§01 · CMMC LEVEL 1

CMMC Level 1, Done Right Every Year

If your contracts involve Federal Contract Information, you need CMMC Level 1: a self-assessment against 15 safeguarding requirements, submitted in SPRS every year with an affirmation from a senior official.

Our CMMC Certified Assessors review your self-assessment the way an assessor would, so your score is accurate and your affirmation holds up.

Talk to a Certified Assessor See the 15 requirements

FILE 01-L · LEVEL 1 AT A GLANCE

01For organizations that handle Federal Contract Information (FCI), not CUI.
0215 basic safeguarding requirements from FAR 52.204-21, all of them met.
03A self-assessment every year, submitted in SPRS, plus an annual affirmation.
04No POA&Ms, and records kept for six years.

32 CFR § 170.15 · FAR 52.204-21

§02
FIELD NOTE

Level 1 looks like the easy level, and in scope it is. But there’s no partial credit: with no POA&Ms allowed, every requirement has to be met before you submit. Every year, someone senior signs a statement to the government that all 15 are in place.

§03
THE 15 REQUIREMENTS

All 15 CMMC Level 1 requirements, in plain language.

They come from FAR 52.204-21, the basic safeguarding clause, grouped here by the CMMC domain each one falls under.

AC · 4

Access Control

Only authorized people, processes, and devices can get into your systems.
People can only do what their role allows.
Connections to outside systems are checked and limited.
Nothing that contains FCI is posted on public-facing systems.

IA · 2

Identification & Authentication

Every user, process, and device is identified.
Identities are verified, for example with passwords or MFA, before access is granted.

MP · 1

Media Protection

Media that held FCI is sanitized or destroyed before disposal or reuse.

PE · 2

Physical Protection

Physical access to systems and equipment is limited to authorized people.
Visitors are escorted and monitored, physical access is logged, and keys and badges are controlled.

SC · 2

System & Communications Protection

Traffic at your network boundaries is monitored and controlled.
Public-facing systems sit on a network separated from your internal one.

SI · 4

System & Information Integrity

Flaws are found, reported, and fixed promptly, including patching.
Malware protection is in place where it’s needed.
Malware protection is kept up to date.
Systems are scanned periodically, and files from outside are scanned as they’re opened.

Paraphrased from FAR 52.204-21(b)(1). Your self-assessment uses the NIST SP 800-171A objectives for each requirement, with FCI in place of CUI.

§04
WHAT IT COSTS

How much does CMMC Level 1 cost?

It depends far more on what’s already in place than on the assessment itself. Assessing and affirming is the small part; getting all 15 requirements in place is where the work is.

The requirements aren’t new. They’ve been in contracts through the FAR basic safeguarding clause since 2016, and the Department of Defense’s own cost analysis for the CMMC rule assumes they’re already in place. If they are, the annual self-assessment and affirmation is a modest, repeatable task. If they aren’t, closing the gaps comes first.

What moves the cost of CMMC Level 1 for your organization:

Your current security maturity. If basic hygiene is already in place (antivirus, updates, strong passwords, MFA), the cost stays low. Writing policies or upgrading firewalls from scratch is where it grows.
How far FCI spreads. More systems, locations, and people in scope mean more to assess.
Your evidence. Each requirement needs proof, not just a yes.
In-house or with help. Some organizations run the self-assessment themselves; others want a Certified Assessor to review it so the affirmation holds up.
Tools. Level 1 rarely needs a dedicated enclave or specialized software. Standard business tools, set up correctly, usually cover it.

Want a scope and a quote for your organization? Request a custom quote.

§05
HOW WE HELP

Assessor-reviewed, so your affirmation holds up.

Our CCAs check your Level 1 self-assessment the way an assessor would, requirement by requirement.

FCI Scoping

Identify where Federal Contract Information lives, so the assessment covers the right people, systems, and facilities.

Requirement-by-Requirement Review

Each of the 15 requirements checked against your implementation and evidence, the way an assessor would check it.

Gap Closure Guidance

Clear steps to close anything that isn’t fully met, since Level 1 doesn’t allow POA&Ms.

SPRS Submission & Annual Affirmation

Support entering your results in SPRS and preparing your Affirming Official to affirm, then repeating the review every year.

§06
EVERY YEAR

The Level 1 cycle, year after year.

Scope

Confirm where FCI lives and which systems, people, and facilities are in scope.

Assess all 15

Check each requirement against your implementation and evidence, and close any gaps.

Submit & affirm

Enter your results in SPRS and have your senior official affirm.

Repeat yearly

Keep evidence current through the year, and keep records for six years.

Step by step: how to run your Level 1 self-assessment. What your senior official signs each year: the annual CMMC affirmation, explained. Want this handled every year? See Continuous Compliance. Not sure Level 1 is right? Take the three-question CMMC level check.

COMMON QUESTIONS

01How much does CMMC Level 1 cost?

It depends mostly on what you already have in place. The annual self-assessment and affirmation is a modest internal task; the Department of Defense’s own cost analysis for the CMMC rule treats it that way because it assumes the 15 requirements are already implemented. The real cost is closing any gaps first, which depends on your current security maturity, how far FCI spreads across your systems, and whether you want an assessor’s review. Request a custom quote for your organization.

02Is CMMC Level 1 a certification?

No. Level 1 is a self-assessment. Your organization assesses itself against the 15 requirements every year, submits the result in SPRS, and a senior official affirms it. No C3PAO is involved.

03Can we use a POA&M for Level 1?

No. POA&Ms are not permitted at Level 1. Every one of the 15 requirements must be met before you submit your self-assessment and affirm.

04Did the Phase 2 pause change anything for Level 1?

No. The suspension paused the C3PAO certification requirement for Level 2. Level 1 self-assessments, SPRS submissions, and annual affirmations still apply.

05How long do we keep our Level 1 records?

Keep the artifacts that support your self-assessment for six years from your CMMC Status Date.

06How do we know if we need Level 1 or Level 2?

It follows the information you handle. Federal Contract Information only points to Level 1; Controlled Unclassified Information points to Level 2. Our three-question CMMC level check is a quick way to find out.

§07
NEXT STEP

Get your Level 1 right the first time.

Talk to a Certified Assessor about your FCI, your 15 requirements, and your next affirmation.

Thirty minutes. No obligation.

CONSULTATION REQUEST · FORM 01A