Level 1 [Foundational]: Applicable to defense or aerospace contractors bidding on DoD contracts handling FCI. All contractors in Level 1 must implement 17 basic cybersecurity practices to safeguard FCI. If the FAR 52.204-21 Requirement is in your current contracts, you are most likely in the CMMC Level 1 category