and export your attestation—all free.
✓ No credit card required ✓ Complete in 60-120 minutes ✓ Export attestation letter
What you need to do
Sign up
Create free account. No payment info required.
Upload policies
Security policy, access controls, incident response procedures.
Complete assessment
Answer questions for 15 controls. Certi auto-maps evidence.
Export attestation
Download signed PDF for contracting officers.
15 controls you must implement
Access Control (AC)
Limit system access to authorized users, functions, and devices. Control external connections.
Identification & Authentication (IA)
Identify and authenticate all users before allowing system access.
Media Protection (MP)
Sanitize or destroy media containing CUI before disposal or reuse.
Physical Protection (PE)
Limit physical access to systems and facilities processing CUI.
System & Communications (SC)
Monitor, control, and protect organizational communications at system boundaries.
Maintenance (MA)
Perform and control system maintenance with proper tools and procedures.
Frequently asked questions
What happens if I miss the deadline?
You cannot bid on DoD contracts that include FAR 52.204-21 (most defense contracts). Contracting officers require proof of L1 completion.
Is self-assessment enough or do I need a C3PAO?
Level 1 only requires self-assessment. No third-party assessor needed. You complete the assessment and submit attestation with your bid. Only L2+ requires C3PAO certification.
How long does the assessment take?
60-120 minutes for most contractors. Upload your policies, answer 15 control questions, let Certi map evidence automatically, then export your attestation.
What documents do I need?
Security policy, access control procedures, incident response plan, media sanitization policy, and any existing evidence of control implementation (screenshots, logs, procedures).
Is ReadyCheck really free for L1?
Yes. CMMC Level 1 (15 controls) is free forever. No credit card required. No trial period. Upgrade only if you need Level 2 (110 controls) or advanced features like SSP generation.
What's the difference between L1, L2, and L3?
L1 = 15 basic controls (FAR 52.204-21). L2 = 110 controls (NIST 800-171). L3 = 130+ advanced controls for classified work. Most SMB contractors only need L1 to start bidding.