15 safeguarding requirements
Level 1 uses the 15 FAR 52.204-21 basic safeguarding requirements for FCI. Review all 15 requirements and evidence examples →
CMMC Level 1
FCI only. Fifteen safeguards. Annual self-assessment.
Fixed fee · 15 safeguards · FCI only · 2–3 weeks
CMMC Level 1 applies to contractor information systems that process, store or transmit Federal Contract Information when the procurement requires Level 1. It is a contractor-performed self-assessment against the 15 safeguarding requirements in FAR 52.204-21.
Current Phase 1: Level 1 remains active.
The July 2026 suspension of Phase II did not suspend Level 1. Current Department guidance says CMMC remains paused in Phase 1, where Level 1 Self and Level 2 Self may be required.
Annual self-assessment
Your organization performs the Level 1 self-assessment every year.
Assessment result in SPRS
The Level 1 result is submitted in SPRS. It is not the 110-point numeric NIST SP 800-171 score used for the DFARS Basic Assessment.
Annual affirmation
An affirming official submits the required affirmation each year.
No POA&M
Level 1 does not permit POA&Ms. All applicable Level 1 requirements must be MET.
No C3PAO
Level 1 is a self-assessment. A C3PAO is not part of the Level 1 assessment path.
If the environment handles CUI, verify whether Level 2 applies.
Level 1 is for FCI. If Controlled Unclassified Information is stored, processed or transmitted in the contractor environment, the Level 2/NIST SP 800-171 requirements may apply. Level 1 should not be treated as the first 15 requirements of Level 2.
New to Department of Defense work
This page is step 4 of five on the path from SAM.gov to CMMC.
- Step 1 — Register in SAM.gov.
- Step 2 — Read the clauses: FCI, CUI, FAR 52.204-21, DFARS 7012.
- Step 3 — Get your result on record in SPRS (a Level 1 self-assessment for FCI-only work; a NIST SP 800-171 score where CUI is involved).
- Step 4 — Meet CMMC Level 1 or Level 2. You are here.
- Step 5 — Keep it current: renewals, affirmations, day-to-day security.
Ready to complete your CMMC Level 1 self-assessment?
Cyberneza helps confirm the FCI-only scope, evaluate your environment against all 15 FAR 52.204-21 safeguarding requirements, identify and remediate gaps, organize supporting evidence, and prepare the information your organization needs to submit its Level 1 assessment result and annual affirmation.
Discuss Level 1 readiness