Small defense contractors are the highest-value, lowest-defended targets in the supply chain — and the CMMC rule (32 CFR Part 170) was written to fix that. SMBs handling Federal Contract Information owe CMMC Level 1 self-assessment under § 170.16; SMBs handling Controlled Unclassified Information owe Level 2 (Self-Assessment or Certification depending on the Defense Organizational Index Grouping). The threat profile and the regulatory profile have converged: the same companies adversaries are targeting are the same companies the rule now requires to demonstrate they can defend. This series walks through the Level 1 and Level 2 requirements, starting with why an SMB should expect to be a target.