Level 1 is fifteen safeguards and a signature
If your firm works on a DoD contract and handles federal contract information but no controlled unclassified information, CMMC Level 1 is the level that fits. It asks for 15 basic safeguards, an annual self-assessment, a result entered in the Supplier Performance Risk System (SPRS), and a senior official's affirmation that all of it is true.
The work is modest and the standard is strict. Every requirement has to be met, there is no partial score, and the person who signs is making a statement to the government. This guide takes the 15 in order, says what evidence shows each one is met, and then walks through the annual cycle.
Where the 15 requirements come from
The requirements are the fifteen items at FAR 52.204-21(b)(1), Basic Safeguarding of Covered Contractor Information Systems. That clause defines federal contract information, or FCI, as information not intended for public release that is provided by or generated for the Government under a contract to develop or deliver a product or service. Information the Government gives the public and simple transactional information, such as what is needed to process payments, are excluded.
CMMC assesses those items with the objectives in NIST SP 800-171A, reading FCI wherever an objective says CUI. The rule maps the 15 items to 17 NIST requirements, because item ix splits into three phrases. The FAR Overhaul deviation text prescribes a clause with the same title at 52.240-93, while the CMMC rule still cites 48 CFR 52.204-21, so check which number your contract carries.
Level 1 is unaffected by the pause in the program. On July 13, 2026, DoD suspended Phase 2 and later milestones, and Phase 1 self-assessment requirements remain in force. As of early November 2026, no restart date has been announced.
Set the scope before you touch the checklist
The rule requires you to specify your scope before you assess. Information systems that process, store or transmit FCI are in scope, and you should consider the people, technology, facilities and external service providers that handle it. Systems that do none of those things are out of scope and carry no documentation requirement.
Two carve-outs keep the scope small. Specialized Assets, a category that includes operational technology, Internet of Things devices, government-furnished equipment and test equipment, are not part of the Level 1 scope. An endpoint running a virtual desktop client configured to allow nothing beyond keyboard, video and mouse is out of scope as well.
Take a 40-person machine shop that receives purchase orders by email and keeps them on a file server. Its scope is the email system, the file server, the office PCs that open those files and the network between them. A CNC controller that counts as operational technology stays outside. Write the result on one page, because SPRS asks you to state your scope.
The 15 requirements and the evidence for each
The middle column restates each FAR item in plain terms. The right column lists evidence that shows it working today.
| FAR item | What it asks | Evidence that shows it |
|---|---|---|
| (i) | Only authorized people, processes and devices get in | Current account list reconciled to the employee roster; device list |
| (ii) | People can do only what their job permits | Role or group assignments; a standard user blocked from admin settings |
| (iii) | Connections to outside systems are verified and controlled | List of outside systems in use and the rule for each |
| (iv) | FCI stays off public websites and social accounts | Named reviewer and a log of content reviewed before posting |
| (v) | Every user, process and device is identified | Unique account per person; device inventory |
| (vi) | Identity is verified before access | Sign-in policy settings for each system in scope |
| (vii) | Media holding FCI is sanitized or destroyed before disposal or reuse | Disposal log or destruction certificates |
| (viii) | Physical access to systems and equipment is limited | Locks, badge list and a floor plan showing where systems sit |
| (ix) | Visitors are escorted and monitored, physical access is logged, keys and badges are managed | Visitor log, written escort rule, key or badge register |
| (x) | Communications are monitored and protected at external and key internal boundaries | Firewall rule export and a network diagram |
| (xi) | Public-facing components sit on a separated subnetwork | Diagram showing separation, or a record that no public system is in scope |
| (xii) | Flaws are identified, reported and corrected in a timely manner | Recent patch report and your stated patching timeline |
| (xiii) | Malicious code protection runs at appropriate locations | Endpoint console showing every in-scope device covered |
| (xiv) | That protection updates when new releases are available | Console showing current versions or the automatic update setting |
| (xv) | Periodic scans run, and files from outside are scanned in real time | Scan schedule and the real-time scanning setting |
Item xi is the one a small firm may legitimately mark not applicable. The scoring rule treats a requirement that does not apply as equivalent to met, and it names public-access separation as its example where no publicly accessible system is in scope. A website hosted elsewhere and holding no FCI usually fits that description. Record the reasoning.
Where small firms usually come up short
- A shared login at the front desk or on the shop office PC, which fails items v and vi
- An account still active for someone who left, which fails item i
- A visitor log with no escort rule, which satisfies only part of item ix
- Old drives in a closet with no record of what became of them, which leaves item vii unproven
- Work email forwarded to a personal account, an outside connection nobody approved under item iii
- Antivirus on most machines, when items xiii through xv cover every device in scope
Level 1 allows no POA&M
The rule is direct: "A POA&M is not permitted at any time for Level 1 self-assessments." Results are scored as met or not met in their entirety, and all Level 1 requirements must be fully implemented to count as met. Level 2 can reach a conditional status with some items open. Level 1 cannot, and the DFARS text in the current class deviation says a final Level 1 status is required for award.
The practical effect is sequence. Fix first, test second, sign last. There is no partial credit at Level 1, and a gap you know about has to be closed before anyone signs.
There is no partial credit at Level 1, and a gap you know about has to be closed before anyone signs.
Running the annual self-assessment
A firm with a settled environment can treat this as a short yearly project with one named owner.
- Confirm the scope still matches reality: new systems, new locations, new cloud services, new providers
- Test each item against its NIST SP 800-171A objectives, reading FCI in place of CUI
- Collect evidence in final form, since the scoring rule does not accept working papers, drafts or unofficial or unapproved policies
- Fix anything not met, then test it again
- Store the evidence where you can find it, because artifacts must be kept for six years from the CMMC Status Date
- Enter the results in SPRS and have the Affirming Official affirm them
What goes into SPRS
The rule lists five items at minimum: the CMMC level, the CMMC Status Date, the CMMC Assessment Scope, all CAGE codes associated with the systems in that scope, and the compliance result. The self-assessment must be repeated and entered annually to keep the status.
When DFARS 252.204-7021 is in your contract, it adds two duties. You give the contracting officer the CMMC unique identifier that SPRS issues for each system used in performance, along with any changes. You also keep a current self-assessment and a current affirmation in SPRS for each identifier.
The affirmation and the person who signs it
The Affirming Official is the senior level representative responsible for the firm's compliance, with authority to affirm it. The affirmation carries that person's name, title and contact information, and states that the firm has implemented and will maintain all applicable requirements for every system in scope. It is due at the completion of the self-assessment and annually after that.
Note the words "will maintain." A signature covers the coming year as well as the day it is made. Before signing, the official should see the evidence for all 15 and ask who is responsible for keeping each one true until the next cycle.
When Level 1 is no longer enough
Level 1 covers FCI only. If your firm will process, store or transmit CUI under a subcontract, Level 2 (Self) is the minimum the rule allows. Drawings and specifications are a common way this happens: technical information with a military or space application that is subject to distribution controls is controlled technical information, which is CUI under the DFARS. Read the markings on what your customers send before you settle on Level 1.
Frequently asked questions
No. Level 1 is a self-assessment, and the status is Level 1 (Self). Outside help with preparation is allowed, but the result and the affirmation belong to your firm.
You cannot post a plan of action and claim the status. A solicitation that requires Level 1 needs a current final status at award, so the item has to be closed and the assessment completed first.
Every year. The self-assessment and the affirmation are both annual. Treat any significant change to your systems as a reason to look again sooner.
It applies to a subcontractor that will process, store or transmit FCI in performance of the subcontract. The clause excludes purchases of commercially available off-the-shelf items, so a supplier shipping catalog goods with no FCI on its systems is outside it.