CMMC level 1 self-assessment depends on evidence, not intent

At a glance

What this is: This is a step-by-step walkthrough for completing a CMMC Level 1 self-assessment, with a strong emphasis on inventory, evidence, remediation, and formal sign-off.

Why it matters: It matters because CMMC Level 1 is as much a governance exercise as a security one, and IAM teams often own the evidence for access control, authentication, and documentation practices.

By the numbers:

• CMMC Level 1 requires 17 practices to be documented and assessed.

Context

CMMC Level 1 is a documentation-heavy compliance process, not just a checklist exercise. Organisations handling Federal Contract Information must be able to show that required practices exist, that evidence supports each one, and that the result can survive review against the contract scope and official guidance. The control problem is governance consistency, not simply policy presence.

For identity teams, the article is a reminder that access control evidence is part of compliance evidence. Directory permissions, authentication settings, access logs, and owner assignments all become proof points in a defence-grade assessment process. That makes identity operations, evidence handling, and remediation tracking part of the same control fabric.

Key questions

Q: What should teams do first when preparing a CMMC Level 1 self-assessment?

A: Start by confirming whether the organisation handles Federal Contract Information only or also Controlled Unclassified Information. That scope decision determines whether Level 1 applies at all and prevents teams from documenting the wrong control set. After that, build the evidence register and assign an owner for every required practice.

Q: Why do CMMC self-assessments fail when controls exist on paper?

A: They fail when the organisation cannot prove implementation with current evidence. A checklist marked MET without supporting artefacts, ownership, and remediation records is weak during review because assessors evaluate traceability as well as control presence. Evidence quality is the difference between a claim and a defensible compliance position.

Q: What do teams get wrong about documenting Security Protection Assets for CMMC?

A: Teams often treat Security Protection Assets as supporting infrastructure only, then under-document the data and control relationships that make them in scope. If an SPA stores Security Protection Data, or if it helps enforce the controls protecting CUI, it needs the same disciplined inventory, SSP, and diagram treatment. Missing that link creates scope gaps and audit friction.

Q: Who should be accountable for NIST and CMMC self-assessment readiness?

A: Accountability should sit with a cross-functional team, not a single department. IT, compliance, HR, and operational owners each hold part of the evidence and control picture. Senior leadership should ensure the assessment is resourced, while control owners validate documentation and remediation. That shared accountability reduces blind spots and makes the readiness decision defensible.

Technical breakdown

How CMMC Level 1 evidence is assembled

A CMMC Level 1 self-assessment is only as defensible as the evidence chain behind each practice. The article’s workflow shows the practical mechanics: inventory every required practice, assign an owner, capture proof such as screenshots, logs, and policy documents, then tie each item to a MET, NOT MET, or N/A status. The crucial control concept is traceability. Without a clear link between practice, evidence location, owner, and status, the assessment becomes a declaration rather than a verifiable compliance record. See the GRC Maturity Model.

Practical implication: Build the assessment around evidence traceability, not around a completed checklist.

Why access control proof matters in CMMC assessments

Access control is one of the clearest places where security operations and compliance intersect. The article calls for evidence such as user permissions or authentication settings from a directory service, which is exactly the kind of artefact assessors expect when a practice must be shown rather than asserted. In practice, the issue is not whether access exists, but whether the organisation can prove that access is configured, reviewed, and owned in a way that matches the assessed scope.

Practical implication: Keep exportable access evidence and ownership records available for every assessed system.

How remediation turns a self-assessment into a control programme

The walkthrough treats NOT MET findings as remediation inputs, not as assessment failures. That matters because the control lifecycle does not end when a gap is identified. Organisations need a repeatable path from gap identification to corrective action, validation, and retention of the final artefact set. This is especially important where the same weaknesses recur year to year, because annual recertification without durable remediation simply recreates the same assurance problem.

Practical implication: Track remediation to closure and preserve proof that the gap was actually fixed.

Threat narrative

Attacker objective: The objective is not theft but compliance failure, meaning the organisation cannot reliably defend its Level 1 status during contract review or validation.

1. Entry begins with an organisation accepting CMMC scope without confirming whether it handles FCI only or also CUI, which can place the wrong practices under review.
2. Credential and control evidence are then gathered from directory services, logs, policies, and physical access records, but weak records or undocumented exceptions create an assessment gap.
3. Escalation occurs when the self-assessment is signed off without defensible evidence or when remediation is not closed before affirmation, leaving the organisation exposed to review failure.
4. Impact is contract risk, because an unsupported Level 1 claim can undermine eligibility and weaken confidence in the organisation’s compliance posture.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Evidence, not intention, is the real compliance control: CMMC Level 1 is structured around what can be demonstrated, not what a team believes it has done. The article’s insistence on evidence location, ownership, and status shows that assessment quality depends on record integrity as much as control presence. For IAM and GRC teams, that means access evidence must be maintained as an operational asset, not assembled ad hoc at audit time.

Identity evidence is part of defence readiness: directory permissions, authentication settings, and access logs are not just technical artefacts, they are compliance evidence. In practice, this creates a direct bridge between identity administration and contract eligibility, especially where the organisation’s proof of control comes from identity systems. Teams that cannot evidence identity controls cannot credibly claim readiness.

Annual reassessment exposes weak governance memory: the article makes clear that documentation must survive year-to-year change, not just a single review cycle. That is a governance issue, because personnel turnover, system changes, and delayed remediation all erode the continuity of evidence. The organisation that treats the checklist as a living record is the one that can sustain compliance rather than merely pass a momentary test.

CMMC compliance is a control system, not a filing exercise: the strongest message in the walkthrough is that remediation, sign-off, and record retention are one lifecycle. If the evidence trail is incomplete, the organisation has not merely missed paperwork, it has failed to operationalise assurance. Practitioners should treat this as a governance discipline with audit consequences, not as a one-time administrative task.

What this signals

Control evidence will increasingly be treated as operational infrastructure: organisations that can continuously produce proof of access, authentication, and remediation will move faster through annual reassessment. The programme lesson is simple: compliance stamina depends on maintaining evidence continuously, not assembling it late.

The strongest CMMC programmes will be the ones that connect identity administration, logging, and remediation tracking into a single governed workflow. That is the difference between a checklist that survives one review and a control environment that stays ready throughout the year.

For practitioners

• Define the assessed scope first Confirm whether the organisation handles FCI only or also CUI before building the assessment package, because the scope determines whether Level 1 is the right target.
• Create a practice-level evidence register Track each of the 17 practices with an owner, evidence location, and current status so every assertion can be traced back to a source artefact.
• Collect identity and access evidence early Export directory permissions, authentication settings, and access logs before assessment day so access control claims are supported by current records.
• Treat NOT MET items as remediation work items Assign deadlines, owners, and verification steps for every gap, then retain proof that the control was corrected rather than merely noted.
• Keep annual documentation ready for review Store the signed affirmation, prior-year evidence, and any remediation records in a secure repository so the next self-assessment starts from a complete baseline.

Key takeaways

• CMMC Level 1 self-assessment is a proof exercise, not a paperwork exercise, and undocumented claims are weak under review.
• The article’s core evidence model depends on named ownership, current artefacts, and remediation records that survive annual reassessment.
• Identity records such as permissions, authentication settings, and access logs are central to making a Level 1 claim defensible.

Related NHI Mgmt Group resources: GRC Maturity Model · Identity Security Maturity Model · CUI Guide

Key terms

• CMMC Level 2 Self-Assessment: A contractor-led evaluation of whether implemented controls meet CMMC Level 2 requirements. The organisation scores its own environment and submits the result, so the quality of the evidence, scope, and interpretation directly affects whether the attestation is defensible.
• Federal Contract Information: Federal Contract Information is information created for or provided by the government under contract that is not intended for public release. It usually requires protection, but the control burden is lighter than CUI, which is why environment choice and access scoping can differ materially.
• Evidence Trace: The record of queries, source systems, timestamps and artifacts used to support a security verdict. Evidence traces let teams reconstruct machine-led investigations, challenge false conclusions and demonstrate why a containment or escalation decision was made.
• Control ownership: Control ownership is the assignment of responsibility for a security control’s configuration, operation, and evidence. In identity programmes, it determines who reviews changes, who approves exceptions, and who can prove that a control is working as intended.

Deepen your knowledge

NHI Foundation Level course covers NHI governance, machine identity security, and secrets management through the industry's only accredited NHI security programme. It helps practitioners connect identity governance to the broader security and compliance work their programme depends on.