Again, the answer is “it depends”. If, like many businesses throughout the world, your organization has not prioritized cybersecurity then the answer is no. However, it is important to remember that if your organization has been contracting with the Federal Government, your organization has already been telling the government that it meets the requirements in Maturity Level 1. This is because the requirements in Maturity Level 1 are the same requirements as those in FAR 52.204-21, and FAR 52.204-21 is either explicitly required in most acquisitions or is likely to be read into them under the Christian Doctrine.