CMMC Level 1 tracking: what compliance teams still get wrong

TL;DR: Manual CMMC Level 1 assessment becomes harder to govern as requirements, evidence, and client questions accumulate across environments, according to Todyl. The compliance problem is not just documentation volume, but the absence of a repeatable control model that ties policy, evidence, and monitoring together.

Editorial analysis by NHI Mgmt Group, based on content published by Todyl: “Simplifying CMMC Level 1 with Todyl GRC”.

By the numbers:

• Todyl says CMMC Level 1 depends on 17 practices broken down across six controls.
• Todyl partners have found that implementing the platform covers nearly 50% of CMMC controls across all 3 levels.

Key questions

Q: What breaks when CMMC Level 1 compliance is tracked manually?

A: Manual tracking breaks down when evidence lives in too many places and no one can show a consistent line from practice to proof.

Q: Why does compliance evidence need identity governance as well as GRC controls?

A: Because policy and assessment records are only reliable if the right people can change them.

Q: How do you know if compliance evidence is actually current?

A: Current evidence should refresh at the same pace as the control it represents.

Practitioner guidance

• Standardise control-to-evidence mapping Create a single mapping layer that links each CMMC Level 1 practice to current policies, assessments, and monitoring outputs so reviewers do not have to reconstruct the story from separate files.
• Restrict who can edit compliance records Apply identity-based access limits to policy libraries, assessments, and supporting documentation so only authorised owners can change the material used to prove compliance.
• Use repeatable client questionnaires Replace ad hoc email follow-ups with standardised assessments that collect missing control details, capture responses in writing, and reduce version drift across client engagements.

Bottom line: The central risk is not only whether CMMC Level 1 practices exist, but whether teams can prove them consistently with governed evidence.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →