CMMC & CPCSC Level 1
One friendly check gives you two clear readiness views. Federal Contract Information (FCI) is non-public information connected to a U.S. government contract. Specified Information (SI) is sensitive, non-classified Government of Canada information a supplier must protect. Answer in everyday business language and we will show you what is already working for each program.
See what is working—and what to strengthen next
You do not need to be a cybersecurity expert. Choose the answer that feels closest to how your business works today. We will quietly map each answer to both frameworks and keep the technical references tucked away unless you want them.
- Build on the work you have already done. Recognize the everyday safeguards that are already helping protect contract information.
- Turn uncertainty into a clear next step. See which gaps deserve attention first without getting buried in compliance language.
- Leave with a practical starting point. Receive a report you can use to guide a calm, focused conversation with your team.
Why might my two scores be different?
Most safeguards overlap, so the same policies, settings, and records can often support both programs. CPCSC combines some related checks into a single control, and it also requires multi-factor authentication for both standard and privileged accounts. MFA is not a CMMC Level 1 requirement.
CMMC and CPCSC remain separate programs: they protect different information, use different portals, and require their own scope and self-attestation. This report helps you reuse good work without assuming that one result automatically satisfies the other.
Your next steps are ready
Share a few business details to receive one practical report with separate CMMC and CPCSC Level 1 results. If you want to edit your answers, click the “Back to questionnaire” button.
This self-assessment is an indicative starting point, not a formal assessment, certification decision, or guarantee.