CMMC Level 1 Requirements

CMMC Level 1 requirements at a glance

CMMC Level 1 is the same 15 basic safeguards that FAR 52.204-21 already puts in contracts, plus an annual self-assessment and a signed affirmation in SPRS ⁵². The requirements in 32 CFR 170.14 are taken directly from FAR 52.204-21(b)(1)(i) through (xv) ⁵.

Level 1 applies only to the systems that process, store or transmit federal contract information (FCI). If you also hold controlled unclassified information, you are in CMMC Level 2 territory instead. The CMMC overview explains the difference between FCI and CUI.

Phase 1 of CMMC has been in effect since November 10, 2025, and during the current suspension of Phase 2, Level 1 (Self) remains one of the two levels contracting officers may require ¹⁶.

The 15 FAR 52.204-21 requirements in plain language

Each of the 15 requirements below is paraphrased from FAR 52.204-21(b)(1) ⁴. The rule text controls, so check the clause itself for exact wording.

Access control

1. Only authorized people and devices get in. Limit system access to authorized users, processes acting for them, and devices.
2. People can only do what their job needs. Limit access to the transactions and functions each user is permitted to run.
3. Control outside connections. Verify and control connections to and use of external systems, such as personal devices and outside cloud accounts.
4. Control what goes public. Control information posted or processed on public systems, such as your website, so FCI does not end up there.

Identification and authentication

5. Know who is who. Identify users, processes acting for users, and devices.
6. Prove it before access. Authenticate those identities, for example with passwords, before allowing access.

Media protection

7. Wipe or destroy media. Sanitize or destroy media holding FCI before disposal or reuse, including drives and paper.

Physical protection

8. Lock up the equipment. Limit physical access to systems, equipment and work areas to authorized people.
9. Manage visitors and keys. Escort visitors and monitor what they do, keep logs of physical access, and control badges, keys and similar devices.

System and communications protection

10. Guard the edges. Monitor, control and protect communications at the external boundary and key internal boundaries, usually with a firewall.
11. Separate public-facing systems. Put publicly accessible systems on subnetworks separated from internal networks.

System and information integrity

12. Patch on time. Identify, report and correct system flaws in a timely manner.
13. Run anti-malware. Protect against malicious code at appropriate places.
14. Keep it updated. Update malware protection when new releases are available.
15. Scan. Run periodic scans of systems and real-time scans of files from outside sources as they are downloaded, opened or executed.

A managed firewall and properly configured endpoint protection cover several of these at once, but they do not cover physical security, visitor logs or media disposal, which stay with you.

How the Level 1 self-assessment and affirmation work

You assess yourself once a year, enter the result in SPRS, and a senior official affirms it ²⁷. There is no third-party assessor at Level 1.

Key rules from 32 CFR part 170:

• Annual cycle. The self-assessment must be done every year ².
• All or nothing. Each requirement is MET or NOT MET. A plan of action and milestones (POA&M) is not permitted at any time for Level 1, so every requirement must be met before you can claim the status ³.
• Affirmation. A senior official of the company affirms continuing compliance in SPRS at the time of the assessment and every year after ⁷⁸.
• Flow-down. Primes must flow the Level 1 requirement down to subcontractors that will handle FCI ⁸.

The affirmation is a statement to the government. A wrong one can create False Claims Act exposure, so keep evidence for every requirement: screenshots, configuration exports, the visitor log, the media disposal record. If in doubt about your position, check with counsel before signing.

Who needs CMMC Level 1

You need Level 1 if your DoD contract or subcontract names CMMC Level 1 and you will handle FCI on your own systems ⁸. FCI is information not intended for public release that is provided by or generated for the government under a contract, excluding public information and simple transactional information such as payment processing data ⁹.

Typical Level 1 companies include suppliers of parts, services or labor that receive purchase orders, schedules, delivery details and contract correspondence but no technical drawings or other CUI. Under the acquisition rule, commercially available off-the-shelf (COTS) awards are excluded ¹⁰.

For scale, DoD's regulatory impact analysis estimated 221,286 entities across all CMMC levels, 163,987 of them small ¹¹. If your contracts will move you into CUI, plan for Level 2 from the start rather than building twice.

CMMC Level 1 self-assessment: common gaps and the evidence to keep

The gaps that most often stop a Level 1 affirmation are shared accounts, missing visitor records and undocumented media disposal, not missing technology. Each requirement maps to evidence you can show if a prime or the government asks ⁴:

• Shared or generic logins (a single "shop" account on a floor PC) fail requirements 1, 5 and 6. Give everyone a unique account.
• Personal email or cloud storage used for contract files fails requirement 3. Decide which external services are allowed and block the rest.
• No visitor log fails requirement 9. A paper sign-in sheet with escort notes is enough if you keep it.
• Old drives in a closet fail requirement 7. Keep a simple disposal record or a certificate from a shredding vendor.
• A website or shared portal holding contract documents can fail requirement 4.
• Patching done "when someone gets to it" fails requirement 12. Set a schedule and keep the report.

Keep the evidence in one place with the date of each check. When you assess again next year, you update the folder rather than starting over. If you later move to Level 2, the same evidence carries into the NIST SP 800-171 work described in our NIST 800-171 guide, since Level 2 includes these safeguards. If you would rather have someone walk through it with you, the CMMC compliance services guide explains what consultants and registered practitioners do.

Typical effort and cost for Level 1

For a small company whose basic IT is already in order, Level 1 is mostly checking, documenting and closing a handful of gaps, because the 15 safeguards are basic hygiene. DoD's regulatory impact analysis estimated a small entity's cost to support a Level 1 self-assessment and affirmation at $5,977 ¹¹. That figure covers the assessment, not fixing gaps, which DoD treats as already required by FAR 52.204-21 ¹².

Where the effort goes:

• Inventory. Listing users, devices and where FCI lives.
• Quick technical fixes. Unique logins for everyone, turning on automatic patching and malware protection, closing unmanaged remote access.
• Physical controls. Visitor sign-in, escort rules and a locked equipment area.
• Evidence. Collecting proof for each requirement in one folder.

Many small contractors do this with their current IT provider. If you do not have one, a small business managed IT provider can handle the technical items, and a cybersecurity risk assessment gives you a baseline. For a fuller picture across levels, see CMMC cost. The schedule may change; check the DoD CIO CMMC page for current status ¹.