CMMC Level 1 Requirements: All 15 Controls Listed

By Shaheer Malik · Updated Oct 28, 2026

CMMC Level 1 is the entry level for companies that handle only Federal Contract Information. It requires all 15 basic safeguarding requirements of FAR 52.204-21, checked by an annual self-assessment that you post in SPRS with an affirmation. No third-party audit is involved, and every requirement must be met: no POA&Ms are allowed.^[1]

The 15 requirements

Verbatim from FAR 52.204-21(b)(1), with the CMMC identifier.^[2]^[1]

CMMC ID	Requirement
AC.L1-b.1.i	Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
AC.L1-b.1.ii	Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
AC.L1-b.1.iii	Verify and control/limit connections to and use of external information systems.
AC.L1-b.1.iv	Control information posted or processed on publicly accessible information systems.
IA.L1-b.1.v	Identify information system users, processes acting on behalf of users, or devices.
IA.L1-b.1.vi	Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
MP.L1-b.1.vii	Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
PE.L1-b.1.viii	Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
PE.L1-b.1.ix	Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
SC.L1-b.1.x	Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
SC.L1-b.1.xi	Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
SI.L1-b.1.xii	Identify, report, and correct information and information system flaws in a timely manner.
SI.L1-b.1.xiii	Provide protection from malicious code at appropriate locations within organizational information systems.
SI.L1-b.1.xiv	Update malicious code protection mechanisms when new releases are available.
SI.L1-b.1.xv	Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

The self-assessment uses the matching objectives in NIST SP 800-171A, reading “FCI” wherever an objective says “CUI”.^[1]

What a Level 1 self-assessment involves

Scope: the systems, people, facilities and External Service Providers that process, store or transmit FCI. IoT, OT, government-furnished equipment and test equipment that can’t be fully secured are Specialized Assets and are not assessed at Level 1.^[1]
Result: you must score MET on all 15; there is no Conditional status at Level 1.^[1]
SPRS entry: level, status date, assessment scope, the CAGE codes involved and the result, plus an affirmation by your Affirming Official.^[1]
Frequency: every year. Keep your evidence for six years from the status date.^[1]

DoD estimates a small business spends about $5,977 a year on the Level 1 self-assessment and affirmation, assuming the requirements are already in place.^[3] The step-by-step is in the Level 1 self-assessment guide.

Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.

FAQ

Does CMMC Level 1 require a third-party audit?

No. Level 1 is always a self-assessment, done every year and entered in SPRS with an affirmation.

How do I get CMMC Level 1 certification?

Level 1 is not a certification. You meet all 15 FAR 52.204-21 requirements, self-assess, enter the result in SPRS and have your Affirming Official affirm it, every year.

Does CMMC Level 1 require an SSP?

The rule does not list a System Security Plan among the Level 1 SPRS inputs. A written description of how you meet each requirement still makes the yearly self-assessment and affirmation far easier to defend.

Can I have a POA&M at CMMC Level 1?

No. The rule does not permit a POA&M at Level 1; every requirement must be met.

Sources

32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (checked Oct 28, 2026)
Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)

Get quotes from matching firms

Describe what you need once. It goes to up to 3 matching firms, never published or sold.

Request quotes

Independent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.