Topic starter
27/10/2026 7:11 pm
TL;DR: CMMC Level 1 self-assessment hinges on documenting all 17 required practices, assigning ownership, collecting evidence, and remediating gaps before annual affirmation, according to Todyl, because a checklist without proof will not stand up to DoD review.
Editorial analysis by NHI Mgmt Group, based on content published by Todyl: “How to Complete Your CMMC Level 1 Self-Assessment: A Step-by-Step Walkthrough”.
By the numbers:
- CMMC Level 1 requires 17 practices to be documented and assessed.
Key questions
Q: What should teams do first when preparing a CMMC Level 1 self-assessment?
A: Start by confirming whether the organisation handles Federal Contract Information only or also Controlled Unclassified Information.
Q: Why do CMMC self-assessments fail when controls exist on paper?
A: They fail when the organisation cannot prove implementation with current evidence.
Q: What do teams get wrong about documenting Security Protection Assets for CMMC?
A: Teams often treat Security Protection Assets as supporting infrastructure only, then under-document the data and control relationships that make them in scope.
Practitioner guidance
- Define the assessed scope first Confirm whether the organisation handles FCI only or also CUI before building the assessment package, because the scope determines whether Level 1 is the right target.
- Create a practice-level evidence register Track each of the 17 practices with an owner, evidence location, and current status so every assertion can be traced back to a source artefact.
- Collect identity and access evidence early Export directory permissions, authentication settings, and access logs before assessment day so access control claims are supported by current records.
Bottom line: CMMC Level 1 self-assessment is a proof exercise, not a paperwork exercise, and undocumented claims are weak under review.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →