Skip to content
Compliance DirectoryGet quotes

CMMC Level 1 Self-Assessment: Requirements and Steps

By Shaheer Malik · Updated Oct 22, 2026

CMMC Level 1 is a yearly self-assessment against the 15 basic safeguarding requirements of FAR 52.204-21. You must meet all 15, enter the result in SPRS and have a senior official affirm it. No Plan of Action and Milestones is allowed, and no C3PAO is involved.[1]

Who needs Level 1

Contractors that handle Federal Contract Information but not Controlled Unclassified Information, when their contract carries a Level 1 requirement.[1] If you also handle CUI, you need Level 2, which covers Level 1 for the same scope.[1]

The steps

  1. Define the scope: the systems, people and places that handle Federal Contract Information.
  2. Assess all 15 requirements against evidence: access control, identification and authentication, media protection, physical protection, system and communications protection, and system and information integrity.[1]
  3. Fix anything not met first. Level 1 has no conditional status: every requirement must be met.[1]
  4. Enter the result in SPRS: the CMMC level, status date, assessment scope, every CAGE code in scope and the compliance result.[1]
  5. Affirm. Your Affirming Official, a senior person with authority over compliance, affirms the result.[1]
  6. Repeat every year.[1]

Do you need help?

Many small contractors do Level 1 in-house. If you want a second pair of eyes, a CMMC consultant (RPO) can review your evidence; a C3PAO is not needed at this level. If Level 2 is coming, read what CMMC certification involves.

FAQ

How many requirements are in CMMC Level 1?

15, taken from the basic safeguarding requirements of FAR 52.204-21.

Can I use a POA&M for CMMC Level 1?

No. The CMMC rule does not permit a Plan of Action and Milestones at Level 1; every requirement must be met.

How often is the Level 1 self-assessment done?

Every year, with the result entered in SPRS and an affirmation by your Affirming Official.

Sources

  1. 32 CFR part 170, CMMC Program (eCFR, text current as of Aug 17, 2026) (checked Oct 22, 2026)

Get quotes from matching firms

Describe what you need once. It goes to up to 3 matching firms, never published or sold.

Request quotes

Independent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.