To get CMMC Level 1 status, confirm that Level 1 applies, define the systems that process, store, or transmit Federal Contract Information, implement all 15 FAR 52.204-21 safeguards, fix every applicable gap, conduct the annual self-assessment, enter the results into SPRS, submit the required affirmation, and repeat the process every year. CMMC Level 1 is self-assessed. It does not require a C3PAO audit or third-party certification assessment. The official result is Final Level 1 (Self) status.
In This Guide
- 01Is CMMC Level 1 Actually a Certification?
- 02Who Needs CMMC Level 1?
- 03CMMC Level 1 vs. Level 2: Which One Do You Need?
- 04What Is Included in the CMMC Level 1 Assessment Scope?
- 05What Are the 15 CMMC Level 1 Requirements?
- 06CMMC Level 1 Process at a Glance
- 07How to Get CMMC Level 1: Step-by-Step
- 08Does CMMC Level 1 Require an SSP or Formal Documentation?
- 09How Long Does CMMC Level 1 Take?
- 10How Much Does CMMC Level 1 Cost?
- 11What Are the Most Common CMMC Level 1 Mistakes?
- 12Does the 2026 CMMC Pause Affect Level 1?
- 13What Happens If Your Organization Starts Handling CUI?
- 14How Nexeris Helps Contractors Prepare for CMMC Level 1
- 15Frequently Asked Questions
Is CMMC Level 1 Actually a Certification?
The phrase CMMC Level 1 certification is commonly used, but the official model identifies it as CMMC Level 1 (Self). The organization conducts its own assessment rather than hiring a C3PAO. After all applicable requirements are satisfied, the results are entered into the Supplier Performance Risk System, or SPRS, and the required affirmation is submitted.
Does CMMC Level 1 Issue a Certificate?
No third-party certificate is issued by a C3PAO. Instead, the organization achieves Final Level 1 (Self) status after completing the annual self-assessment, recording the results in SPRS, and submitting the required affirmation.
Do You Need a C3PAO for Level 1?
No.
A C3PAO is used for applicable Level 2 certification assessments, not Level 1. A consultant can help with readiness, scoping, remediation, and evidence, but the official Level 1 assessment remains a self-assessment.
Who Needs CMMC Level 1?
CMMC Level 1 generally applies to organizations handling Federal Contract Information, or FCI, where the applicable contract requires Level 1.
Level 1 Is for Contractors Handling FCI
FCI is non-public information provided by or generated for the government under a contract to develop or deliver a product or service. It excludes information the government has already made public and simple transactional information such as data used only for payment processing. FCI may appear in email, cloud storage, file shares, laptops, business applications, servers, or other systems used to support government work.
How Do You Know If Level 1 Applies?
Review the relevant contracts, solicitation language, FAR and DFARS clauses, information received from the government, information created for the government, subcontract flow-down requirements, and whether any CUI enters the environment. The applicable level is based on the information and contract requirements, not company size.
What If You Also Handle CUI?
If applicable work involves Controlled Unclassified Information, Level 1 alone may not be sufficient. Level 2 uses the 110 NIST SP 800-171 Revision 2 requirements and introduces substantially more detailed cybersecurity, scoping, documentation, and assessment requirements. Review the CMMC Level 2 requirements if CUI enters the environment.
CMMC Level 1 vs. Level 2: Which One Do You Need?
| Area | CMMC Level 1 | CMMC Level 2 |
|---|---|---|
| Protected information | FCI | CUI |
| Security baseline | FAR 52.204-21 | NIST SP 800-171 Rev. 2 |
| Requirements | 15 | 110 |
| Current assessment model | Annual self-assessment | Self-assessment every 3 years during current Phase I |
| POA&M | Not permitted | Limited use permitted |
| Affirmation | After each annual assessment | After assessment and annually thereafter |
| SPRS | Results and affirmation | Results and affirmation |
This distinction helps contractors avoid building the wrong compliance program.
What Is Included in the CMMC Level 1 Assessment Scope?
The Level 1 scope includes assets that process, store, or transmit FCI. That can include workstations, servers, email systems, cloud platforms, file shares, business applications, network services, and other technology used with FCI.
Which Assets Are Out of Scope?
Assets that do not process, store, or transmit FCI can generally remain outside the Level 1 assessment scope. The important point is that the classification must reflect how the asset is actually used.
How Are Specialized Assets Treated?
Specialized Assets can include IoT, IIoT, Operational Technology, Government Furnished Equipment, Restricted Information Systems, and test equipment. Current Level 1 scoping guidance treats qualifying Specialized Assets differently from ordinary in-scope assets and excludes them from assessment against the Level 1 requirements.
What Are the 15 CMMC Level 1 Requirements?
CMMC Level 1 uses the 15 safeguarding requirements from FAR 52.204-21. They fall into six security families.
Access Control
Organizations must limit system access to authorized users, processes, and devices, restrict users to permitted functions, control external system connections, and prevent FCI from being improperly posted or processed on public systems.
Identification and Authentication
Users, processes, and devices must be identified, and identities must be authenticated before system access is granted.
Media Protection
Media containing FCI must be sanitized or destroyed before disposal or reuse.
Physical Protection
Organizations must limit physical access to authorized individuals, control and monitor visitors, maintain physical-access records, and manage physical-access devices.
System and Communications Protection
Communications must be protected at external and important internal boundaries, and publicly accessible system components should be separated from internal systems where required.
System and Information Integrity
Organizations must identify and correct system flaws, provide protection against malicious code, keep that protection updated, and perform appropriate periodic and real-time scanning.
CMMC Level 1 Process at a Glance
| Step | Action |
|---|---|
| 1 | Confirm Level 1 applies |
| 2 | Define the FCI scope |
| 3 | Review all 15 safeguards |
| 4 | Conduct a gap assessment |
| 5 | Remediate every applicable deficiency |
| 6 | Gather supporting evidence |
| 7 | Complete the self-assessment |
| 8 | Enter results into SPRS |
| 9 | Submit the affirmation |
| 10 | Repeat annually |
How to Get CMMC Level 1: Step-by-Step
Step 1: Confirm Level 1 Is the Correct Requirement
Before changing systems or buying tools, confirm what your contract actually requires. Determine whether the organization handles only FCI or whether CUI is also present. Review prime contractor flow-down requirements as well. Preparing for Level 1 when Level 2 is required can leave a serious compliance gap. Building a Level 2 environment when only Level 1 applies can create unnecessary cost.
Step 2: Map Where FCI Is Processed, Stored, and Transmitted
Identify where FCI enters the organization and how it moves through the environment. Review users, endpoints, applications, email, cloud storage, file shares, servers, facilities, external providers, and network connections. The objective is to establish the real assessment boundary before evaluating safeguards.
Step 3: Compare the Environment Against All 15 Safeguards
Conduct a readiness gap assessment before the formal annual self-assessment. For each safeguard, determine how it is implemented, whether it applies across the full scope, who owns it, and what evidence supports the conclusion. The goal is to identify deficiencies while there is still time to fix them.
Step 4: Remediate Every Applicable Security Gap
Level 1 does not permit POA&Ms. If an applicable requirement is NOT MET, it must be corrected before Final Level 1 (Self) status can be achieved. Common gaps can include inactive accounts, weak authentication, uncontrolled external connections, inadequate visitor tracking, poor media disposal, outdated malware protection, weak boundary controls, or inconsistent patching. Remediation should fix the actual issue, not simply create a policy saying the issue has been addressed.
Step 5: Gather Evidence for Each Requirement
Self-assessment does not mean unsupported self-attestation. Evidence may include account lists, authentication settings, firewall rules, visitor records, malware configurations, patch records, system settings, approved procedures, and other records showing that a safeguard is operating. The official assessment approach uses three methods: examine, interview, and test.
Step 6: Conduct the Formal Level 1 Self-Assessment
The Organization Seeking Assessment performs its own Level 1 assessment. A C3PAO is not required. The organization reviews the applicable assessment objectives and determines whether sufficient evidence supports each safeguard. Examination may involve reviewing configurations and records. Interviews can verify whether responsible personnel understand the process. Testing demonstrates that technical safeguards operate as intended.
Step 7: Record the Assessment Findings
Assessment objectives may be identified as MET, NOT MET, or NOT APPLICABLE where appropriate. A MET finding means the applicable objectives are satisfied. A NOT MET finding means at least one applicable objective has not been demonstrated. A genuinely N/A objective can be treated as equivalent to MET for assessment purposes. However, the overall Level 1 result is MET or NOT MET. All applicable Level 1 requirements must be satisfied to achieve Final Level 1 (Self).
Step 8: Enter the Results Into SPRS
After completing the assessment, enter the Level 1 results into the Supplier Performance Risk System. SPRS records the applicable CMMC assessment information and is a required part of completing the Level 1 process. Level 1 should not be confused with the numeric NIST SP 800-171 scoring model used with Level 2. An FCI-only Level 1 organization does not generate a -203 to 110 score for this process.
Step 9: Submit the Level 1 Affirmation
The required affirmation follows the annual assessment and is also entered through SPRS. The Affirming Official is a senior-level representative responsible for confirming that the organization has implemented and will continue maintaining the applicable CMMC safeguards. This is a formal representation of compliance, not a routine administrative signature.
Step 10: Repeat the Process Every Year
Level 1 must be reassessed annually. Organizations should review changes to users, systems, cloud services, vendors, facilities, and FCI flows before each new assessment. Maintaining evidence continuously makes the next annual review easier and helps prevent security changes from creating unnoticed compliance gaps.
Does CMMC Level 1 Require an SSP or Formal Documentation?
A formal System Security Plan is not a Level 1 requirement in the same way it is associated with the NIST SP 800-171 Level 2 environment. Current Level 1 guidance also does not require organizations to formally document Level 1 asset categories in the same way as Level 2. However, evidence is still necessary.
Do You Still Need Evidence and Records?
Yes.
Useful records include the assessment worksheet, evidence references, scope notes, remediation history, approved procedures, SPRS submission records, and affirmation information. These records make annual reassessment easier and help show that MET findings were based on real implementation.
How Long Does CMMC Level 1 Take?
There is no universal official timeline. An organization with mature basic security controls and a simple FCI environment may become ready relatively quickly. A company with unclear FCI flows, outdated systems, weak physical controls, poor malware protection, or unmanaged accounts may require significantly more remediation. The formal self-assessment itself is usually not the longest part. Scoping, remediation, and evidence preparation often consume most of the time.
How Much Does CMMC Level 1 Cost?
There is no mandatory C3PAO assessment fee because Level 1 is self-assessed. Costs depend primarily on what needs to be fixed. Potential expenses may involve IT labor, security software, firewall or network improvements, account-management changes, malware protection, physical safeguards, policy development, or outside readiness assistance. A business with mature foundational security may have relatively low remediation costs, while an organization with significant weaknesses may need more investment.
What Are the Most Common CMMC Level 1 Mistakes?
Using 17 Requirements Instead of 15
Current Level 1 guidance uses 15 FAR 52.204-21 safeguards. Older references to 17 practices should not be used as the current checklist.
Pursuing Level 1 When You Handle CUI
FCI and CUI should not be treated as the same thing. If applicable CUI enters the environment, review whether Level 2 applies before proceeding with a Level 1-only program.
Hiring a C3PAO for Level 1
Level 1 is self-assessed. A C3PAO certification assessment is not part of the Level 1 process.
Using a POA&M for Open Requirements
POA&Ms are not permitted at Level 1. Unmet applicable requirements must be remediated before Final Level 1 status is achieved.
Treating Self-Assessment as a Checklist
An organization should not mark a safeguard MET without evidence. The assessment should be based on actual configurations, records, processes, interviews, and testing where appropriate.
Forgetting the Annual Affirmation
The assessment and affirmation must be repeated annually. Organizations should build these activities into their recurring compliance calendar.
Does the 2026 CMMC Pause Affect Level 1?
No material change has been made to the Level 1 self-assessment process. On July 13, 2026, the Department suspended CMMC Phase II requirements and began a broader review of the program. Phase I self-assessment requirements remained in place. As of September 2026, Level 1 still requires the 15 FAR safeguards, an annual self-assessment, SPRS submission, no POA&M, and an affirmation after the assessment. The CMMC Phase 2 suspension explains what changed and what requirements remain active.
What Happens If Your Organization Starts Handling CUI?
If CUI enters the environment, Level 1 should not automatically be treated as sufficient. The organization should reassess its contractual obligations and cybersecurity requirements before introducing CUI into existing systems. Moving to Level 2 can introduce all 110 NIST SP 800-171 Revision 2 requirements, CUI-specific scoping, an SSP, more detailed evidence requirements, a different assessment cycle, and NIST/SPRS scoring. The 15 Level 1 safeguards provide a useful foundation, but they are not a substitute for the complete CMMC Level 2 requirements.
How Nexeris Helps Contractors Prepare for CMMC Level 1
Nexeris helps contractors determine whether Level 1 applies, identify and scope FCI, review the 15 FAR safeguards, conduct readiness gap assessments, plan security remediation, organize evidence, and prepare for the annual self-assessment and SPRS process. For organizations that may later receive CUI, preparation can also identify where the current Level 1 environment would need to evolve toward Level 2. CMMC compliance consulting can help contractors build an assessment-ready environment while keeping the official distinction clear: Level 1 remains a self-assessment rather than a third-party certification.
Frequently Asked Questions
1. How do I get CMMC Level 1 certification?
Confirm Level 1 applies, identify the FCI environment, implement all 15 FAR 52.204-21 safeguards, remediate every applicable gap, complete the annual self-assessment, enter the results in SPRS, and submit the required affirmation. The official result is Final Level 1 (Self).
2. Is there an actual CMMC Level 1 certificate?
No C3PAO-issued certificate is required. Level 1 is self-assessed, and the organization receives Final Level 1 (Self) status after completing the required assessment, SPRS submission, and affirmation.
3. What are the 15 CMMC Level 1 requirements?
The 15 requirements come from FAR 52.204-21 and cover Access Control, Identification and Authentication, Media Protection, Physical Protection, System and Communications Protection, and System and Information Integrity.
4. Who needs CMMC Level 1?
Level 1 generally applies to contractors and subcontractors with an applicable Level 1 requirement that process, store, or transmit Federal Contract Information. Organizations handling CUI should evaluate whether Level 2 applies.
5. Does CMMC Level 1 require a C3PAO?
No.
The organization conducts its own annual Level 1 assessment.
6. Does CMMC Level 1 require an SSP?
A formal Level 2-style System Security Plan is not a Level 1 requirement. Organizations should still maintain enough evidence and internal records to support their annual assessment findings.
7. Can you use a POA&M for CMMC Level 1?
No.
Level 1 does not permit POA&Ms. Applicable unmet requirements must be corrected before Final Level 1 status can be achieved.
8. Does CMMC Level 1 have an SPRS score?
Level 1 results are submitted through SPRS, but the process does not use the Level 2-style -203 to 110 NIST SP 800-171 weighted score.
9. How often is the CMMC Level 1 self-assessment required?
Annually.
The organization must reassess Level 1, submit the results to SPRS, and complete the required affirmation each year.
10. Does the 2026 CMMC suspension affect Level 1?
No material change has been made to Level 1. The July 13, 2026 suspension affected Phase II, while Phase I Level 1 self-assessment requirements remain in effect.
