CMMC Level 1 Requirements and Compliance

15 basic safeguards form the foundation of CMMC Level 1, covering how defense contractors protect Federal Contract Information (FCI). Contractors whose contracts require Level 1 must implement these safeguards, complete an annual self-assessment, and affirm continuing compliance.

This guide explains who needs Level 1, what its requirements cover, and how to prepare for the assessment and maintain compliance.

What Is CMMC Level 1?

CMMC Level 1 is the foundational level of the Cybersecurity Maturity Model Certification program. It verifies basic protection of FCI in contractor systems through an organizational self-assessment and a senior official’s affirmation of compliance.

The underlying safeguards come from Federal Acquisition Regulation (FAR) clause 52.204-21. Level 1 uses self-assessment rather than certification by a CMMC Third-Party Assessment Organization (C3PAO). Consultants can assist, but the contractor remains responsible for its assessment and affirmation.

CMMC has three levels. Level 1 addresses FCI, while Levels 2 and 3 address Controlled Unclassified Information (CUI). Contractors should prepare for the level specified in their contract; Level 1 is not a mandatory preliminary certification before a higher level.

Who Needs CMMC Level 1?

Defense contractors and subcontractors need Level 1 status when their applicable contracts require it. Company size does not create a general exemption, and bidding on a defense contract alone does not automatically trigger the requirement.

Applicability depends on the contract and the information handled. Review these two points before defining the assessment scope:

Federal Contract Information

FCI is nonpublic information provided by or generated for the government under a contract to develop or deliver a product or service. It excludes publicly available government information and simple transactional information needed to process payments.

Examples of systems to examine include email, file storage, and endpoints used to handle nonpublic contract information. Identify where that information is processed, stored, or transmitted before deciding which systems belong in the assessment.

Contract and Subcontract Requirements

The clause covers contractor systems that process, store, or transmit FCI. Its subcontract provision requires applicable safeguards to flow down when subcontractor systems may handle FCI, with an exception for commercially available off-the-shelf items.

Handling FCI does not automatically create a CMMC assessment obligation under every federal contract. Check the applicable solicitation, contract, subcontract, and amendments for the required status and assessment type.

Some contracts now use the replacement clause FAR 52.240-93 under applicable Revolutionary FAR Overhaul deviations. Check the clause incorporated into your contract; the CMMC program regulation continues to reference FAR 52.204-21.

Organizations handling CUI should review their contractual obligations and the requirements for CMMC Level 2 compliance.

What Are the CMMC Level 1 Requirements?

Level 1 covers 15 FAR safeguards across six security domains. The domains group related safeguards; each applicable assessment objective still needs supporting evidence. The following groups explain what the requirements cover:

Access Control

1. Authorized Access: Limit system access to approved users, processes acting for them, and devices.

2. Permitted Activities: Restrict authorized users to approved transactions and functions.

3. External Systems: Verify and control connections to and use of external systems.

4. Public Systems: Control information posted or processed on publicly accessible systems.

Identification and Authentication

5. System Identities: Establish the identities of system users, processes acting for users, and devices.

6. Authentication: Verify those identities before granting system access.

Media Protection

7. Media Disposal: Sanitize or destroy media containing FCI before disposal or release for reuse.

Physical Protection

8. Physical Access: Restrict access to systems, equipment, and operating environments to authorized individuals.

9. Visitors and Access Records: Escort visitors, monitor their activity, maintain physical access logs, and manage physical access devices.

System and Communications Protection

10. Communication Boundaries: Monitor, control, and protect communications at external and key internal system boundaries.

11. Public Component Separation: Place publicly accessible components on subnetworks physically or logically separated from internal networks.

System and Information Integrity

12. Flaw Correction: Detect, report, and correct information and system flaws promptly.

13. Malicious Code Protection: Deploy protection against malicious code at appropriate system locations.

14. Protection Updates: Update malicious code protection mechanisms when new releases become available.

15. Security Scanning: Perform periodic system scans and real-time scans of externally sourced files as they are downloaded, opened, or executed.

Employee training supports correct implementation, but awareness training and incident response are not separate Level 1 domains. Multi-factor authentication can strengthen access security, although Level 1 does not explicitly require it.

How Does the Level 1 Self-Assessment Work?

The self-assessment determines whether the safeguards operate across the defined scope. To obtain Final Level 1 (Self) status, contractors must satisfy the assessment requirements, submit results, and complete the required affirmation. Three obligations govern this process:

1. Meet All Applicable Requirements

Every Level 1 requirement must receive a MET result. Document the rationale for any NOT APPLICABLE finding, which receives equivalent treatment under the scoring rules. The overall Level 1 result is MET or NOT MET; it does not use Level 2’s weighted score.

Level 1 offers no conditional status and does not permit a Plan of Action and Milestones (POA&M) to defer unmet requirements. Correct deficiencies and verify the fixes before claiming compliance.

2. Submit Results and Affirm Compliance

Submit the self-assessment results to the Supplier Performance Risk System (SPRS). The submission includes the CMMC level, CMMC Status Date, assessment scope, associated Commercial and Government Entity (CAGE) codes, and compliance result.

A senior affirming official must affirm continuing compliance in SPRS at assessment completion and annually thereafter. Before an award requiring Level 1 status, the applicable assessment and affirmation must be in place.

3. Retain Evidence and Renew Annually

Retain the artifacts supporting the assessment for six years from the CMMC Status Date. Evidence can include access lists, configuration exports, visitor logs, patch records, and scan results tied to the relevant assessment objectives.

Complete a self-assessment and affirmation annually, while maintaining safeguards throughout contract performance. Level 1 does not require a System Security Plan (SSP), but it still requires sufficient evidence of implementation.

How Do You Prepare for CMMC Level 1?

Preparation turns the requirements into a defined scope, working safeguards, and evidence that supports the final assessment. Follow these eight steps:

1. Define the Assessment Scope

Confirm the CMMC level required for your contract, then determine where FCI is processed, stored, or transmitted. Review relevant email services, file storage, endpoints, facilities, personnel, and external service providers.

Apply the Level 1 scoping rules when classifying assets, including exclusions for qualifying specialized assets. Record which safeguards your organization operates and which depend on a managed service provider or cloud provider.

2. Map Safeguards to Assessment Objectives

Use the Level 1 Assessment Guide to map the required safeguards to their assessment objectives. Identify the people responsible for each safeguard and the records or tests needed to show that it operates.

3. Review Existing Controls and Record Gaps

Conduct a readiness review before completing the official self-assessment. Examine system configurations, speak with responsible staff, and test safeguards to establish whether each assessment objective is satisfied.

Record missing controls, incomplete implementation, and missing evidence in an internal remediation tracker. A “partial” label can help track internal progress, but it is not a passing Level 1 assessment result.

4. Implement and Verify Corrective Actions

Assign each gap an owner, completion date, and verification method. Corrective work may include restricting user permissions, controlling external connections, protecting network boundaries, maintaining malware protection, scheduling scans, and recording physical access.

Select tools that satisfy the applicable objectives within your environment. Verify each correction in operation before closing the finding; purchasing a tool or drafting a procedure does not demonstrate implementation.

5. Organize Supporting Evidence

Collect final procedures, configuration records, logs, and test results in an accessible, protected location. Connect each artifact to the relevant requirement and assessment objective, and record who maintains it.

6. Complete the Self-Assessment

Evaluate every applicable objective against the final evidence. Record supported findings and any justified NOT APPLICABLE determinations. Reassess corrected deficiencies before recording a passing result.

7. Submit Results and Affirm Compliance

Access SPRS through the Procurement Integrated Enterprise Environment (PIEE) with the appropriate permissions. Enter the required assessment details and arrange for the senior affirming official to review and submit the affirmation.

8. Maintain Safeguards and Renew Annually

Assign owners for renewal deadlines and ongoing control reviews. Revisit safeguards when personnel, systems, facilities, or service providers change, and keep the assessment evidence current.

An internal remediation tracker can support steps 3 and 4. Record the affected requirement, deficiency, corrective action, owner, resources, milestones, deadline, and closure evidence.

Close each entry only after verification confirms the correction works; the tracker does not authorize compliance claims while requirements remain unmet.

How Does Level 1 Compare With Levels 2 and 3?

The required level follows the information and protection needs specified in the contract. This comparison places Level 1 within the broader program:

POA&M rules differ by level. Level 1 requires all applicable requirements to be satisfied before achieving status. At Level 2, conditional status requires at least 88 of 110 points, permits only eligible deficiencies, and requires a successful POA&M closeout assessment within 180 days of the Conditional CMMC Status Date.

What Affects CMMC Level 1 Cost and Preparation Time?

Preparation costs and schedules depend on existing safeguards, the assessment scope, remediation work, and staff capacity. Existing tools may satisfy some requirements when configured correctly and supported by evidence.

A readiness review identifies where additional work is necessary. Use its findings to prioritize corrective actions and assign resources. Basic safeguards reduce exposure to common threats, but Level 1 status does not eliminate cybersecurity risk or replace other contractual obligations.

How Can Bright Defense Help With CMMC Level 1?

Bright Defense helps defense contractors prepare for Level 1 through gap assessments, remediation, documentation, and ongoing compliance support. Its team can help define the scope, assess safeguards, verify corrective actions, organize evidence, and prepare for annual self-assessments.

Your organization remains responsible for submitting assessment results, and its senior affirming official remains responsible for affirming continuing compliance. Contact Bright Defense to discuss readiness and remediation priorities.

What Is the CMMC Rollout Timeline?

As of September 23, 2026, Phase 1 self-assessment requirements continue while the planned Phase 2 expansion remains suspended. Contractors should review current contracts and amendments, maintain applicable safeguards, and monitor official notices for further changes. The timeline provides context for those obligations:

Program and Contractual Milestones

Phase 2 Suspension and Contract Changes

On July 13, 2026, the Department suspended the Phase 2 transition scheduled for November 10, 2026, and launched a 60-day program review. Phase 1 self-assessment requirements remained in place.

On September 3, 2026, Class Deviation 2026-O0025, Revision 3, directed contracting officers to remove or revise suspended CMMC requirements in solicitations and contracts.

The suspension does not remove existing information protection obligations. Continue meeting applicable contract requirements and treat any future restart date as unconfirmed until officially announced.