CMMC Level 1 applies to defense contractors that handle Federal Contract Information (FCI) but not Controlled Unclassified Information. It requires the 15 basic safeguarding requirements in FAR 52.204-21, plus an annual self-assessment and affirmation in SPRS by a senior company official.
15
Requirements in FAR 52.204-21
Annual
Self-assessment and affirmation
0
Open POA&Ms allowed at Level 1
SPRS
Where results and affirmations are posted
Sources: FAR 52.204-21; 32 CFR Part 170. Rollout status as of October 2026.
How we help
A short, defined project.
We find where FCI lives, put the 15 requirements in place, collect evidence for each one, and prepare the self-assessment for your affirming official. A small environment can take a few weeks.
If your contracts also involve CUI, we scope Level 2 at the same time so the work is not repeated. For defense suppliers along Colorado’s Front Range, on-site work is available.
Basic safeguarding
Fifteen requirements, and every one must be met.
Tap a requirement to read its text.
Every year
Self-assess
↓
Affirm in SPRS
↓
Repeat every year
No POA&Ms at Level 1. Every requirement must be met.
FAR 52.204-21(b)(1)(i)–(xv); 32 CFR Part 170.
Level 1 or Level 2
The level depends on the data you handle.
Level 1
FCI only
The 15 FAR 52.204-21 requirements. Annual self-assessment and affirmation. Every requirement must be met before you affirm.
FAR 52.204-21
Level 2
CUI
The 110 requirements in NIST SP 800-171 Rev 2. A self-assessment or a C3PAO assessment every three years, depending on the contract.
NIST SP 800-171 Rev 2
Most companies that handle CUI also handle FCI, so a Level 2 program covers Level 1. If you are not sure which data you hold, scope that first, because it decides the rest. See CMMC Level 2.
Common questions
CMMC Level 1 questions.
What do the 15 requirements cover?
Limiting system access to authorized users and devices, identifying and authenticating users, sanitizing media before disposal, limiting physical access, protecting the network boundary, fixing flaws promptly, and running malware protection. A well-run small IT environment meets many of them already, but each one needs evidence.
Is CMMC required right now?
Phase 1 began on November 10, 2025, so new DoD solicitations can require a Level 1 self-assessment. Phase 2, which adds third-party Level 2 assessments, was suspended on July 13, 2026, pending review. FAR 52.204-21 and DFARS 7012 obligations still apply. This is the status as of October 2026.
Can we use a plan of action (POA&M)?
No. At Level 1, every requirement must be met before your company affirms.
Who submits the affirmation?
A senior official at your company affirms the results in SPRS each year. We prepare the assessment and evidence with your team, and your company submits the affirmation.
Have a Level 1 clause in a contract?
On a scoping call we’ll confirm whether you need Level 1 or Level 2 and what it will take.
