Start with the obligation, then the technology
Before buying a security product, identify the solicitation, contract, or subcontract language driving the request. Record the required CMMC level, the organization and CAGE codes involved, and the work that will generate or receive Federal Contract Information (FCI). Ask the contracting party to clarify anything that is ambiguous. A customer questionnaire and an actual contract requirement can require different follow-up.
Level 1 centers on protecting FCI through the 15 safeguarding requirements in FAR 52.204-21. The organization conducts its own assessment and an authorized senior official affirms continuing compliance. Hiring an adviser can help with preparation; it does not transfer these responsibilities or create third-party Level 1 certification.
Make a small, useful first inventory
Choose one representative contract workflow. Follow an incoming nonpublic task instruction from the mailbox to a shared folder, an employee device, a printer, and the eventual response to the customer. Record the systems and people involved. Include external services and remote work locations instead of assuming that the office network is the entire environment.
This exercise is an investigation, not a final scoping determination. Specialized assets and other scoping details need their own review against the official rule. A concise diagram with confirmed boundaries is more useful than a polished diagram based on assumptions.
Turn the 15 safeguards into owned work
For each requirement, name an operational owner and ask three questions: what is actually implemented, how could we demonstrate it, and what remains unresolved? The same person may own several requirements in a small company, but ownership should still be explicit. Keep evidence in a controlled internal location and use non-sensitive references in a planning worksheet.
An open issue needs a corrective action and a follow-up check. Level 1 does not permit a POA&M as a route to a conditional status. A readiness task list is useful for managing work before an accurate self-assessment; it is not permission to declare an unmet requirement complete.
Finish with a decision meeting
Bring the scope owner, IT operator, assessment reviewer, and prospective Affirming Official together. Review unresolved questions before any government submission. Establish the assessment date and an annual review reminder, then verify the assessment record and affirmation separately in SPRS.
A useful first week ends with an agreed scope draft, 15 assigned planning records, a short gap list, and a meeting on the calendar. It does not need to end with a premature claim that the company is compliant. The readiness planner on this site helps organize those records without calculating a compliance result.