Home › CMMC Level 1
CMMC Level 1 readiness for defense contractors
Get your company ready for CMMC Level 1.
If you do work for the Department of Defense and handle federal contract information, CMMC Level 1 is already showing up in contracts, and it isn't affected by the Phase 2 pause. SenseTech helps small contractors in York, Lancaster and South Central PA meet all 15 requirements and prepare their annual self-assessment.
CMMC Registered Practitioner and veteran-owned
Where CMMC stands right now
DoD paused the next phase of CMMC in July 2026. Level 1 self-assessments are not affected.
Level 1 self-assessment requirements can appear in new DoD solicitations and option periods. Contracting officers check SPRS for your current status before award.
Phase 2 was set to add third-party Level 2 certifications on November 10, 2026. DoD suspended it and launched a 60-day CMMC Reform Task Force review. Contracts with CUI must still meet DFARS 252.204-7012 and NIST SP 800-171.
Who needs CMMC Level 1?
Any DoD contractor or subcontractor whose systems handle federal contract information (FCI). FCI is information that isn't public and is provided by or created for the government under a contract, such as drawings, specs, schedules or pricing a contracting office sends you.
It doesn't include information the government has made public, or simple transactional information like what's needed to process a payment.
If your contracts also involve controlled unclassified information (CUI), you'll likely need Level 2 instead. Your solicitation will state the required level.
- 15 requirements
- The basic safeguarding requirements from FAR 52.204-21, across six areas.
- Self-assessed every year
- No outside assessor. Results go into SPRS with an affirmation by a senior official.
- All or nothing
- Every requirement must be MET. No plans of action (POA&Ms) allowed.
- Keep the evidence
- Assessment records must be kept for six years.
The 15 CMMC Level 1 requirements, in plain English
Each requirement is scored MET or NOT MET against its assessment objectives in NIST SP 800-171A. Here's what each one means and what it usually looks like for a small business.
Access Control AC · 4
AC.L1-b.1.iAuthorized access control
Only people you've approved, and the devices and programs they use, can get into your systems.
Everyone has their own login, and former employees are removed right away.
AC.L1-b.1.iiTransaction and function control
People can only do what their job requires.
Day-to-day staff accounts aren't administrator accounts.
AC.L1-b.1.iiiExternal connections
You know and control connections to systems outside your own.
Personal devices and outside cloud apps are approved before they touch FCI.
AC.L1-b.1.ivControl public information
Nothing that contains FCI gets posted on public sites.
Someone reviews what goes on your website and social media.
Identification and Authentication IA · 2
IA.L1-b.1.vIdentification
Every user, process and device is identified.
No shared logins, and an inventory of the computers you use.
IA.L1-b.1.viAuthentication
Identities are verified before access is allowed.
Strong passwords, with default passwords changed on every device.
Media Protection MP · 1
MP.L1-b.1.viiMedia disposal
Drives and paper containing FCI are wiped or destroyed before disposal or reuse.
Old hard drives are securely erased or shredded, with a record kept.
Physical Protection PE · 2
PE.L1-b.1.viiiLimit physical access
Only authorized people can get to your systems and work areas.
Locked office, server closet or network cabinet.
PE.L1-b.1.ixManage visitors and access devices
Visitors are escorted and monitored, physical access is logged, and keys and badges are controlled.
A visitor sign-in sheet and a list of who has keys.
System and Communications Protection SC · 2
SC.L1-b.1.xBoundary protection
Traffic at the edge of your network is monitored and controlled.
A properly configured business firewall.
SC.L1-b.1.xiPublic-access separation
Anything the public can reach is kept separate from your internal network.
Guest Wi-Fi is separated, and your website isn't hosted on your office network.
System and Information Integrity SI · 4
SI.L1-b.1.xiiFlaw remediation
Security problems in software are found, reported and fixed promptly.
Windows and application updates are applied on a schedule.
SI.L1-b.1.xiiiMalicious code protection
Protection against malware is in place.
Business antivirus or endpoint protection on every computer.
SI.L1-b.1.xivUpdate malicious code protection
That protection stays up to date.
Automatic definition and engine updates, monitored.
SI.L1-b.1.xvSystem and file scanning
Systems are scanned regularly, and files from outside sources are scanned when downloaded or opened.
Scheduled scans plus real-time scanning of email attachments and downloads.
The annual Level 1 self-assessment
Six steps, repeated every year to keep your status current.
Scope
Identify every person, computer, cloud service and location that stores, processes or sends FCI.
Assess
Check each of the 15 requirements against its assessment objectives from NIST SP 800-171A, scoring each one MET or NOT MET.
Fix
Close every gap. Level 1 allows no POA&Ms, so all 15 requirements must be MET before you submit.
Submit to SPRS
Enter your CMMC level, status date, assessment scope, the CAGE codes covered, and the result.
Affirm
A senior official at your company affirms compliance in SPRS.
Repeat yearly
Reassess and reaffirm every year, and keep your assessment evidence for six years.
How SenseTech helps
Travis Michael is a CMMC Registered Practitioner. We do the technical work, in plain English, alongside your regular IT, so you're not paying for a separate compliance project that falls apart a year later.
Already a SenseTech CARE client? Much of Level 1 is covered by what we already do: managed antivirus, patching, firewall and account management.
Ask about CMMC readiness- Scope it
Find which systems, people and locations handle FCI, and keep that footprint small. - Find the gaps
Walk through all 15 requirements and their assessment objectives against your setup. - Fix what's missing
Accounts, updates, firewall, antivirus, media disposal and physical access, handled for you. - Prepare your self-assessment
Organize your documentation and evidence so your affirming official can submit to SPRS with confidence. - Stay current
Ongoing monitoring and an annual check before you reaffirm.
CMMC Level 1 questions
Do I need CMMC Level 1 or Level 2?
Level 1 applies when your company handles federal contract information (FCI) only. If you also receive or create controlled unclassified information (CUI), the contract will usually call for Level 2, which is based on the 110 requirements in NIST SP 800-171. Third-party Level 2 certifications are paused during DoD's review, but contractors with CUI still have to meet DFARS 252.204-7012 and NIST SP 800-171. Your solicitation states the required level, and we can help you figure out which kind of information you actually have.
Is CMMC Level 1 a certification?
No. Level 1 is an annual self-assessment. Your company assesses itself against the 15 requirements, enters the result in the Supplier Performance Risk System (SPRS), and a senior official affirms compliance. No outside assessor is required for Level 1.
Can we submit a plan to fix gaps later?
No. Plans of action and milestones (POA&Ms) are not permitted for Level 1. Every requirement must be met at the time of your self-assessment, so gaps need to be fixed before you submit.
When does CMMC show up in contracts?
Phase 1 began November 10, 2025, so Level 1 self-assessment requirements can already appear in new DoD solicitations and option periods, and contracting officers check SPRS for your status before award. Phase 2, which would have added third-party Level 2 certifications on November 10, 2026, was suspended by DoD on July 13, 2026 while a CMMC Reform Task Force reviews the program. Phase 1 self-assessments, including Level 1, remain in effect.
Does the Phase 2 pause change anything for Level 1?
No. The July 2026 suspension paused the move to Phase 2 and its third-party certifications. Phase 1 self-assessment requirements stay in place, so if your contracts involve FCI you still need a current Level 1 self-assessment and affirmation in SPRS, renewed every year.
Does CMMC apply to subcontractors?
Yes. If you are a subcontractor and FCI flows to you, the requirement flows down to you as well, and you need your own current Level 1 status in SPRS.
What happens if our affirmation isn't accurate?
The affirmation is a formal statement to the government, so an inaccurate one can create legal exposure, including under the False Claims Act. That's why the requirements need to be truly in place and documented before your affirming official signs. Talk to your attorney about the legal side.
This page is general information, not legal advice. Your company and its affirming official are responsible for the accuracy of your self-assessment and affirmation. Requirements are set by 32 CFR Part 170 and the DFARS, and may change. Always check your specific solicitation.
Find out where you stand on Level 1.
Start with a free network evaluation. We'll tell you which requirements you already meet and what to fix first.