A CMMC Level 1 self-assessment means checking your own systems that handle Federal Contract Information (FCI) against the 15 basic safeguarding requirements in FAR 52.204-21. Every requirement must be MET, no plan of action is allowed, and a senior official affirms the result in SPRS every year (32 CFR 170.15).
What does a Level 1 self-assessment actually require?
The rule sets four conditions (32 CFR 170.15, checked 2026-10-31):
- Score every Level 1 security requirement as MET. No POA&Ms are permitted at Level 1.
- Repeat the self-assessment every year and submit the result in SPRS (the Supplier Performance Risk System, or its successor).
- Have an Affirming Official affirm the status (32 CFR 170.22).
- Keep the evidence you used for six years from the CMMC Status Date.
The Level 1 requirements are "those set forth in 48 CFR 52.204-21(b)(1)(i) through (xv)" (32 CFR 170.14(c)(2)). That's 15 items. Some CMMC material counts 17 practices because item (ix), on physical access, holds three separate actions. The rule counts 15 (89 FR 83092).
Which systems are in scope?
Start with where FCI lives. FCI is information "not intended for public release" that is provided by or generated for the government under a contract, not counting public information or simple transactional information such as payment processing (FAR 52.204-21(a)). List every system that stores, processes or transmits it: laptops, file shares, email, cloud storage, the printer that prints contract documents. Your SPRS entry has to name the assessment scope and all the CAGE codes associated with those systems.
What is on the Level 1 checklist?
Answer each row MET or NOT MET. These are the 15 FAR items; item (ix) is shown as three rows (9 to 11), so item (ix) is MET only when all three are. The wording follows FAR 52.204-21(b)(1). The last column is an example of what to keep as evidence, not a required format.
| # | FAR item | Practice | Evidence to keep (example) |
|---|---|---|---|
| 1 | (i) | Limit system access to authorized users, processes acting for them, and devices | User and device list; access approvals |
| 2 | (ii) | Limit users to the transactions and functions they are permitted to run | Role or permission settings |
| 3 | (iii) | Verify and control connections to, and use of, external systems | Approved-services list; firewall or app settings |
| 4 | (iv) | Control information posted or processed on publicly accessible systems | Review step before website or social posts |
| 5 | (v) | Identify users, processes acting for users, and devices | Unique accounts; device inventory |
| 6 | (vi) | Authenticate those identities before allowing access | Sign-in settings, password policy |
| 7 | (vii) | Sanitize or destroy media containing FCI before disposal or reuse | Disposal log or vendor receipt |
| 8 | (viii) | Limit physical access to systems, equipment and their environments to authorized individuals | Badge or key list |
| 9 | (ix) | Escort visitors and monitor visitor activity | Visitor policy; sign-in sheet |
| 10 | (ix) | Maintain audit logs of physical access | Visitor or badge logs |
| 11 | (ix) | Control and manage physical access devices | Key and badge register |
| 12 | (x) | Monitor, control and protect communications at external and key internal boundaries | Firewall configuration |
| 13 | (xi) | Put publicly accessible components on subnetworks separated from internal networks | Network diagram |
| 14 | (xii) | Identify, report and correct system flaws in a timely manner | Patch records |
| 15 | (xiii) | Protect against malicious code where appropriate | Endpoint protection settings |
| 16 | (xiv) | Update malicious code protection when new releases are available | Update settings or reports |
| 17 | (xv) | Run periodic scans, plus real-time scans of files from external sources when downloaded, opened or executed | Scan schedule and results |
How do you run the self-assessment, step by step?
- List the systems that handle FCI (see scope above).
- Go through the rows. For each, write down what you do today and where your proof is.
- Mark MET only where the practice is in place. A gap is NOT MET, and Level 1 has no POA&M, so fix it before you affirm.
- Save the evidence. The rule requires six years from the CMMC Status Date.
- Enter the result in SPRS: the CMMC level, status date, assessment scope, all associated CAGE codes and the compliance result (32 CFR 170.15).
- Have the Affirming Official affirm in SPRS. 32 CFR 170.22 describes this person as the senior-level representative from within your organization who is responsible for ensuring its compliance with the CMMC Program requirements and has the authority to affirm its continuing compliance.
- Put the next one on the calendar. The self-assessment and affirmation repeat annually.
Do you need a third-party assessor at Level 1?
No. Level 1 is a self-assessment, and the status is "Level 1 (Self)" (32 CFR 170.15). Whether your contract needs Level 1 or something higher depends on the type of information you handle, so check your contract's clauses.
Frequently asked questions
How many requirements are there? Fifteen. 32 CFR 170.14(c)(2) lists the requirements in FAR 52.204-21(b)(1)(i) through (xv). Some CMMC material splits item (ix) into three practices and counts 17. Use the count your contract or assessor names.
Can I use a plan of action for a practice I haven't met? Not at Level 1. 32 CFR 170.15 says no POA&Ms are permitted, and every requirement must be scored MET.
Who signs the affirmation? The Affirming Official: the senior-level representative from within your organization who is responsible for ensuring its compliance with the CMMC Program requirements and has the authority to affirm its continuing compliance (32 CFR 170.22). Pick the person with that authority, not whoever happened to do the checking.
How often do I repeat it? Every year. The self-assessment is repeated annually and the result resubmitted in SPRS, with the affirmation made at completion and annually after that.
Does Level 1 produce a numeric score? The result is entered in SPRS as a compliance result, MET across the board or not, rather than a numeric score.
Next step
You can answer these requirements in a spreadsheet, or you can do it in ComplianceONE. Under Compliance > Self-Assessment there is a CMMC Level 1 self-assessment, pass or fail, with an annual affirmation. In the gap assessment, the Level 1 questions sit in a single "CMMC Level 1 Assessment" tab. CMMC Level 1 is completely free, with no credit card. You request an account and our team approves each one.
This post explains public rules and is not legal advice. Completing a checklist does not by itself make a system compliant, and ComplianceONE does not certify or assess you. Check your contract for the CMMC level it requires.