A CMMC Level 1 self-assessment is the annual check a defense contractor performs on its own systems to confirm that they meet the 15 basic safeguarding requirements of FAR 52.204-21 for federal contract information. The results go into the Supplier Performance Risk System (SPRS), and a senior company official affirms them. Every requirement must be met: the CMMC rule does not allow a plan of action and milestones at Level 1.
Level 1 matters more in late 2026, not less. With the transition to third-party Level 2 assessments suspended, self-assessments are the CMMC requirements that remain in force. This guide explains who needs a Level 1 self-assessment, the 15 requirements, and how to complete and affirm it.
What CMMC Level 1 Is and Who Needs It
The CMMC Program, set out in 32 CFR Part 170, has three levels. Level 1 applies to contractors and subcontractors that process, store, or transmit federal contract information (FCI) but not controlled unclassified information (CUI). FCI is information provided by or generated for the government under a contract that is not intended for public release. Many small suppliers, manufacturers, and service providers in the defense supply chain handle only FCI.
| CMMC Level 1 (Self) | CMMC Level 2 (Self) | |
|---|---|---|
| Information protected | Federal contract information (FCI) | Controlled unclassified information (CUI) |
| Requirements | 15 safeguarding requirements from FAR 52.204-21 | 110 requirements from NIST SP 800-171 Rev 2 |
| Who assesses | The contractor, annually | The contractor, every three years |
| Scoring | Met or not met for each requirement | Weighted score starting at 110 |
| Plan of action and milestones | Not permitted | Permitted for some requirements, closed within 180 days |
| Affirmation | After each assessment and annually | After each assessment and annually |
The table shows why Level 1 is simpler but less forgiving. There is no score to fall back on and no conditional status: a contractor either meets all 15 requirements or has no Level 1 status to post.
Where CMMC Stands Now
On July 13, 2026, the Department of War suspended the transition to CMMC Phase 2, which would have made third-party Level 2 certification the default for applicable contracts from November 10, 2026, and put later milestones on hold while a CMMC Reform Task Force reviewed the program. As of mid-October 2026, the Task Force’s report had not been published and no new Phase 2 date had been set. The suspension did not change the self-assessment requirements, the 32 CFR Part 170 rule, or FAR 52.204-21 itself. Elevate’s analysis of what the Phase 2 suspension means covers the details.
The practical result is that a Level 1 self-assessment and affirmation is what a contract can require today for FCI. An affirmation that turns out to be false also carries legal exposure, discussed in Elevate’s article on False Claims Act liability in CMMC compliance.
The 15 Requirements Behind a CMMC Level 1 Self-Assessment
The CMMC rule adopts the security requirements in FAR 52.204-21(b)(1)(i) through (xv) as Level 1. They cover six areas: access control, identification and authentication, media protection, physical protection, system and communications protection, and system and information integrity.
| FAR 52.204-21(b)(1) | Requirement (paraphrased) | Area |
|---|---|---|
| (i) | Limit system access to authorized users, processes acting for them, and devices | Access control |
| (ii) | Limit users to the transactions and functions they are authorized to perform | Access control |
| (iii) | Verify and control connections to and use of external systems | Access control |
| (iv) | Control information posted or processed on publicly accessible systems | Access control |
| (v) | Identify users, processes, and devices | Identification and authentication |
| (vi) | Authenticate those users, processes, and devices before allowing access | Identification and authentication |
| (vii) | Sanitize or destroy media containing FCI before disposal or reuse | Media protection |
| (viii) | Limit physical access to systems, equipment, and operating environments to authorized people | Physical protection |
| (ix) | Escort and monitor visitors, keep physical access logs, and manage physical access devices | Physical protection |
| (x) | Monitor, control, and protect communications at external and key internal boundaries | System and communications protection |
| (xi) | Separate publicly accessible system components from internal networks | System and communications protection |
| (xii) | Identify, report, and correct system flaws in a timely manner | System and information integrity |
| (xiii) | Protect against malicious code at appropriate locations | System and information integrity |
| (xiv) | Update malicious code protection when new releases are available | System and information integrity |
| (xv) | Run periodic system scans and real-time scans of files from external sources | System and information integrity |
Most of these are basic hygiene: accounts, passwords or other authentication, antivirus, patching, a firewall, and physical security. The difficulty is rarely the technology. It is being able to show, with evidence, that each requirement is in place across every system that touches FCI.
Why Some Sources Say 17
Earlier versions of CMMC split requirement (ix) into three separate practices, which produced a count of 17. The current rule uses the 15 requirements of the FAR clause, and assessment guidance still breaks (ix) into its parts for testing. The work is the same; the count of 15 is the one that matches 32 CFR Part 170.
Scope Comes First
The self-assessment covers the assets that process, store, or transmit FCI. Defining that scope before testing prevents two common errors: missing a laptop, cloud service, or file share that holds contract information, and over-scoping systems that never touch it. Elevate’s guide to scoping your environment for CMMC covers the method, and FCI versus CUI explains when Level 2 applies instead.
How to Complete the Self-Assessment and Affirmation
The process has six steps. None requires an outside assessor, but every step should leave a record, because the affirmation is a statement the company may later have to defend.
Step 1: Confirm FCI and Define Scope
Confirm which contracts involve FCI and which people, systems, facilities, and external services handle it. Document the boundary. If any contract also involves CUI, the Level 2 requirements apply to those systems and Level 1 alone is not enough.
Step 2: Assess Each Requirement Against Its Objectives
Assess each of the 15 requirements using the Department’s Level 1 self-assessment guidance, which breaks each requirement into assessment objectives. Assess at the objective level, because a requirement is met only when every one of its objectives is met. For each, record how it is implemented and what evidence shows it: configuration screenshots, policies, access lists, visitor logs, scan reports, or patch records.
Step 3: Close Every Gap Before Posting
32 CFR 170.15 requires a met result for all Level 1 requirements and states that no plans of action and milestones are permitted. A gap must be fixed before the result is posted, not after. This is the main practical difference from Level 2, where some requirements can be closed within 180 days under a conditional status.
Step 4: Post the Result in SPRS
Enter the self-assessment result in SPRS, or its successor system, through the Procurement Integrated Enterprise Environment. The rule requires the self-assessment and the posting every year to maintain Level 1 status.
Step 5: Complete the Affirmation
A senior official of the company, the affirming official, affirms continued compliance in SPRS after each assessment and annually thereafter. This is the step with legal weight. The official should review the evidence, not just the summary, before affirming.
Step 6: Keep the Evidence and Repeat
Retain the self-assessment artifacts; sources tracking the rule cite a six-year retention period. Reassess every year and whenever the environment changes in a way that affects FCI, such as a new system, office, or cloud service.
What It Costs
The Department’s regulatory impact analysis for the CMMC rule estimated an annual cost for a Level 1 self-assessment and affirmation of about $5,977 for a small entity and $4,042 for a larger one. Those are regulatory estimates, not market prices, and they assume the requirements are already implemented. The cost of implementing missing controls is separate.
Elevate helps defense contractors scope, assess, and document CMMC requirements through its CMMC services. For organizations that also handle CUI, the Level 2 self versus certified assessment guide explains the next tier. To review your Level 1 evidence before your affirming official signs, talk to an Elevate advisor.
Conclusion
A CMMC Level 1 self-assessment asks a simple question with no partial credit: are all 15 FAR 52.204-21 requirements met on every system that handles federal contract information? The answer is posted in SPRS and affirmed by a senior official every year, and no plan of action can carry a gap. With third-party Level 2 assessments suspended, this self-assessment is one of the CMMC requirements that contracts can still require today.
The work is manageable for most small contractors: define the FCI scope, assess each requirement at the objective level with evidence, fix every gap before posting, and give the affirming official the evidence before asking for a signature. To review your Level 1 scope and evidence, book a call with an Elevate advisor.
Key Takeaways
A CMMC Level 1 self-assessment confirms, every year, that systems handling federal contract information meet FAR 52.204-21.
- Fifteen requirements, all mandatory. Level 1 adopts FAR 52.204-21(b)(1)(i) through (xv); older counts of 17 split one physical security requirement into three.
- No plan of action is allowed. 32 CFR 170.15 requires a met result for every requirement before status can be posted.
- Annual posting and affirmation. Results go into SPRS each year, and a senior official affirms compliance after each assessment and annually.
- Still in force during the suspension. The July 2026 suspension paused third-party Level 2 and Level 3 assessments, not self-assessments.
- Evidence protects the affirming official. An affirmation without evidence behind it creates False Claims Act exposure.
- Scope decides the effort. Defining which systems touch FCI first avoids both missed assets and unnecessary work.
Frequently Asked Questions
What is a CMMC Level 1 self-assessment?
A CMMC Level 1 self-assessment is an annual assessment a defense contractor performs on its own systems to confirm they meet the 15 basic safeguarding requirements of FAR 52.204-21 for federal contract information. The results are entered in the Supplier Performance Risk System, and a senior company official affirms compliance. It is required under 32 CFR 170.15 for contracts that call for CMMC Level 1.
How many requirements are in CMMC Level 1?
CMMC Level 1 has 15 requirements, the basic safeguarding requirements in FAR 52.204-21(b)(1)(i) through (xv). Some sources cite 17 because earlier versions of CMMC split the visitor, access log, and physical access device requirement into three practices. The current rule at 32 CFR Part 170 uses the 15 FAR requirements.
Can you use a POA&M for CMMC Level 1?
No. 32 CFR 170.15 requires a met result for all Level 1 requirements and states that no plans of action and milestones are permitted for Level 1. Any gap must be fixed before the self-assessment result is posted. Plans of action are allowed only for certain requirements at Levels 2 and 3.
How often is a CMMC Level 1 self-assessment required?
A Level 1 self-assessment must be performed and its results submitted in SPRS every year to maintain Level 1 status. The affirming official must also affirm compliance after each assessment and annually thereafter. Organizations should reassess sooner when changes affect the systems that handle federal contract information.
Is CMMC Level 1 still required after the Phase 2 suspension?
Yes. The July 2026 suspension paused the transition to Phase 2 and its third-party Level 2 and Level 3 assessments, but it did not change the self-assessment requirements or FAR 52.204-21. Contracts can still require CMMC Level 1 (Self). As of mid-October 2026, no new Phase 2 date had been announced.