If your DoD contracts involve Federal Contract Information (FCI) but no Controlled Unclassified Information (CUI), CMMC Level 1 is your requirement. It has three parts: the 15 security requirements in FAR 52.204-21, an annual self-assessment, and a senior official's annual affirmation. No third-party assessor is required. It's the most manageable tier of CMMC, and with the right help it's quick to get right. Here's what Level 1 actually asks of you, where contractors trip, and how we make it simple.
Get Level 1 Done RightLevel 1 covers contractors whose systems store, process, or transmit Federal Contract Information. FCI is information provided by or generated for the government under contract that isn't intended for public release. Think contract documents, technical correspondence, performance reports. The requirements come from FAR 52.204-21's basic safeguarding rules, expressed in CMMC as 15 security requirements. Earlier CMMC versions counted them as 17 practices by splitting two physical-protection items; the final rule counts 15. There's no CMMC Third-Party Assessment Organization (C3PAO) and no certification audit at Level 1. You assess yourself every year and record the result in the Supplier Performance Risk System (SPRS). A senior company official then affirms it. That affirmation is a certification to the federal government — which is exactly why it's worth getting the details right. Our Level 1 services are built to be quick, contained, and proportionate to the requirement.
Explore Readiness Assessment ServicesA focused review of your environment against all 15 requirements. You get a punch list of exactly what passes, what doesn't, and what to fix — not an oversized enterprise assessment for a Level 1 problem.
Hands-on help closing the gaps: multi-factor authentication and access cleanup, patching and malware protection, and physical and media controls. You also get the documentation to show each practice is actually in place.
We prepare you to run the annual self-assessment yourself. You get templates, evidence checklists, and a review of your results with our team before your SPRS submission and affirmation.
Level 1's practices map to the basic safeguarding requirements of FAR 52.204-21, across six areas. None of them require enterprise tooling — they require discipline.
Limit system access to authorized users, devices, and processes. Limit what each user can do to what their job requires. Control connections to external systems and what gets posted publicly.
Know who's on your systems: identify every user uniquely and authenticate them before granting access. Shared logins fail this on the spot.
Sanitize or destroy drives, disks, and other media containing FCI before disposal or reuse — the practice small contractors most often forget to document.
Limit physical access to systems and facilities to authorized people; escort visitors, log physical access, and manage who holds keys and badges.
Monitor and control communications at your network boundary, and keep public-facing systems — like your website — separated from internal networks that hold FCI.
Fix flaws promptly, run malware protection and keep it current, and scan files arriving from email and external sources before they land.
Once a year, you assess your environment against all 15 requirements and record the result in SPRS, the DoD's Supplier Performance Risk System. A senior company official then affirms continuing compliance — also annually. The CMMC acquisition rule is now in effect, and CMMC requirements are appearing in new DoD solicitations. Expect that affirmation to be a precondition for new awards.
Treat the affirmation with the seriousness of any certification made to the federal government. It attaches a named executive to a factual claim about your security. The good news is that Level 1 is small enough to verify properly — an afternoon of honest checking beats a year of assumed compliance.
Five patterns account for most of the failed practices we see:
1. Shared and stale accounts — group logins, ex-employees with live credentials, and admin rights handed out for convenience.
2. No boundary between public and internal — the public website, guest Wi-Fi, and FCI file shares all living on one flat network.
3. Undocumented physical controls — visitors wander unescorted, nobody logs access, and server hardware sits in an unlocked closet.
4. Media that never dies properly — old laptops and drives leave the building with FCI still readable on them.
5. "Our IT provider handles it" — assumed compliance with no evidence. If you can't show a practice is in place, you can't affirm it.
Level 1 only holds if FCI is genuinely all you touch — and in practice, CUI creeps. A drawing with a distribution statement lands in email. An export-controlled spec arrives from a prime. A program office shares marked technical data. Once CUI touches your systems, Level 2's 110 controls apply, with self-assessment for some contracts and C3PAO assessment for others. The Phase 2 rollout of third-party C3PAO assessments is paused pending the program review announced on July 13, 2026. If any of that sounds familiar, size the real requirement before you affirm the wrong one.
See CMMC Level 2 Compliance ServicesLevel 1 shouldn't require an open-ended consulting arrangement, so we deliver it as a contained engagement. It includes a readiness check, a remediation punch list, and implementation help where you want it. Self-assessment preparation runs through your SPRS submission and affirmation. If you'd rather have ongoing cover, the same team behind our Level 2 clients is available for the long haul. That team includes former Big Four auditors and top-tier security engineers.
Read the CMMC 2.0 OverviewVisit Our CMMC FAQAt Cybersecurity Maturity Model Certification (CMMC) Level 1, most of the work is building controls rather than assessing them. Our CMMC implementation services set up each control in your environment and document how it works. That covers access control and account hygiene, media handling and sanitization, physical access controls, boundary protection, malware defenses, and patching.
We also help you gather the evidence behind your annual self-assessment, from account lists to visitor logs. That evidence supports the results and affirmation your company submits to the Department of Defense (DoD) through SPRS. Level 1 allows no Plan of Action and Milestones (POA&M), so every requirement must be met when you assess.
The affirmation covers continuing compliance, so the controls must keep working between assessments. New hires, departing staff, replaced laptops, and office moves all affect them. If you'd rather hand off that upkeep, we offer CMMC-compliant managed security services.
Most defense contractors can meet Level 1 contract requirements with a small, well-documented set of controls. Maintaining compliance is usually harder than reaching it, and a managed service keeps that work on schedule.
We run CMMC programs at both levels, from the first gap review to readiness for formal CMMC assessments. Our client RPS Defense achieved CMMC Level 2 with a score of 110 out of 110, assessed by A-LIGN. Level 1 compliance requirements are where that CMMC compliance work begins.
A contract that brings CUI into your systems moves you to Level 2, which is based on NIST SP 800-171. Your Level 1 controls stay part of that work, and we support it through our CMMC Level 2 compliance services. Companies in the defense industrial base (DIB) can keep one CMMC provider across both levels through our CMMC consulting services.
.svg)
