CMMC Level 1 self-assessment checklist

The CMMC Program is codified at 32 CFR Part 170. Level 1 consists of the 15 security requirements already found in FAR 52.204-21(b)(1), the Basic Safeguarding of Covered Contractor Information Systems clause that has appeared in federal contracts since 2016. CMMC Level 1 does not add new controls; it adds accountability for the controls that were already contractually required.

The accountability model has three parts. First, a self-assessment: your organization checks itself against all 15 requirements, and every requirement must be fully MET or NOT APPLICABLE. Plans of Action and Milestones (POA&Ms) are not permitted at Level 1, so there is no partial credit and no "we will fix it later." Second, submission: the results go into the Supplier Performance Risk System (SPRS), the DoD's database of record. Third, affirmation: a senior official from your company, the Affirming Official, formally attests in SPRS that the organization is compliant, at the time of the assessment and annually thereafter. The self-assessment itself must also be repeated every year.

That affirmation carries real weight. It is a statement to the federal government that a named executive stands behind, which is why the practical goal of a Level 1 program is not just passing a checklist but being able to show, on paper, why each answer is true.

Level 1 applies to DoD contractors and subcontractors whose systems process, store, or transmit Federal Contract Information (FCI): information provided by or generated for the government under contract that is not intended for public release. If you sell to the DoD, or you are a subcontractor to someone who does, and any contract information touches your systems, Level 1 is the floor. Handling Controlled Unclassified Information (CUI) pushes you to Level 2 instead.

The acquisition side of the program took effect on November 10, 2025, when the 48 CFR final rule made the CMMC contract clause (DFARS 252.204-7021) available for new solicitations, with a phased rollout that starts with self-assessed Level 1 and Level 2 requirements at contract award. Practically: if defense work is anywhere in your pipeline, the requirement is no longer hypothetical, and primes are already pushing it down to their subcontractors.

Level 2 is a different order of magnitude. It requires all 110 security requirements of NIST SP 800-171 Revision 2, covering fourteen requirement families instead of six, and it applies when your systems handle CUI rather than just FCI. Under the phased acquisition rollout, most Level 2 work will eventually require a certification assessment by an authorized third-party assessment organization (C3PAO), where Level 1 always remains a self-assessment.

The practical advice: do not build for Level 1 in a way you would have to undo for Level 2. The 15 Level 1 requirements are a strict subset of the practices NIST SP 800-171 expects, so clean account management, patching, and boundary documentation done properly at Level 1 all carry forward if a CUI contract later pushes you up a tier.

For a small business with reasonably modern IT (cloud email, managed laptops, a configured firewall), a first Level 1 self-assessment is typically weeks of part-time effort, not months. The technical controls are largely things competent IT already does; the work is scoping which systems handle FCI, confirming each of the 15 requirements is actually met on those systems, and writing down the evidence behind each answer.

Budget the effort in three phases. Scoping: identify where FCI lives and which assets are in scope, usually a few days of asset inventory and data-flow mapping. Gap fixing: whatever the walkthrough above surfaced, most commonly visitor logs, media disposal practice, and formal account reviews. Documentation and submission: write down policies and evidence, run the self-assessment, submit the score in SPRS, and have your Affirming Official affirm. Then put the annual repeat on the calendar, because both the self-assessment and the affirmation recur every year.