Self-assess the scope
Check all 15 requirements against their objectives. Every one must be Met or N/A; the result is MET or NOT MET in its entirety.
32 CFR 170.15(a)(1), 170.24(c)(1)
CMMC Level 1 self-assessment checklist
The 15 FAR 52.204-21 requirements that make up CMMC Level 1, each with its NIST SP 800-171A objectives, a Met, Not met or N/A pick and room for evidence. It scores the way the rule does, all or nothing, and ends with what you enter in SPRS and affirm each year.
CMMC Level 1 self-assessment checklist
What this checklist checks
CMMC Level 1 is the 15 basic safeguarding requirements of FAR 52.204-21(b)(1)(i)–(xv). A Level 1 self-assessment checks each one against the NIST SP 800-171A objectives for the 17 NIST requirements they map to, 59 objectives in all, with FCI read wherever the objective says CUI. Then the whole is scored MET or NOT MET, with no plan of action to fall back on. The checklist above is that assessment, row by row, in the order the Level 1 requirements appear in the FAR clause.
It only covers systems that touch Federal contract information. If you are not sure whether what you hold is FCI or CUI, settle that first with FCI vs CUI. CUI brings in DFARS 252.204-7012 and the 110 requirements of NIST SP 800-171 Rev 2, which have their own NIST SP 800-171 checklist.
- Assessed
- Laptops and the file server that hold purchase orders, schedules or a prime's drawings
- Email that sends or receives FCI
- Paper copies of FCI in the office (FCI on paper is stored FCI)
- The people, sites and outside IT providers that handle FCI
- Out of scope
- Systems that never process, store or transmit FCI
- A computer whose VDI client passes only keyboard, video and mouse
- Specialized Assets, not assessed
- CNC controllers and other Operational Technology
- IoT and Industrial IoT devices
- Government Furnished Equipment and test equipment
- Restricted Information Systems
32 CFR 170.19(b); CMMC Scoping Guide, Level 1
The scoping guide says there are no documentation requirements for a Level 1 scope, and a system security plan is recommended at Level 1 but not required. Writing the scope down anyway is what makes the yearly affirmation honest: you are affirming for every system inside it.
How to use the checklist
- 01Draw the scope first. List the people, technology, facilities and outside providers that process, store or transmit FCI; the scoping worksheet does this in one pass.
- 02Open each requirement's objectives and tick only what you can show. Evidence must be in final form: drafts, working papers and unapproved policies do not count.
- 03Pick Met only when every objective is ticked or does not apply. N/A is allowed (no public-facing system, for example) but write down why.
- 04Fix every Not met before you go further. There is no POA&M at Level 1, so a gap is closed, not planned.
- 05Fill in the SPRS fields, print the page and keep it with your evidence. Then enter the result in SPRS and have the Affirming Official affirm it.
The yearly cycle: assess, enter, affirm
Level 1 never ends with a certificate. It is the same three steps every year, and before award of a contract that requires Level 1 (Self) you need both the status and a submitted affirmation in SPRS (32 CFR 170.15(b)).
Post the result
Enter the CMMC level, the CMMC Status Date, the assessment scope, every CAGE code tied to it, and the compliance result.
32 CFR 170.15(a)(1)(i)
A senior official affirms
The Affirming Official affirms continuing compliance in SPRS when the self-assessment is done, and every year after.
32 CFR 170.22(b)(1)
DFARS 252.204-7021 treats a Final Level 1 (Self) status as current when it is not older than one year, with an affirmation also not older than one year. The checklist's SPRS panel adds a year to your status date to give the date you must beat. Keep the evidence too: assessment evidence is kept for six years from the CMMC Status Date. The SPRS walk-through covers the screens.
Note
Your Level 1 result is a pass or a fail, not a number. The 110-point score belongs to NIST SP 800-171 and Level 2; work that one out with the SPRS score calculator.
Worked example: a 14-person machine shop
The checklist loads with this shop. It makes brackets on a subcontract that carries FAR 52.204-21 and holds purchase orders, delivery schedules and a prime's drawings that are FCI, not CUI. Its office runs eleven laptops, a file server and cloud email; the CNC controllers on the floor are Specialized Assets and sit outside the assessment.
| Requirement | Finding | What was missing | The fix |
|---|---|---|---|
| PE.L1-b.1.ixManage visitors and physical access | Not met | No visitor sign-in log, and no list of who holds which door key: objectives [c], [e] and [f]. | A sign-in sheet at the front door, kept in a locked drawer; a key list with a holder per key, rekeyed when one goes missing. |
| SC.L1-b.1.xiPublic-access system separation | N/A | Nothing to miss: the website is hosted outside and holds no FCI, so no public system sits in scope. | None. The reason goes in the evidence notes, as the guide advises; an N/A counts the same as Met. |
| SI.L1-b.1.xiiFlaw remediation | Not met | Updates run, but no time frame is written down to identify, report or correct flaws: objectives [a] to [e]. | One page: check for updates weekly, tell the owner the same day, install critical fixes within 14 days and the rest within 30. |
The other 12 rows are Met. That makes 13 of 15 Met or N/A, and the result is still NOT MET: two gaps fail Level 1 as surely as fifteen would. With no POA&M available, the shop puts the log, the key list and the patch page in place, re-checks both rows, and only then takes a new CMMC Status Date, enters MET in SPRS and has the owner affirm. The patch page is the kind of short written procedure a set of policy templates saves you from writing from scratch, and old drives leaving the shop follow NIST SP 800-88 media sanitization.
Where the rule says so
The checklist encodes the rule text, not a reading of it. The one sentence that drives the whole tool is this:
Rule textAll CMMC Level 1 security requirements must be fully implemented to be considered MET. No POA&M is permitted for CMMC Level 1, and self-assessment results are scored as MET or NOT MET in their entirety.
32 CFR 170.24(c)(1)
| Rule | What it settles |
|---|---|
| FAR 52.204-21(b)(1) | The 15 basic safeguarding requirements, (i) to (xv), applied "at a minimum" to any contractor system that processes, stores or transmits FCI. |
| FAR 52.204-21(c) | The clause flows down to subcontracts in which the subcontractor may have FCI, including commercial products and services other than COTS items. |
| 32 CFR 170.14(c)(2) | CMMC Level 1 is exactly those FAR requirements; nothing is added. |
| 32 CFR 170.15(c)(1) | Assess with the NIST SP 800-171A (June 2018) objectives, reading FCI for CUI. Table 2 maps the requirements to 17 NIST requirements because FAR (ix) splits into three. |
| 32 CFR 170.19(b) | In scope: systems that process, store or transmit FCI. Out of scope: everything else. Specialized Assets (OT, IoT, GFE, test equipment) are not assessed. |
| 32 CFR 170.24(b) | Each requirement is MET, NOT MET or N/A. Evidence must be final, not draft. N/A is equivalent to MET. |
| 32 CFR 170.15(a)(1)(i) | SPRS gets the CMMC level, CMMC Status Date, assessment scope, every CAGE code tied to the scope, and the compliance result. |
| 32 CFR 170.22 | A senior Affirming Official affirms in SPRS with name, title and contact details, at completion and annually after. |
| 32 CFR 170.15(c)(2) | Keep the evidence for six years from the CMMC Status Date. |
| DFARS 252.204-7021(a) | Final Level 1 (Self) is current when not older than one year, with an affirmation not older than one year. |
- FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (Nov 2021)
- 32 CFR 170.15, CMMC Level 1 self-assessment and affirmation requirements
- 32 CFR 170.19(b), CMMC Level 1 scoping
- 32 CFR 170.22, Affirmation
- 32 CFR 170.24, CMMC Scoring Methodology
- CMMC Assessment Guide – Level 1 and CMMC Scoping Guide – Level 1, Version 2.13 (September 2024), read from the Internet Archive's copy; the DoD CIO site refused the direct request
- DFARS 252.204-7021, definition of "current"
Questions small shops ask
Do I need a system security plan for Level 1?
No. The Level 1 assessment and scoping guides both say an SSP is recommended as a best practice but not required for a Level 1 self-assessment. A short one still pays for itself: it is where your scope, your N/A reasons and your evidence locations live. See what a system security plan is.
Can I put a gap on a POA&M and still pass?
Not at Level 1. 32 CFR 170.15 says no POA&Ms are permitted for Level 1, so a requirement that is not fully in place is Not met and the whole result is NOT MET.
One narrow case is different. A temporary deficiency that shows up after a requirement was implemented, and is tracked in an operational plan of action showing progress, is assessed as MET (32 CFR 170.24(b)(1)(ii)). The guide says an operational plan of action is not a POA&M, and a temporary deficiency is generally not a first-time rollout that is still in progress. More on the difference in what a POA&M is.
Are the CNC machines on the shop floor in scope?
Operational Technology, IoT devices, Government Furnished Equipment, test equipment and Restricted Information Systems are Specialized Assets: they can hold FCI but cannot be fully secured, so 32 CFR 170.19(b) keeps them out of the Level 1 scope and they are not assessed. The office computer that holds the drawing a part program was made from is a different matter; if it holds FCI, it is in.
Who can be the Affirming Official?
The senior level representative from within the company who is responsible for its compliance with the CMMC Program and has the authority to affirm it (32 CFR 170.22(a)(1)). “From within” rules out your outside IT provider; in a small shop it is often the owner or president.
Does this apply while CMMC Phase 2 is suspended?
FAR 52.204-21 is a contract clause in its own right: if your contract carries it, the 15 requirements apply whatever happens to the CMMC phases. Whether a contract also asks for a CMMC Level 1 (Self) status in SPRS is in your solicitation, and the dated status box near the top of this page says what the program requires today.
Do my subcontractors need to do this too?
FAR 52.204-21(c) puts the substance of the clause into every subcontract in which the subcontractor may have FCI in its systems, including commercial products and services other than COTS items. If you are not sure which level a contract will ask of you or them, the CMMC level finder walks the questions.