CMMC L1 - Base Camp
A CMMC Level 1 readiness engagement for organizations with DFARS 252.204‑7021 requirements.
Know where you stand, and know what needs to happen next.
- Offer
- CMMC L1 - Base Camp
- Engagement type
- CMMC Level 1 readiness assessment, 30 days
- Applies to
- Organizations carrying DFARS 252.204‑7021 in a current or pursued contract
- Investment
- $7,000 fixed fee
- Prepared by
- Sam Baker, Summit Cyber, LLC
In 30 days you’ll know exactly what’s in scope for your CMMC Level 1 assessment, how your organization measures against all 15 requirements, and what has to happen before your Affirming Official signs. The diagrams, the Gap Assessment Report, and the Plan of Action and Milestones (POA&M) document all of it.
Why this exists now
If your organization has DFARS 252.204‑7021, the contract clause that carries the CMMC requirement, in an existing contract or in a contract you’re pursuing, a CMMC Level 1 requirement can become a contract timing problem quickly. Base Camp is designed to give the Affirming Official, most commonly the CEO, a clear picture of the current security profile, the gaps, and what needs to happen next.
We don’t start by guessing at what needs to be fixed. We first determine what actually belongs in the assessment.
Here’s how it works
Scope
We determine the assessment boundary, identify which assets process, store, or transmit Federal Contract Information (FCI) and are therefore in scope, and build the diagrams.
Milestone. Defined assessment boundary, documented in-scope assets, and three diagrams.
Assess
We assess the defined scope against the 15 CMMC Level 1 requirements in FAR 52.204‑21, which appears as FAR 52.240‑93 in solicitations issued since February 1, 2026.
Milestone. Current security profile and identified gaps.
Document
We generate and deliver the Gap Assessment Report and the POA&M.
Milestone. Documented gaps and a clear path toward the target profile.
What you get
- Assessment scoping and a defined assessment boundary
- Identification of in-scope and out-of-scope assets
- Data Flow Diagram
- Network Diagram
- Assessment Boundary Diagram
- A CMMC Level 1 assessment of the defined scope
- Gap Assessment Report
- Plan of Action and Milestones (POA&M)
Timeline. 30 days from kickoff to delivery of the Gap Assessment Report and the POA&M.
From roadmap to readiness
Base Camp gives you more than a list of gaps. The deliverables provide a strategic roadmap for what needs to happen next.
Based on that roadmap, Summit Cyber can perform the remediation, collect the evidence needed to demonstrate that the requirements have been addressed, and perform your CMMC Level 1 self-assessment. You receive a scorecard showing your assessment results and the documentation that supports your self-assessment, so you have the clarity and the confidence to affirm your CMMC status.
Base Camp shows you what needs to happen, and Summit Cyber can help you do the work and produce the evidence behind it.
Why Summit Cyber
Summit Cyber is a cybersecurity governance, risk, and compliance advisory firm specializing in CMMC, ISO 27001, ISO 42001, and SOC 2. CMMC Level 1 readiness is a defined service here, not something assembled from scratch for each client.
Your engagement is led by a CMMC Certified Assessor who also serves as a contracted Assessment Team Member supporting C3PAOs, performing evidence adequacy and sufficiency review and practice scoring from the assessor side of the table. Your scope and your evidence get reviewed the way an assessor would review them, while there’s still time to fix what’s missing.
That’s backed by 15 years across information technology, cybersecurity, and telecommunications, and by standardized toolsets mapped to 32 CFR Part 170 and the CMMC Assessment Guides, so what you receive is repeatable and defensible rather than improvised.
The goal isn’t to make CMMC sound more complicated than it is; it’s to give you a clear picture of where your organization stands so you can make the right decisions about what happens next.
Is this the right fit?
Your organization has DFARS 252.204‑7021 requirements in an existing contract or a contract you’re pursuing.
You need a clear understanding of your CMMC Level 1 assessment scope and current security profile.
Contract timing makes it important to know what needs to happen next.
Your organization doesn’t have the DFARS 252.204‑7021 requirement.
Investment
| Service | Basis | Amount |
|---|---|---|
| CMMC L1 - Base Camp | Fixed fee | $7,000 |
If DFARS 252.204‑7021 is in a contract you hold or one you’re pursuing, the next step is a short conversation about your requirement, where you are today, and what getting to a completed self-assessment looks like for your organization.
Start the conversation