CMMC Level 1 Self-Assessment Guide: The 15 Requirements, Evidence and Annual Affirmation

Every defence contractor that handles Federal Contract Information (FCI) must self-assess against 15 basic safeguarding requirements, score every one of them MET, and have a senior official affirm the result in SPRS every year, with no plan of action allowed for gaps. Level 1 looks small next to Level 2, but the affirmation is a signed statement to the government, and the Department of Justice treats knowing misrepresentation of cybersecurity practices as a False Claims Act matter. This guide walks through the 15 requirements one by one, the assessment objectives behind them, the evidence that satisfies them, scoping, the SPRS submission and the affirmation. It is written for small and mid-sized suppliers, their IT providers and the person who will sign. Controlled Unclassified Information (CUI) and Level 2 are covered in the CMMC 2.0 Level 2 Assessment Guide.

Source note: requirement text, assessment rules and status below are taken from FAR 52.204-21, 32 CFR 170.15, 170.22, DFARS 252.204-7021 and the DoD CIO CMMC pages and guides as read on 11 November 2026. The programme is under review and details may change. Confirm against the official text before relying on it.

Key takeaways

• Level 1 is still required. The DoD CIO "About CMMC" page states Phase II was suspended on 13 July 2026, but Phase I self-assessment requirements "remain firmly in place" and the programme "may only require self-assessments at two levels".
• All 15 or nothing. Under 32 CFR 170.15 the organisation "must complete and achieve a MET result for all security requirements", and "No POA&Ms are permitted for CMMC Level 1."
• Assess at objective level. The 15 requirements break into the NIST SP 800-171A objectives listed in 170.15 Table 2; one NOT MET objective fails the whole requirement.
• The affirmation carries the risk. A senior Affirming Official attests in SPRS that the company "has implemented and will maintain implementation" of all requirements, at each assessment and annually.
• Keep evidence for six years. Artifacts must be retained for six years from the CMMC Status Date, so build the evidence pack as if someone will ask for it.

Where Level 1 sits in 2026

CMMC Level 1 (Self) applies to contracts where the contractor processes, stores or transmits FCI but not CUI. FCI, as defined in 48 CFR 4.1901 and repeated in the DoD Level 1 Assessment Guide, is information not intended for public release that is provided by or generated for the government under a contract to develop or deliver a product or service. It excludes information the government publishes and simple transactional information such as that needed to process payments. Typical FCI includes statements of work, delivery schedules, technical drawings that are not CUI, and contract correspondence.

Level 1 does not require a System Security Plan. The DoD Level 1 Scoping Guide recommends one as good practice, and in practice a short SSP is the easiest way to show scope, owners and how each requirement is met. See the NIST SP 800-171 and CMMC 2.0 Guide for how the levels, DFARS clauses and SPRS fit together.

Scoping a Level 1 self-assessment

Level 1 scoping is simpler than Level 2. The Level 1 Scoping Guide (version 2.13, September 2024) has two outcomes for most assets: in scope if it processes, stores or transmits FCI, out of scope if it does not. A third group, specialised assets, can handle FCI but cannot be fully secured, and is not assessed against the requirements.

• People: employees, contractors, vendors and external service provider staff who handle FCI. This list feeds IA.L1-b.1.v.
• Technology: servers, laptops, mobile devices, firewalls, switches, access points, VoIP, applications, virtual machines and databases. This feeds AC.L1-b.1.iii and SC.L1-b.1.x.
• Facilities: offices, satellite sites, server rooms, data centres, plants and secured rooms.
• External service providers: cloud, managed service and managed security providers. The Assessment Guide allows a requirement to be MET by an ESP where there is adequate evidence that the ESP implements the objectives.
• Specialised assets: government furnished equipment, IoT and industrial IoT, operational technology, restricted information systems and test equipment.

Paper counts. The Scoping Guide treats FCI at rest on paper as stored, so filing cabinets and printers sit inside the physical requirements. A new assessment is needed only for significant architecture or boundary changes such as mergers or network expansion; routine changes inside the boundary are covered by the annual affirmation. Keeping FCI in one cloud tenant with managed devices is the usual way to keep scope small. See the CMMC Scoping Guide.

The 15 requirements and what satisfies them

The identifiers below come from the DoD Level 1 Assessment Guide. The requirement wording is from FAR 52.204-21(b)(1). The SP 800-171 Rev. 2 numbers are the matching CUI requirements whose 800-171A objectives are used, with FCI substituted for CUI, as 170.15 directs; requirement ix maps to three, which is why Table 2 holds 17 mappings for 15 requirements.

Objectives that are most often missed

• Processes and devices, not only users: AC.L1-b.1.i has six objectives, [a] to [f]. Three cover processes acting on behalf of users and devices. Scripts, backup agents, scanners and SaaS integrations are processes; if they are not identified and limited, the requirement is NOT MET even with perfect user accounts.
• Authentication of processes and devices: IA.L1-b.1.vi objectives [b] and [c] require each process and device to be authenticated or verified before access. A shared API key with no owner, or a printer joined with a default password, fails them.
• Visitor and physical access logs: PE.L1-b.1.ix bundles escorting, monitoring, logging and access device management. Small firms often escort visitors but keep no log.
• Internal boundaries: SC.L1-b.1.x mentions key internal boundaries as well as the internet edge. A flat network with guest Wi-Fi bridged to the office LAN also undermines SC.L1-b.1.xi.

How findings are scored

Each requirement receives MET, NOT MET or NOT APPLICABLE. The Level 1 Assessment Guide, following 32 CFR 170.24, sets the rules below.

A third party can perform the work, but the Assessment Guide is clear that it remains a self-assessment and does not result in certification. The outputs are the SPRS submission and a self-assessment report.

How to run the self-assessment

1. Confirm the contract need: read the solicitation or contract for DFARS 252.204-7021 and FAR 52.204-21 and the CMMC level required. Check whether any data is actually CUI; if it is, Level 1 is the wrong target. See the CUI Guide.
2. Map where FCI lives: email, file shares, cloud storage, ERP, laptops, phones, printers and paper. Record people, technology, facilities and ESPs in a one-page scope statement with a simple diagram.
3. Appoint the Affirming Official early: a senior representative who will sign must understand what is being attested before the work starts, not after.
4. Gap check against objectives: walk the 800-171A objectives for each requirement, substituting FCI for CUI. Interview the IT provider; examine settings; test a sample (try to log in with a disabled account, check that a test file is scanned, confirm a visitor log entry exists).
5. Fix before you record: because no POA&M is allowed, close gaps first. Common quick fixes: remove shared accounts, enforce MFA on email and remote access, change default device passwords, separate guest Wi-Fi, turn on automatic updates, start a visitor log.
6. Assemble final evidence: approved policies, screenshots with dates, exports and logs, filed per requirement. Note which evidence comes from an ESP and what its documentation says it covers.
7. Write the self-assessment report: per objective result, evidence reference, method used, assessor names and date.
8. Submit in SPRS: 170.15 requires at minimum the CMMC level, CMMC Status Date, assessment scope, all CAGE codes tied to in-scope systems, and the compliance result. Then the Affirming Official affirms. Give the resulting CMMC UID to the contracting officer, as DFARS 252.204-7021(e) requires.
9. Schedule the next cycle: the self-assessment and the affirmation repeat annually. Set a reminder at least 60 days before the status date (an NHI Mgmt Group recommendation, not a rule).

If something regresses during the year, such as MFA switched off for a migration, fix it promptly and record the change. If the environment is materially changed, reassess. Do not carry an affirmation you know is no longer true.

The affirmation and why it matters

Under 32 CFR 170.22 every organisation seeking assessment, prime or subcontractor, has an Affirming Official, "the senior level representative from within each Organization Seeking Assessment". The affirmation records the official's name, title and contact details and attests that the company "has implemented and will maintain implementation of all applicable CMMC security requirements" for every system in scope. At Level 1 it is due when the self-assessment completes and annually after that.

The forward-looking wording ("will maintain") is the point people miss: it is a continuing promise, not a snapshot. The DOJ Civil Cyber-Fraud Initiative, announced on 6 October 2021, uses the False Claims Act against contractors who knowingly misrepresent their cybersecurity practices or protocols. An inaccurate SPRS affirmation is the kind of statement that initiative targets. The practical defence is simple: an evidence pack that matches what was affirmed, and a record of fixes when things changed.

• Small organisations: the owner or managing director is usually the Affirming Official. A two-hour walkthrough of the evidence with the IT provider before signing is a reasonable minimum.
• Larger organisations with several business units: each in-scope system set has its own CMMC UID. Name one Affirming Official per scope and require written sign-off from system owners before each annual affirmation.
• Subcontractors: DFARS 252.204-7021(d)(4) requires primes to ensure subcontractors affirm before award and annually. Expect primes to ask for your SPRS status and UID.

Where identity fits

Five of the 15 requirements are identity requirements, and three of them name processes and devices explicitly. That brings non-human identities into Level 1 scope: service accounts for backups and scanners, API keys used by accounting or ERP integrations, OAuth apps connected to the email tenant, and shared mailbox credentials used by scripts. Inventory them, give each an owner, remove those not needed, and make sure each authenticates with its own credential rather than a person's password. The same applies to managed service provider accounts: one named account per technician, not a shared admin login. See the Defence Industrial Base Identity Security Guide and the MFA Guide.

Measurement

Level 1 does not require continuous monitoring, but the "will maintain" promise is easier to defend with a few numbers reviewed each quarter:

• Account hygiene: percentage of in-scope accounts mapped to a named person or owner (target 100%), and count of shared accounts (target zero).
• Authentication coverage: percentage of users with MFA on email and remote access.
• Patch timeliness: percentage of in-scope endpoints with operating system updates installed within the policy window.
• Anti-malware health: percentage of devices reporting real-time protection on and current definitions.
• Leavers: median days from departure to account disablement.
• Visitor logging: spot check of log completeness against reception or calendar records.

Framework mapping

The SP 800-53 and CSF entries are NHI Mgmt Group mappings for orientation; the authoritative mapping for assessment is the 800-171A objective list in 32 CFR 170.15 Table 2.

Common failure patterns

• Affirming without assessing: a score entered in SPRS with no objective-level working or evidence pack behind it. Under the False Claims Act lens this is the highest-risk mistake.
• Treating Level 1 as users only: service accounts, integrations and devices left out of AC.L1-b.1.i and IA.L1-b.1.vi, so objectives [b], [c], [e] and [f] fail.
• Relying on a provider without evidence: "the MSP handles it" is not evidence. Get written confirmation of what the provider does for each requirement, and screenshots from its tools. See Choosing an IT Support Provider or MSP Securely.
• Forgetting paper and premises: printed drawings on open desks and no visitor log fail the physical requirements regardless of IT controls.
• Draft policies: unapproved or undated documents are not acceptable evidence under 170.24.
• Letting the year lapse: missing the annual reassessment and affirmation leaves the company without a current status, which DFARS 252.204-7021(d)(1)(i) requires for the life of the contract.

Practitioner checklist

• Confirm the contract requires Level 1 and that no data handled is CUI.
• Write a one-page scope: people, technology, facilities, ESPs, specialised assets, and where paper FCI is kept.
• Name the Affirming Official and brief them on the continuing nature of the attestation.
• Assess every 800-171A objective mapped in 170.15 Table 2, substituting FCI for CUI, and record results per objective.
• Inventory and assign owners to service accounts, API keys and integrations; remove shared logins.
• Close every gap before submission; there is no POA&M at Level 1.
• File approved, dated evidence per requirement and retain it for six years from the CMMC Status Date.
• Submit level, status date, scope, CAGE codes and result in SPRS; affirm; give the CMMC UID to the contracting officer.
• Diary the annual reassessment and affirmation, and reassess after major boundary changes.

Standards and references

• eCFR: 32 CFR 170.15 CMMC Level 1 self-assessment and affirmation requirements
• eCFR: 32 CFR 170.22 Affirmation
• Acquisition.gov: FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems
• Acquisition.gov: DFARS 252.204-7021 Contractor Compliance with the CMMC Level Requirement
• DoD CIO: CMMC Assessment Guide Level 1
• DoD CIO: CMMC Scoping Guide Level 1
• DoD CIO: About CMMC
• US Department of Justice: Civil Cyber-Fraud Initiative announcement

Related NHI Mgmt Group resources: NIST SP 800-171 and CMMC 2.0 Guide · CMMC 2.0 Level 2 Assessment Guide · CMMC Scoping Guide · Defence Industrial Base Cyber Rules. This guide summarises the CMMC Level 1 self-assessment and affirmation rules and is not legal advice.