If you hold a defense contract or subcontract that involves Federal Contract Information (FCI), CMMC Level 1 is the floor you have to meet. It's the most approachable level of the Cybersecurity Maturity Model Certification program, but "approachable" doesn't mean optional or informal. Every requirement has to be fully met, you assess yourself every year, and a senior official at your company signs off on the result.
This article walks through who needs Level 1, how FCI reaches you, the 15 safeguards in plain language, how the self-assessment and affirmation work, and the mistakes we see most often.
Who needs Level 1?
Level 1 applies when your contract requires CMMC Level 1 (Self) and your information systems process, store, or transmit FCI in performance of that contract.
FCI is defined in FAR 52.204-21 as information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service. It does not include information the government already makes public, or simple transactional information like what's needed to process a payment.
In practice, that's things like statements of work, drawings and specs that aren't public, delivery schedules, internal contract correspondence, and the reports you produce for the customer.
If your contract also involves Controlled Unclassified Information (CUI), Level 1 isn't enough. CUI brings in DFARS 252.204-7012 and the 110 requirements of NIST SP 800-171, which is Level 2 territory. Level 1 is not "the first 15 requirements of Level 2." It's its own standard, for FCI.
How FCI shows up through your contract
You don't have to guess whether you handle FCI. The contract tells you. Look for:
- FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. This clause lists the 15 safeguards and applies to systems that process, store, or transmit FCI.
- DFARS 252.204-7021, the CMMC clause. The contracting officer fills in the required level, such as CMMC Level 1 (Self).
- Flow-downs from your prime. Both clauses require primes to pass the requirements down to subcontractors who will have FCI on their systems. If you're a sub, your purchase order or subcontract is where this shows up.
Read the clauses in your contract and your subcontract. They decide which level applies, not a guess about what kind of company you are.
The 15 safeguards, in plain language
The 32 CFR Part 170 rule defines the CMMC Level 1 requirements as the 15 safeguards in FAR 52.204-21(b)(1)(i) through (xv).
You may also see "17 practices" in older CMMC material. That's because the self-assessment uses the NIST SP 800-171A objectives, and one FAR requirement (the visitor and physical access one) maps to three separate NIST requirements. Same work, counted two ways. The current rule says 15.
Here they are, grouped by what they protect, with what that looks like at a small shop.
Access control (4)
- Only authorized users, processes, and devices get in. Every person has their own account, and only company-approved devices connect.
- Users only do what their job requires. Your shop-floor lead doesn't need admin rights on the file server.
- Control connections to outside systems. Decide which personal devices, cloud apps, and remote access methods are allowed, and block the rest.
- Control what goes on public systems. Someone reviews what gets posted on your website or social media so contract information doesn't end up there.
Identification and authentication (2)
- Identify users, processes, and devices. No shared logins like "frontdesk" or "shop."
- Verify identity before granting access. Passwords at minimum. Multi-factor authentication is a smart addition even though Level 1 doesn't list it by name.
Media protection (1)
-
Wipe or destroy media before disposal or reuse. Old laptops, drives, and USB sticks that held FCI get wiped or shredded, and you keep a record.
Physical protection (2)
Limit physical access to authorized people. Locked doors, a locked server closet, and badges or keys for the people who need them.
Escort visitors, log physical access, and manage keys and badges. A visitor sign-in sheet, an escort rule, and a list of who holds which keys. Collect them when people leave.
System and communications protection (2)
- Monitor and protect your network boundaries. A properly configured firewall between your network and the internet.
- Keep public-facing systems separate from internal ones. If you host anything public, put it on its own network segment or with a hosting provider, not on the same network as your accounting PC.
System and information integrity (4)
- Find and fix flaws promptly. Turn on automatic updates and patch regularly.
- Protect against malicious code. Anti-malware on every computer that handles FCI.
- Keep that protection updated. Automatic signature and engine updates.
- Scan regularly, and scan files from outside sources in real time. Scheduled scans plus real-time scanning of downloads, email attachments, and USB files.
For each safeguard with evidence examples, see our CMMC Level 1 requirements page.
How the self-assessment works
1. Set your scope. Before you assess, write down which systems, people, facilities, and outside service providers process, store, or transmit FCI. Systems that don't touch FCI are out of scope.
2. Assess every requirement. Use the NIST SP 800-171A objectives that map to each Level 1 requirement, reading "FCI" wherever the objective says "CUI." Each requirement is scored MET or NOT MET. There is no partial credit.
3. All 15 must be MET. Level 1 doesn't use the 110-point scoring you see at Level 2, and Plans of Action and Milestones (POA&Ms) are not allowed at Level 1 at any time. If something isn't done, finish it before you claim compliance.
4. Enter the results in SPRS. The Supplier Performance Risk System entry includes the CMMC level, the status date, the assessment scope, the CAGE codes covered, and the result.
5. Affirm it. A senior official submits an affirmation in SPRS.
6. Keep your evidence. The rule requires you to keep the artifacts behind your assessment for six years.
7. Repeat every year. Both the self-assessment and the affirmation are annual. Under the CMMC contract clause, a Final Level 1 (Self) status counts as current only if it's no older than one year.
Timing matters too. When a contract requires Level 1 (Self), you need the status and the affirmation in SPRS before award, not after.
What the affirmation means
The Affirming Official is a senior person at your company who is responsible for CMMC compliance and has the authority to speak for the company. By affirming, they're telling the government your company has implemented, and will keep implementing, every Level 1 requirement for every system in scope.
That's a statement to the federal government, and it's tied to getting paid on federal contracts. A knowingly false or reckless affirmation can create liability under the False Claims Act. Treat the affirmation as a statement you need to be able to back up with evidence, not a checkbox.
Where things stand right now
CMMC is in Phase 1, which uses self-assessments. On July 13, 2026, the Department suspended the planned Phase 2 rollout while a CMMC Reform Task Force reviews the program. Level 1 wasn't suspended. Contracts can still require Level 1 (Self), and the FAR 52.204-21 safeguards apply whenever that clause is in your contract.
Common mistakes
- Treating policy as proof. A written policy says what you intend. The assessment checks what's actually in place.
- Shared accounts. One login for the front desk or the shop floor breaks the identification and authentication requirements.
- Forgetting the physical side. No visitor log, no escort rule, and no record of who holds keys are common gaps.
- Leaving out cloud and outside providers. If your email, file sharing, or IT provider handles FCI, it belongs in your scope.
- Skipping the yearly repeat. Level 1 isn't one and done. A status older than one year isn't current.
- Affirming without evidence. If you can't show it, don't sign it.
- Assuming Level 1 covers CUI. If DFARS 7012 or CUI markings show up in your contract, look at Level 2.
A quick Level 1 checklist
- I've read my contract and subcontract clauses (FAR 52.204-21, DFARS 252.204-7021, prime flow-downs).
- I've written down which systems, people, facilities, and providers handle FCI.
- Every user has a unique account, with access limited to their role.
- Outside connections and public posting are controlled.
- Old media is wiped or destroyed, with records.
- Doors are locked, visitors are escorted and logged, and keys and badges are tracked.
- A firewall protects the network edge, and public-facing systems are separated.
- Patching, anti-malware, updates, and scans are running.
- All 15 requirements are MET, with evidence saved for six years.
- Results are in SPRS, and our Affirming Official has affirmed.
- Next year's assessment and affirmation are on the calendar.
Want a second set of eyes?
Cyberneza is a veteran-owned cybersecurity firm in Orlando, FL, with a 100% US-based team. We help defense contractors confirm their scope, check each Level 1 requirement against how their systems actually run, and get ready to affirm with confidence. Start with our CMMC page.
