How to Do a CMMC Level 1 Self-Assessment, Step by Step
A Level 1 self-assessment checks 59 assessment objectives across 15 requirements, and one miss fails a requirement. How to scope it, what an assessor looks for in each requirement, and how to enter the result in SPRS.
A CMMC Level 1 self-assessment is something your organization does itself, every year: you check your systems against the 15 basic safeguarding requirements, enter the result in SPRS, and a senior official affirms it. No C3PAO comes in. That makes it sound simple, and the requirements themselves are basic. What catches organizations out is the method: each requirement breaks down into specific assessment objectives, and every one of them has to hold up.
Not sure Level 1 is the right level for you? Check first:
- Scope first: every person, system, and facility that handles your Federal Contract Information (FCI) is in scope, except Specialized Assets such as IoT, OT, and government-furnished equipment.
- Judge objectives, not requirements: the 15 requirements break into 59 assessment objectives, and one objective NOT MET fails the whole requirement.
- No POA&Ms at Level 1: fix every gap before you submit.
- Submit and affirm in SPRS, every year. A Final Level 1 status expires automatically after one year.
How the self-assessment works
The DoD publishes an official CMMC Assessment Guide for Level 1 (version 2.13, September 2024), and it's the best way to run a self-assessment: it's the same breakdown an assessor would use. You can do it in-house or bring in help. Either way it stays a self-assessment, not a certification. The result is your SPRS entry plus a self-assessment report with your findings.
LEVEL 1 SELF-ASSESSMENT · 5 STEPS- 01ScopeEverything that handles FCI
- 02Gather evidenceFinal versions, not drafts
- 03Score 59 objectivesMet, not met, or N/A
- 04Fix every gapNo POA&Ms at Level 1
- 05Submit & affirmIn SPRS, every year
Step 1, scope. Before you assess anything, define what's in scope: under 32 CFR § 170.19, that's every asset that processes, stores, or transmits FCI, except Specialized Assets (IoT, operational technology, government-furnished equipment, restricted information systems, and test equipment), which are outside Level 1 scope. It can be your whole enterprise or a defined enclave. If you're not sure what counts as FCI, see CUI vs. FCI, with real examples.
Step 2, evidence. For each requirement, collect what shows it's in place: policies, system settings, account lists, logs, records. The guide is strict about form: evidence must be final, and "working papers, drafts, and unofficial or unapproved policies" don't count.
Step 3, score the objectives. This is where the real work is. Use the guide's three methods (examine documents and settings, interview the people responsible, and test that things work) to decide whether each objective is met.
The rule that makes Level 1 harder than it looks
“Each assessment objective in NIST SP 800-171A must yield a finding of MET or NOT APPLICABLE in order for the overall security requirement to be scored as MET. … One NOT MET Assessment Objective results in a failure of the entire security requirement.”
- 159 of themThe 15 requirements break into 59 objectives, from 1 to 8 each.
- 2N/A needs a reasonIt counts as met, but write down why it doesn’t apply.
- 3One is enoughA single missed objective decides the requirement.
- 4No safety netLevel 1 allows no POA&M, so the gap has to be fixed before you submit.
Step 4, fix before you submit. Level 1 allows no POA&Ms (32 CFR § 170.21), so a NOT MET finding isn't something to note and move on from. Close it, re-check it, then submit.
What an assessor looks for, requirement by requirement
Here's each requirement in plain language, with the number of objectives behind it and the questions the DoD guide suggests asking. Open the ones you're least sure about.
Authorized accessAC.L1-b.1.i · 6 objectives
Only authorized people, processes, and devices get into your systems.
- Is there a list of authorized users and their roles?
- Are the processes (scripts, service accounts) and devices allowed to connect identified?
- Are account requests approved before anyone gets access?
Transaction & function controlAC.L1-b.1.ii · 2 objectives
People can only do what their role allows.
- Is it defined what each type of user is allowed to do?
- Is access denied by default and granted by exception, so someone who only needs email can't reach admin or developer tools?
External connectionsAC.L1-b.1.iii · 6 objectives
Connections to outside systems, including personal devices and vendor systems, are known and limited.
- Are connections to external systems, and the external systems allowed to connect, identified?
- Are those connections verified and controlled, for example by logins, certificates, VPN, or approved IP addresses?
- If staff read company email on personal phones, can you show only known devices connect?
Control public informationAC.L1-b.1.iv · 5 objectives
Nothing with FCI ends up on your website or other public systems.
- Who is allowed to post to public-facing systems?
- Is content reviewed and approved before it's posted, and checked afterward?
- Is there a way to pull down anything posted by mistake?
IdentificationIA.L1-b.1.v · 3 objectives
Every user, process, and device is identifiable.
- Does each person have their own username, with no shared accounts?
- Are service accounts and automated processes identified?
- Are devices that access your systems identified?
AuthenticationIA.L1-b.1.vi · 3 objectives
Identities are verified before access is granted.
- Are users verified, for example with passwords or MFA, before they get in?
- Are processes and devices authenticated too, for example with credentials, certificates, or tokens?
- Do you keep a record of service accounts for reviewing logs or handling an incident?
Media disposalMP.L1-b.1.vii · 2 objectives
Drives and media that held FCI are wiped or destroyed before disposal or reuse.
- Is storage erased, encrypted, or destroyed so no usable data can be recovered, both before disposal and before reuse?
Limit physical accessPE.L1-b.1.viii · 4 objectives
Only authorized people can physically reach your systems and equipment.
- Is there a list of who's allowed in, with badges or keys issued to match?
- Are sensitive areas protected with locks, card readers, or similar?
- Are printers and other output devices placed where data isn't exposed?
Manage visitors & physical accessPE.L1-b.1.ix · 6 objectives
Visitors are escorted and monitored, access is logged, and keys and badges are controlled.
- Are visitors escorted and easy to tell apart from staff?
- Are logs of physical access kept as long as required?
- Is there an inventory of keys, badges, and key cards, with access to them limited?
Boundary protectionSC.L1-b.1.x · 8 objectives
Traffic at your network's edges, and at key internal boundaries, is monitored, controlled, and protected.
- Are your external boundary (firewalls, gateways, cloud boundaries) and key internal boundaries defined?
- Is traffic monitored, controlled, and protected at both? This requirement has the most objectives at Level 1.
Public-access system separationSC.L1-b.1.xi · 2 objectives
Anything the public can reach sits on a network separated from your internal one.
- Are internet-facing components (web servers, VPN gateways, public cloud services) identified?
- Are they on separated subnetworks, such as a DMZ? If nothing is public-facing, this can be N/A, with the reason written down.
Flaw remediationSI.L1-b.1.xii · 6 objectives
Flaws are found, reported, and fixed on a schedule you set.
- Have you defined how often you look for flaws, and how quickly you report and fix them?
- Can you show they were actually found, reported, and fixed within those time frames, for example through scan results and patch records?
Malicious code protectionSI.L1-b.1.xiii · 2 objectives
Malware protection is in place where it's needed.
- Have you identified which systems need protection (workstations, servers, email, mobile devices)?
- Is protection running on all of them?
Update malicious code protectionSI.L1-b.1.xiv · 1 objective
Malware protection is kept up to date.
- Is protection updated when new releases are available, and is the update frequency defined?
System & file scanningSI.L1-b.1.xv · 3 objectives
Systems are scanned on a schedule, and outside files are scanned as they're opened.
- Is the scan frequency defined, and are scans run on it?
- Are files from outside sources, including USB drives, scanned in real time as they're downloaded, opened, or run?
The CMMC Level 1 page has all 15 requirements on one screen if you want the overview.
Entering it in SPRS
Step 5, submit and affirm. The result goes into the Supplier Performance Risk System (SPRS) through the DoD's PIEE portal. A few things specific to Level 1, from the official SPRS Level 1 Quick Entry Guide:
- You add it under Cyber Reports → CMMC Assessments → "Add New Level 1 CMMC Self-Assessment." You'll need the SPRS Cyber Vendor User role.
- Your CAGE codes come from SAM, so make sure your SAM registration is current first.
- Meeting all of FAR 52.204-21 is what earns a "Final Level 1 Self-Assessment" status.
- That status expires automatically after one year, becoming "No CMMC Status (Expired Assessment)." Repeat the self-assessment and affirm again before then.
- A Final Level 1 Self-Assessment is the only CMMC status type in SPRS that government personnel can see.
The full click-by-click flow, including handing the entry to your Affirming Official, is in our guide to the annual affirmation. Keep your evidence for six years from the CMMC Status Date.
Want a second set of eyes before you affirm?
A self-assessment is only as good as the judgment behind each of those 59 calls. Our CMMC Certified Assessors can review your Level 1 self-assessment objective by objective, the way an assessor would, before your senior official signs. And if you'd rather not rebuild it every year, Continuous Compliance keeps your evidence and your annual affirmation on track.