Ready to transform your IT experience? Reach out to our experts to discuss how our tailored solutions can meet your business needs and keep your technology running smoothly.
CMMC Level 1 Requirements: What Defense Contractors Must Do
Updated November 2026. CMMC status checked November 3, 2026.
CMMC Level 1 is the basic security bar for defense contractors that handle Federal Contract Information (FCI). You must meet 15 safeguards from FAR 52.204-21 and prove it yourself. Once a year, you run a self-check, post the result in SPRS, and a senior official signs off. There is no certificate, no outside auditor and no partial credit.
That’s the short version of the CMMC Level 1 requirements. It applies to a lot of companies. The Defense Department expected about 63% of its supply base to need Level 1, per the 32 CFR Part 170 final rule. If you run a small shop with no compliance staff, a managed IT team can handle the technical side while you own the sign-off.
What Is CMMC Level 1?
CMMC Level 1 is the entry tier of the Cybersecurity Maturity Model Certification program. It checks that a defense contractor protects Federal Contract Information with 15 basic safeguards. The company assesses itself every year, enters the result in the Supplier Performance Risk System (SPRS), and a senior official affirms it. The rules sit in 32 CFR Part 170.
Level 1 has been a condition of award in new DoD contracts since November 10, 2025.
What Counts as FCI in a Small Business?
FCI is information the government gives you, or you create for it, under a contract. It isn’t meant for the public. In a small office, that usually means:
- Contract and purchase order emails
- Statements of work and delivery schedules
- Invoices tied to a government contract
- Drawings and specs with no CUI marking
- Draft deliverables
Public information doesn’t count. Neither do simple payment transactions.
CMMC Level 1 vs Level 2 vs Level 3
| Level 1 | Level 2 | Level 3 | |
|---|---|---|---|
| Protects | FCI | CUI | High-priority CUI |
| Requirements | 15 (FAR 52.204-21) | 110 (NIST SP 800-171 Rev. 2) | 110 plus 24 from NIST SP 800-172 |
| Who assesses | You, every year | You or a C3PAO, every 3 years | DoD, every 3 years |
| Open gaps allowed? | No | Some, with a plan | Some, with a plan |
| Annual affirmation | Yes | Yes | Yes |
CUI means Controlled Unclassified Information, like marked drawings or export-controlled specs. If you receive CUI, Level 1 is not enough. Our NIST SP 800-171 compliance checklist covers that path.
Who Needs CMMC Level 1?
You need it if a DoD contract or subcontract involves FCI. The only exception is a contract solely for commercially available off-the-shelf (COTS) items.
Check your paperwork for two clauses:
- DFARS 252.204-7021. The contract clause. It states the CMMC level you must hold.
- DFARS 252.204-7025. The solicitation notice. It asks for your CMMC unique ID from SPRS.
There is no small business exemption. Size doesn’t matter. The data does.
You may also see the Department of Defense called the Department of War in newer documents. Both names refer to the same CMMC program.
Does CMMC Level 1 Apply to Subcontractors?
Yes. Primes must flow the requirement down to any sub that handles FCI. Many primes now ask for proof of Level 1 before they send a purchase order. That hits manufacturers in the defense supply chain first, since one machined part can put a shop under a prime’s contract terms.
The 15 CMMC Level 1 Requirements
The CMMC 2.0 Level 1 requirements are the 15 safeguards in FAR 52.204-21. They fall into six families. Every one must be fully met.
| ID | Requirement | What it means for you | Example proof |
|---|---|---|---|
| AC.L1-b.1.i | Authorized access | Only approved people and devices get in | Microsoft 365 user list and device list |
| AC.L1-b.1.ii | Transaction and function control | People only do what their job needs | Admin role list |
| AC.L1-b.1.iii | External connections | Control links to outside systems and personal devices | Approved apps and device policy |
| AC.L1-b.1.iv | Control public information | No FCI on your website or social posts | Posting approval steps |
| IA.L1-b.1.v | Identification | Every user and device has its own ID | No shared logins |
| IA.L1-b.1.vi | Authentication | Verify identity before access | Password policy settings |
| MP.L1-b.1.vii | Media disposal | Wipe or destroy drives, USBs and paper before reuse or disposal | Disposal log |
| PE.L1-b.1.viii | Limit physical access | Lock offices, server closets and equipment | Key or badge list |
| PE.L1-b.1.ix | Manage visitors and access | Escort visitors, keep logs, control keys | Visitor log |
| SC.L1-b.1.x | Boundary protection | A firewall watches traffic in and out | Firewall settings |
| SC.L1-b.1.xi | Public system separation | Keep guest Wi-Fi and public systems apart from office systems | Network diagram |
| SI.L1-b.1.xii | Flaw remediation | Patch on a set schedule | Patch report |
| SI.L1-b.1.xiii | Malicious code protection | Antivirus on every device | Endpoint coverage report |
| SI.L1-b.1.xiv | Update malicious code protection | Keep antivirus current | Update status report |
| SI.L1-b.1.xv | System and file scanning | Scan devices and downloaded files | Scan settings and logs |
The families: Access Control (4), Identification and Authentication (2), Media Protection (1), Physical Protection (2), System and Communications Protection (2), and System and Information Integrity (4).
Why some guides say 17. The 2021 CMMC 2.0 Level 1 guide split the physical access rule into extra practices, which made 17. DoD’s Level 1 Assessment Guide (version 2.13, September 2024) uses the 15 FAR requirements. Same rules, different count.
Each requirement also has assessment objectives in that guide. You must meet every objective, not just the headline.
What CMMC Level 1 Does Not Require
Many small contractors overbuy. Here’s what Level 1 does not ask for.
| Myth | Fact |
|---|---|
| You need an outside auditor | Level 1 is always a self-assessment. No C3PAO. |
| You get a certificate | You get a status in SPRS, not a certificate. |
| You need all 110 NIST controls | That’s Level 2. Level 1 is 15. |
| You can fix gaps later | No plan of action (POA&M) is allowed. Fix first, then affirm. |
| You need encryption, MFA and training | None are in the 15. They’re still smart to have. |
| You need a government cloud | Not for FCI only. Commercial Microsoft 365 or Google Workspace can work if set up right. |
One catch on that last row. Some contracts that look FCI-only still include DFARS 252.204-7012, which brings in CUI rules. Read every clause before you decide.
How to Get CMMC Level 1 Compliance: 7 Steps
These steps cover the CMMC Level 1 compliance requirements from contract to sign-off.
- Confirm your level. Read the contract clause. If it’s unclear, ask your contracting officer or prime. FCI only means Level 1.
- Start PIEE and SPRS access today. Register in PIEE, request the SPRS Cyber Vendor User role, and name your Affirming Official. Approval can lag, so do this first. The SPRS CMMC Quick Entry Guide shows each screen.
- Define your scope. List every person, device, cloud service and location that touches FCI. DoD’s free Level 1 Scoping Guide helps. A smaller scope means less work.
- Close the gaps. Work through each requirement and its objectives. Fix what’s missing before you assess.
- Collect evidence. Save screenshots, reports and logs. Write a short note for each requirement on how you meet it. A system security plan isn’t required at Level 1, but a short one makes next year faster.
- Run the self-assessment. Mark each requirement MET or NOT MET. Every one must be MET.
- Enter results in SPRS and affirm. Enter your level, status date, scope and CAGE codes. Your Affirming Official then affirms. Set a reminder for next year, and keep your evidence for six years.
Is There a CMMC Level 1 Certification?
No. People search for CMMC Level 1 certification requirements, but Level 1 never ends in a certificate. You earn a “CMMC Status of Level 1 (Self)” in SPRS. Only Level 2 (C3PAO) and Level 3 involve an outside assessor. When a bid asks for proof, you give your CMMC unique ID from SPRS.
Annual Affirmation: Why the Sign-Off Matters
The Affirming Official is the senior person responsible for compliance. In a small company, that’s usually the owner or CEO. Under 32 CFR 170.22, they affirm after the self-assessment and every year after.
Miss the yearly affirmation and your status lapses. That can block your next award.
The affirmation is a statement to the federal government. In 2021, the Justice Department launched its Civil Cyber-Fraud Initiative, which uses the False Claims Act against contractors who misstate their cybersecurity. The fix is simple: don’t affirm anything you can’t show.
CMMC Status in November 2026: What the Phase 2 Pause Changed
CMMC status as of November 2026. Phase 1 began November 10, 2025, putting Level 1 and Level 2 self-assessments into new DoD contracts. On July 13, 2026, DoD suspended Phase 2, which would have required third-party Level 2 assessments starting November 10, 2026. Later milestones are paused too, while a CMMC Reform Task Force reviews the program. Level 1 self-assessments and yearly affirmations did not change.
The task force sent its recommendations to the DoD CIO in September 2026. As of early November, DoD had not published a final decision. Check this page’s date line, and your contract, before you plan around Phase 2.
One more change you may notice. Under the federal effort to rewrite the FAR, new solicitations list FAR 52.204-21 as FAR 52.240-93. Same title. Same 15 requirements. You may see either number for a while.
Common CMMC Level 1 Gaps We Find
In our Level 1 readiness work with small defense suppliers, the same three gaps show up first.
- FCI in places nobody tracks. Contract emails forwarded to a personal Gmail. Drawings on a shop-floor PC or USB stick. A statement of work in a personal Dropbox. If it holds FCI, it’s in scope.
- Shared logins. One “office@” mailbox that four people sign into. One Windows account on the programming PC. Level 1 needs a unique ID for every user.
- Physical rules skipped. No visitor log. No escort habit. A box of old hard drives in a closet with no record of how they’ll be wiped.
Close behind: a firewall still on its default admin password, guest Wi-Fi on the same network as office PCs, and antivirus on most machines but not all.
Here’s a typical example. A 20-person parts supplier gets a flow-down notice from its prime. It already runs Microsoft 365. Most of the 15 are partly in place. The real work is moving FCI out of personal accounts, ending two shared logins, starting a visitor log and writing down a patch schedule. That’s weeks of steady work, not months.
How Long Does CMMC Level 1 Take, and What Does It Cost?
In our experience, a 10 to 50 person shop already on Microsoft 365 with managed devices needs about 3 to 6 weeks. PIEE and SPRS access can take 1 to 2 weeks of that on its own. A shop with unmanaged PCs, no firewall or FCI in personal accounts should plan on 6 to 10 weeks.
For cost, DoD’s own estimate in the 32 CFR 170 final rule puts a small business Level 1 self-assessment at about $6,000, plus about $560 for each yearly affirmation. That figure covers the assessment work only. It doesn’t include fixing gaps.
What moves your cost up or down:
- Scope. Fewer systems touching FCI means less to protect.
- Starting point. A managed Microsoft 365 setup already covers several requirements.
- Physical fixes. Locks, a visitor log and a disposal process cost little but take time.
- Outside help. Optional at Level 1, but it saves owner hours.
- Staff time. Someone has to collect evidence every year.
Getting Help With CMMC Level 1
AllSafe IT has supported Southern California businesses since 2005. We do NIST SP 800-171 and CMMC readiness work directly. We are not a C3PAO, and Level 1 never needs one. Our job is scoping, fixing gaps, organizing evidence and getting your SPRS entry right. Your company still owns the affirmation.
Our CMMC readiness support page explains how that work runs.
Your next step: confirm your level in the contract, then start your PIEE registration today. It’s the one task that can’t be rushed later.
CMMC Level 1 FAQ
What are the 15 requirements for CMMC Level 1?
They are the 15 basic safeguards in FAR 52.204-21. They cover who can access your systems, unique logins, media disposal, physical access and visitors, firewall and network separation, patching, and antivirus with regular scans. All 15 must be fully met. There is no partial credit and no plan of action allowed at Level 1.
What is the difference between CMMC Level 1 and Level 2?
Level 1 protects Federal Contract Information with 15 safeguards and a yearly self-assessment. Level 2 protects Controlled Unclassified Information with the 110 requirements in NIST SP 800-171 Rev. 2. Level 2 can require a third-party assessment every three years, though that rollout is paused as of November 2026.
Do I need a C3PAO for CMMC Level 1?
No. Level 1 is always a self-assessment. Your company runs it, enters the result in SPRS, and a senior official affirms it each year. You can hire outside help to prepare, but the result is still a self-assessment, not a certification. C3PAOs only assess at Level 2.
How long does it take to get CMMC Level 1?
In our experience, a 10 to 50 person company already on Microsoft 365 with managed devices takes about 3 to 6 weeks. PIEE and SPRS access can take 1 to 2 weeks alone, so start there. Shops with unmanaged PCs or FCI in personal accounts should plan on 6 to 10 weeks.
Is CMMC Level 1 still required after the Phase 2 suspension?
Yes. The July 2026 suspension paused third-party Level 2 assessments and later milestones. It did not change Level 1. New DoD contracts involving FCI can still require a current Level 1 self-assessment and yearly affirmation in SPRS, as of November 2026. Check your contract clauses to confirm.
Can I use regular Microsoft 365 for CMMC Level 1?
Usually, yes. Level 1 comes from FAR 52.204-21, which has no FedRAMP or government cloud rule. Commercial Microsoft 365 can meet Level 1 when set up correctly. If your contract also includes DFARS 252.204-7012 or you receive CUI, different rules apply, so check before you decide.