What should teams do first when preparing a CMMC Level 1 self-assessment?

Start by confirming whether the organisation handles Federal Contract Information only or also Controlled Unclassified Information. That scope decision determines whether Level 1 applies at all and prevents teams from documenting the wrong control set. After that, build the evidence register and assign an owner for every required practice.

Start with scope before you score anything

The first job in a CMMC Level 1 self-assessment is to prove the scope is right. Teams should determine whether the environment handles only Federal Contract Information or also Controlled Unclassified Information, because that boundary decides whether Level 1 is the correct target and prevents evidence, controls, and owners being assembled for the wrong regime. For contractors, the scoping and SSP discipline in the NIST SP 800-171 and CMMC 2.0 Guide is the right starting point for that decision.

That same scope check should be tied to how the organisation classifies and handles data. If the team cannot clearly distinguish FCI from CUI, it is too early to write a credible practice inventory or self-assessment narrative. Use the CUI Guide to align the boundary decision with the way CUI is identified, marked, and safeguarded in practice.

Once the scope is fixed, the self-assessment becomes a Level 1 exercise rather than a generic security review. At that point, the work is to map the required practices to the in-scope environment, identify where each practice is already met, and separate actual evidence from assumed coverage.

Build the evidence register around each required practice

After scoping, teams should create an evidence register that lists each required practice, the system or process that supports it, and the specific proof that will be shown during review. This prevents a common failure mode where teams collect screenshots or policies first and only later discover that they cannot connect them to a practice. The register should make it obvious what is implemented, what is procedural, and what is still missing.

The practical standard here is traceability, not volume. A small amount of direct evidence attached to the right practice is better than a large document pile with no clear mapping. The goal is to be able to answer, for every practice, what the control is, where it operates, and what would prove it is in place on the assessed date.

The evidence register is also the point where teams decide whether the assessment is actually ready to run. If a required practice has no named evidence source, no system owner, and no validation path, the assessment will produce guesswork rather than a defensible result.

Assign ownership before you begin the self-assessment

Every required practice needs an owner before the review starts. Ownership is what turns the exercise from a compliance worksheet into an actionable assessment, because someone must confirm the control state, locate the evidence, and close any gap that appears. Without explicit ownership, teams usually end up with duplicated effort on easy items and no accountability on the difficult ones.

Owners should be chosen for operational authority, not for convenience. The person who understands the process, system, or business function should be responsible for the answer, even if another team helps gather the evidence. That separation keeps the self-assessment honest and makes exceptions easier to escalate quickly.

It also helps to treat ownership as part of the evidence itself. If a practice has no accountable owner, the team does not just have a documentation gap, it has a governance gap that can undermine the credibility of the entire self-assessment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	PL-2 — System and Communications Protection Policy and Procedures	CMMC self-assessment depends on defining the in-scope environment and boundary.
	CA-2 — Control Assessments	A self-assessment is an assessment activity that needs traceable evidence and accountable owners.
Recommendation — Document the assessment boundary before collecting evidence or assigning control owners. Use a structured assessment method that ties each practice to specific evidence and an owner.
CIS Controls v8	CIS-1 — Inventory and Control of Enterprise Assets	Scope and ownership both depend on knowing which systems are in the assessment boundary.
Recommendation — Inventory in-scope assets first so evidence and owners align to the assessed environment.
ISO/IEC 27001:2022	A.5.9 — Inventory of information and other associated assets	CMMC scoping depends on identifying what information and assets fall inside the assessment boundary.
Recommendation — Maintain an accurate asset inventory before finalising the self-assessment scope.

Practitioner Guidance

What to prioritise: Lock scope first, then build the practice-to-evidence map, then assign owners. If the scope is uncertain, pause the rest of the assessment until the FCI and CUI boundary is resolved.

What to verify: For each required practice, verify that the evidence actually reflects the assessed environment, not a policy that exists only in another system, business unit, or contract path. A valid self-assessment depends on current operational proof, not inherited assumptions.

Common mistake: Teams often start by collecting controls and documents before confirming whether Level 1 is even the right target. That creates rework and can leave the organisation documenting the wrong control set.

Practitioner takeaway: The first decision is a scoping decision, not a documentation exercise. If the team gets the FCI/CUI boundary right up front, the rest of the self-assessment becomes a controlled evidence and ownership task instead of a speculative search.