CMMC Level 1 requirements: the 15 FAR 52.204-21 safeguards
Published 2026-10-23, 16 min read
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Contracts may require CMMC Level 1 (Self) or Level 2 (Self): your own assessment, scored and entered in SPRS, with a senior official's affirmation. Class Deviation 2026-O0025 Rev 3; 32 CFR 170.15, 170.16
- The CMMC rule itself, 32 CFR Part 170, is unchanged since it took effect on 2024-12-16. eCFR, 32 CFR Part 170
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Existing contracts that carry CMMC requirements have them removed at the next option period or the next scheduled administrative modification. Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
- DoD's 2026 Regulatory Plan lists an interim final rule amending 32 CFR Part 170 (RIN 0790-AM01) to set a deadline and transition from NIST SP 800-171 Rev 2 to Rev 3. It was timetabled for July 2026 and has not been published as of 2026-10-23. 91 FR 52824
- Class Deviation 2026-O0025, Revision 3 (DFARS part 240), read 2026-10-23
- DFARS 252.204-7012, -7019, -7020, -7021 (acquisition.gov), read 2026-10-23
- 32 CFR Part 170 (eCFR), read 2026-10-23
- Federal Register 2026-16603, 2026 Regulatory Plan (RIN 0790-AM01), read 2026-10-23
- Federal Register: CMMC documents, read 2026-10-23
What Level 1 is, in three documents
CMMC Level 1 writes no new controls. It takes the 15 basic safeguarding requirements of FAR 52.204-21, a government-wide contract clause, and adds a way to prove them: you assess yourself, post the result in the Supplier Performance Risk System (SPRS), and a senior official affirms it every year. Three documents carry that, and a small shop meets each of them in a different place.
FAR 52.204-21 (Nov 2021)
Sets the 15 basic safeguarding requirements. A contracting officer puts it in any contract where you or a subcontractor may have FCI on your systems.
FAR 52.204-21(b)(1); FAR 4.1903
32 CFR Part 170, Level 1
Says how you show you meet them: a self-assessment against the NIST SP 800-171A objectives, a result in SPRS and a senior official's yearly affirmation.
32 CFR 170.14(c)(2), 170.15, 170.22
DFARS 252.204-7021 (NOV 2025)
The contract clause that asks for a current Level 1 (Self) status for every system that handles FCI on the contract, kept current for its whole life.
DFARS 252.204-7021(d)(1), (d)(3)
The order matters when contracts change. The CMMC rule verifies the FAR clause; it does not replace it. If your contract or purchase order carries 52.204-21, the 15 requirements bind you whether or not a CMMC clause sits beside it.
Level 1 is also the floor of everything above it. Each of the 15 maps to a NIST SP 800-171 Rev 2 requirement, so the work carries straight into the Level 2 requirements if CUI ever arrives. How the levels fit together is in what CMMC is.
Who needs Level 1: FCI, and nothing more sensitive
Level 1 is for companies whose systems hold Federal contract information (FCI) and no CUI. The FAR tells the contracting officer to insert 52.204-21 whenever the contractor or a subcontractor at any tier may have FCI residing in or passing through its information system. In the CMMC rule, the systems that process, store or transmit FCI are exactly what a Level 1 self-assessment covers.
- Usually FCI
- The contract or purchase order itself, with its quantities and delivery dates
- Email with the prime or the contracting office about the work
- Inspection records, test reports and certificates you produce for the delivery
- Not FCI
- A solicitation the Government posted on a public website
- Invoices and payment details (simple transactional information)
- Your own catalogue and price list, written for every customer
Our examples, read against FAR 52.204-21(a)
The line that moves a shop out of Level 1 is CUI. Technical drawings that arrive with a distribution statement B through F are typically Controlled Technical Information, a CUI category, and they bring DFARS 252.204-7012 and the 110 requirements of Level 2 with them. If you are not sure which side your files sit on, settle it with FCI vs CUI and what CUI is before you scope anything.
Subcontractors get the level that matches what flows down to them, not the prime's level. The CMMC rule puts it plainly:
The FAR clause flows down the same way: a prime must put its substance in any subcontract where the subcontractor may have FCI, commercial products and services included, with only commercially available off-the-shelf items left out. To check which level a given contract or purchase order points to, run the CMMC level finder.
The 15 requirements on one map
The FAR lists the requirements as one run of paragraphs, (i) to (xv). CMMC files them under six domains and gives each an id that keeps the FAR paragraph at its end: AC.L1-b.1.i is FAR (b)(1)(i) in the access control domain. Pick a domain to jump to its requirements.
The chips are the NIST SP 800-171 Rev 2 requirements each domain maps to, 17 for 15 FAR paragraphs. The difference is FAR (ix), which packs three duties into one sentence; NIST split it into 3.10.3, 3.10.4, 3.10.5, and the CMMC rule assesses each phrase against its own objectives. Across all of them a Level 1 self-assessment checks 59 NIST SP 800-171A objectives, reading FCI wherever an objective says CUI. The Level 1 checklist lists every objective under its requirement.
Each requirement in practice
Below, all 15 in FAR order. Each one gives the clause's own sentence, what it usually looks like in a shop of five to fifty people, the evidence a reviewer would ask to see, and the gap a first self-assessment most often finds. Much of Level 1 is already in place in a typical office; what is often missing is the record that shows it.
Access Control (AC)
Authorized access control
AC.L1-b.1.i“Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).”Rule text, FAR 52.204-21(b)(1)(i); NIST SP 800-171 3.1.1
In a small shop. Keep one list of who has an account on each system that holds FCI (the file server, email, the ERP, the estimating laptop) and which devices may connect. When someone leaves, their accounts are disabled that day and the list shows it.
Evidence a reviewer asks to see
- List of active accounts with the person behind each one
- Records of recently separated or transferred employees and their disabled accounts
- List of devices and systems authorized to connect
Where shops slip: A shared login on the front-desk PC or the CAM workstation: nobody owns it, so nobody can show who used it.
Transaction and function control
AC.L1-b.1.ii“Limit information system access to the types of transactions and functions that authorized users are permitted to execute.”Rule text, FAR 52.204-21(b)(1)(ii); NIST SP 800-171 3.1.2
In a small shop. Decide who needs administrator rights and who only needs to open and save files. Most staff work as standard users; the person who runs IT, or the outside provider, holds admin. Two lines in an access policy plus the group settings are the proof.
Evidence a reviewer asks to see
- Access control policy naming who may do what
- List of approved authorizations, including remote access
- Configuration settings showing role or group permissions
Where shops slip: Everyone is a local administrator because it once saved a call to the IT provider.
External connections
AC.L1-b.1.iii“Verify and control/limit connections to and use of external information systems.”Rule text, FAR 52.204-21(b)(1)(iii); NIST SP 800-171 3.1.20
In a small shop. List the outside systems FCI touches or that reach in: personal phones reading company email, a prime's supplier portal, a cloud drive, a remote-support tool. Say which are allowed and on what terms, and block or forbid the rest.
Evidence a reviewer asks to see
- Procedure for using external systems (personal devices, outside cloud services)
- Terms and conditions or connection agreements for external systems
- List of applications reachable from external systems
Where shops slip: Purchase orders forwarded to a personal email account so someone can work on them from home.
Control public information
AC.L1-b.1.iv“Control information posted or processed on publicly accessible information systems.”Rule text, FAR 52.204-21(b)(1)(iv); NIST SP 800-171 3.1.22
In a small shop. Name who may post to the website, social accounts and any public share link, and have that person check every post for FCI before it goes up. Pull anything that slipped through and note that you did.
Evidence a reviewer asks to see
- List of people allowed to post public content
- Records of reviews before posting
- Record of how an improper post was found and taken down
Where shops slip: A shop-floor photo on social media with a customer's purchase order readable on the bench.
Identification and Authentication (IA)
Identification
IA.L1-b.1.v“Identify information system users, processes acting on behalf of users, or devices.”Rule text, FAR 52.204-21(b)(1)(v); NIST SP 800-171 3.5.1
In a small shop. Every person gets an account of their own, and every device that connects is known by name or address. Accounts that software uses (the backup job, the scanner that emails PDFs) go on the list too.
Evidence a reviewer asks to see
- List of system accounts (no shared logins)
- Identification and authentication policy
- Configuration settings and audit logs that show who did what
Where shops slip: One administrator account shared by the owner and the outside IT provider.
Authentication
IA.L1-b.1.vi“Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.”Rule text, FAR 52.204-21(b)(1)(vi); NIST SP 800-171 3.5.2
In a small shop. Every account proves who it is before it gets in: a password at the least, and never the vendor default on a router, printer or network drive. The FAR text does not name multifactor authentication; Level 2 does (3.5.3), so a shop headed there turns it on now.
Evidence a reviewer asks to see
- List of authenticator types in use (passwords, tokens, certificates)
- Procedure for issuing and changing authenticators, including default passwords
- Configuration settings for login requirements
Where shops slip: Factory passwords still on the Wi-Fi router, the network printer or the NAS that holds the job folders.
Media Protection (MP)
Media disposal
MP.L1-b.1.vii“Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.”Rule text, FAR 52.204-21(b)(1)(vii); NIST SP 800-171 3.8.3
In a small shop. Before a laptop, drive, phone or copier leaves your hands (sold, recycled, returned off lease), wipe it or destroy it and record which device and how. Paper with FCI goes to a shredder, not the recycling bin.
Evidence a reviewer asks to see
- Procedure for media sanitization and disposal
- Sanitization or destruction records (a shredding or wipe log)
Where shops slip: A leased copier sent back with its internal drive still holding months of scanned purchase orders.
Physical Protection (PE)
Limit physical access
PE.L1-b.1.viii“Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.”Rule text, FAR 52.204-21(b)(1)(viii); NIST SP 800-171 3.10.1
In a small shop. Lock the office, the server closet and wherever FCI paper is kept, and give keys or badges only to people whose job needs that door. A short list of who holds what is the evidence.
Evidence a reviewer asks to see
- Authorized personnel access list
- Physical access list reviews
- Physical access termination records for people who left
Where shops slip: The server closet doubles as storage and its door is never locked.
Manage visitors and physical access
PE.L1-b.1.ix“Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.”Rule text, FAR 52.204-21(b)(1)(ix); NIST SP 800-171 3.10.3, 3.10.4, 3.10.5
In a small shop. Visitors sign in, wear a visitor badge and stay with an employee while they are inside; a paper log is enough if you keep it. Know who holds every key, fob and badge, collect them when people leave, and change a code or lock when one goes missing.
Evidence a reviewer asks to see
- Visitor log or physical access control records
- Inventory of keys, badges and fobs
- Records of key and lock combination changes
Where shops slip: A door code that has not changed since the last three people left the company.
System and Communications Protection (SC)
Boundary protection
SC.L1-b.1.x“Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.”Rule text, FAR 52.204-21(b)(1)(x); NIST SP 800-171 3.13.1
In a small shop. A firewall sits between your network and the internet, set to block what you have not chosen to allow, and someone reads its alerts. Where guest Wi-Fi or the shop-floor network meets the office network, that line counts as a boundary too.
Evidence a reviewer asks to see
- Network diagram or list of key internal boundaries
- Firewall or router configuration settings
- Boundary device logs
Where shops slip: The internet provider's router is the only firewall, and nobody has opened its settings since it was installed.
Public-access system separation
SC.L1-b.1.xi“Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.”Rule text, FAR 52.204-21(b)(1)(xi); NIST SP 800-171 3.13.5
In a small shop. Anything the public can reach, such as a web server you host or a customer file drop, sits on its own subnet, apart from the machines that hold FCI. If you host nothing public, the requirement can be N/A, which the rule scores as MET; write down why.
Evidence a reviewer asks to see
- List of publicly accessible components, such as an internet-facing web server
- Configuration showing the separate subnet or DMZ
Where shops slip: Security cameras reachable from the internet, plugged into the same network as the file server.
System and Information Integrity (SI)
Flaw remediation
SI.L1-b.1.xii“Identify, report, and correct information and information system flaws in a timely manner.”Rule text, FAR 52.204-21(b)(1)(xii); NIST SP 800-171 3.14.1
In a small shop. Know what software runs on in-scope machines, turn on automatic updates where you can, and set the number of days in which a patch must go in. A record of what was patched and when is the evidence.
Evidence a reviewer asks to see
- Procedure for flaw remediation with your own time frames
- List of recent patches and updates installed
- Change records for security-relevant updates
Where shops slip: An old PC kept for one legacy program, never updated and still on the office network.
Malicious code protection
SI.L1-b.1.xiii“Provide protection from malicious code at appropriate locations within organizational information systems.”Rule text, FAR 52.204-21(b)(1)(xiii); NIST SP 800-171 3.14.2
In a small shop. Anti-malware runs on every in-scope computer and on email, the places malicious code arrives. Protection built into the operating system can do the job if it is switched on and managed.
Evidence a reviewer asks to see
- Procedure naming where malware protection runs
- Anti-malware configuration and its detection records
Where shops slip: Protection on the office PCs but not on the workstation that opens files from customers' USB sticks.
Update malicious code protection
SI.L1-b.1.xiv“Update malicious code protection mechanisms when new releases are available.”Rule text, FAR 52.204-21(b)(1)(xiv); NIST SP 800-171 3.14.4
In a small shop. Let the anti-malware update itself, and check every month or so that each machine is still reporting in with current definitions.
Evidence a reviewer asks to see
- Records of anti-malware updates
- Configuration showing automatic updates
Where shops slip: A laptop that dropped off the management console months ago and still runs old definitions.
System and file scanning
SI.L1-b.1.xv“Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.”Rule text, FAR 52.204-21(b)(1)(xv); NIST SP 800-171 3.14.5
In a small shop. Schedule full scans, weekly is a common choice, and leave real-time scanning on so files are checked as they are downloaded, opened or run.
Evidence a reviewer asks to see
- Procedure stating the scan frequency
- Scan results from the anti-malware tool
- Configuration showing on-access (real-time) scanning
Where shops slip: Real-time scanning turned off on the one machine that felt slow.
Media disposal is where shops most often guess. NIST SP 800-88 Rev 2 (September 2025) is NIST's guide to a media sanitization program, matching the technique to the device and the data; our guide to NIST SP 800-88 media sanitization turns it into a record you can keep. For the people side of all 15, a short session with staff on what FCI is does more than any tool; CUI training shows how to run one.
The self-assessment and the yearly affirmation
Nobody from outside assesses Level 1. You do it, you post it, and a senior person in the company signs for it. The run is short, and it is the same every year.
| Step | What the rule asks | Where |
|---|---|---|
| Scope | List the systems, people, facilities and outside providers that process, store or transmit FCI. Specialized Assets such as OT, IoT, test equipment and Government-furnished equipment are outside the Level 1 scope. | § 170.19(b) |
| Assess | Check each requirement against its NIST SP 800-171A objectives, reading FCI for CUI. Each is MET, NOT MET or N/A, on evidence in final form, never drafts. | § 170.15(c)(1), 170.24(b) |
| Score | Every requirement MET or N/A, or the whole result is NOT MET. There is no partial score. | § 170.24(c)(1) |
| Enter in SPRS | CMMC level, CMMC Status Date, the assessment scope, every CAGE code tied to it, and the result. SPRS gives each assessment a 10-character CMMC unique identifier (UID) you pass to the contracting officer. | § 170.15(a)(1)(i); 7021(a), (e)(1) |
| Affirm | Your Affirming Official affirms in SPRS that the requirements are in place and will stay in place. | § 170.22 |
| Before award | A contract that asks for Level 1 (Self) needs both the status and the affirmation in SPRS first. | § 170.15(b) |
| Every year | Assess again, enter the new result and affirm again. | § 170.15(a)(1), 170.22(b)(1) |
| Six years | Keep the evidence from the CMMC Status Date. | § 170.15(c)(2) |
The Affirming Official is not whoever happens to have the SPRS login. The rule means the senior level representative who is responsible for the company's CMMC compliance and has the authority to affirm it: in a small shop, usually the owner or the general manager. The affirmation carries their name, title and contact details and a statement that the company has implemented, and will maintain, every applicable requirement for all systems in the scope.
One date drives everything after the first year: the CMMC Status Date, the day the result goes into SPRS. Put yours in below to see when the status stops being current under the CMMC clause and how long the evidence has to stay on file.
The day your Level 1 result went into SPRS.
- Status and affirmation current until DFARS 252.204-7021(a)
- Enter a date
- Keep the assessment evidence until 32 CFR 170.15(c)(2)
- Enter a date
Start the next self-assessment a few weeks ahead, so the new result and affirmation are in SPRS before the first date passes. The dates are a reading of the two rules, not legal advice.
The screens behind each step, from the PIEE login to the affirmation, are in how to submit to SPRS. To run the assessment itself, open the CMMC Level 1 self-assessment checklist: it scores the result the way the rule does and fills in the SPRS fields as you go.
No POA&M: what one gap does at Level 1
At Level 2 a shop can carry a few small gaps on a plan of action and milestones while it fixes them. Level 1 has no such room. The rule says it in one line:
- A score of at least 88 of 110 can earn a Conditional status
- Some 1-point requirements may wait on a POA&M
- The POA&M must be closed out within 180 days
32 CFR 170.21
- The whole self-assessment is NOT MET
- No Conditional status and no POA&M exist at Level 1
- Close the gap, then assess, enter and affirm
32 CFR 170.15(a)(1), 170.24(c)(1)
Two parts of the scoring rule decide most borderline calls. N/A is a real answer: a requirement or objective that does not apply at the time of the assessment is scored N/A, and the rule then counts it as MET. The rule's own example is public-access system separation where nothing in scope is publicly accessible, which is FAR (xi) at Level 1. Write down why it does not apply. And MET means the evidence exists now: “All evidence must be in final form and not draft.” A policy you meant to approve does not count.
The rule also separates a POA&M from an operational plan of action. A temporary deficiency that is “appropriately addressed in operational plans of action”, with deficiency reviews and progress toward the fix, is assessed as MET. We read that as a control that was working and broke, being repaired on a record, not a control that was never built; when in doubt, close the gap before you affirm.
If you are moving toward Level 2, the POA&M rules are worth knowing now; they are in what a POA&M is.
Level 1 today
CMMC is being reformed, and the status box near the top of this page is the one place this site records what binds on the day you read it, with its sources and the date they were last checked. Read the line on Level 1 (Self) there. Three rule facts sit underneath it:
- 01The FAR clause binds on its own. Wherever 52.204-21 is in your contract, the 15 requirements apply, with or without a CMMC clause, because the CMMC rule does not alter it (32 CFR 170.5(e)).
- 02Where a contract does carry the CMMC clause at Level 1, DFARS 252.204-7021 treats a Final Level 1 (Self) status as current only when it is not older than one year, with an affirmation also not older than one year.
- 03Under the class deviation, until 2028-11-09 a contract carries the CMMC clause only where the program office requires a specific level; from 2028-11-10 it applies to any contract whose systems process, store or transmit FCI or CUI.
So a shop with FCI and no CUI is in the same place either way: meet the 15, keep the evidence, and be ready to post and affirm when a contract asks. The background, the dates and what to watch for are in CMMC status today, and how this fits a small company's whole picture is in CMMC requirements for small businesses.
Level 1 on one card
CMMC Level 1 requirements on one card, cuideck.com
- (i)Only approved people, processes and devices get in
- (ii)Users can do only what their job needs
- (iii)Know and control the outside systems you connect to
- (iv)Keep FCI off the website and social accounts
- (v)Every user, process and device has its own ID
- (vi)Prove identity before access: passwords or better
- (vii)Wipe or destroy drives and paper before they leave
- (viii)Lock the office, server closet and gear to authorized people
- (ix)Escort visitors, log entry, control keys and badges
- (x)A firewall at the edge and at key internal lines
- (xi)Public-facing systems on their own subnet
- (xii)Find, report and patch flaws on a clock you set
- (xiii)Anti-malware where it matters
- (xiv)Keep the anti-malware current
- (xv)Scheduled scans plus real-time file scans
- Result
- MET or NOT MET as a whole; no POA&M § 170.24(c)(1)
- Who assesses
- You; a senior official affirms § 170.15, 170.22
- SPRS
- Level, status date, scope, CAGE codes, result § 170.15(a)(1)(i)
- Repeat
- Every year, with a new affirmation § 170.15(a)(1); 7021(a)
- Evidence
- Kept six years from the status date § 170.15(c)(2)
Questions about Level 1
Do we need a C3PAO or any outside assessor for Level 1?
No. Level 1 is a self-assessment: you assess, you enter the result in SPRS, and your Affirming Official affirms it. The rule issues a Certificate of CMMC Status only after a C3PAO or DCMA DIBCAC assessment, so there is no such thing as a Level 1 certificate. Paying someone to help you get ready is fine; paying for a “certification” at Level 1 buys nothing the rule recognises.
Do we need a system security plan for Level 1?
The Level 1 rule in 32 CFR 170.15 does not list one; at Level 2 an assessment cannot be completed without it. A short written scope and a page on how each requirement is met still make the yearly affirmation easier to stand behind, and they are a start on an SSP if CUI ever arrives. The SSP template shows what a full one holds.
Can FCI live in commercial Microsoft 365 or Google Workspace?
Neither FAR 52.204-21 nor the Level 1 rule sets a FedRAMP requirement; that arrives with CUI under DFARS 252.204-7012. The cloud service is still an external system under requirement (iii), its accounts fall under (i), (v) and (vi), and an outside provider that handles FCI belongs in your scope. If CUI is on the way, read GCC vs GCC High before you move anything.
What does Level 1 cost a small company?
DoD's own estimate for a small entity's Level 1 cycle (the self-assessment, entering it and the affirmation) is $5,977 in 2023 dollars, and it covers the assessment, not the cost of putting the requirements in place. The CMMC cost estimator puts your own numbers beside DoD's.
Does a Level 2 status cover Level 1?
Yes, for the same assessment scope: a Level 2 (Self) status also satisfies Level 1 (Self), and a Level 2 (C3PAO) status satisfies both. A shop that already holds Level 2 does not run a separate Level 1 self-assessment for those systems.
What happens if we miss the yearly date?
The status stops being current. DFARS 252.204-7021 asks you to have and maintain a current status for the life of the contract, and a Final Level 1 (Self) status and its affirmation are current only up to one year old. Assess again and affirm before the date; the calendar in the self-assessment section above gives it to you.