CMMC Level 1 Requirements

CMMC Level 1 is the baseline for any company that handles Federal Contract Information (FCI) and no Controlled Unclassified Information. It carries the 15 basic safeguarding requirements of FAR 52.204-21, which the CMMC model expresses as 17 practices across six families, verified by an annual self-assessment and affirmed in SPRS by a senior official.

Level 1 is short, but it is strict in a way Level 2 is not: there is no score and no Plan of Action and Milestones. Every practice is either met or not met, and the affirmation is only true when all 17 are met.

Who needs Level 1

Level 1 applies when a contract contains FAR 52.204-21 and the information you receive or generate under it is FCI: information provided by or generated for the government under a contract that is not intended for public release. Order details, pricing, schedules and correspondence about the work usually qualify.

The test is the information, not your industry. A machine shop and a software reseller can both sit at Level 1, and either moves to Level 2 the moment a marked drawing or other CUI enters the environment. See FCI vs CUI for how to tell them apart, and the clause-by-clause test for which contracts trigger what.

The 17 Level 1 practices

Each practice maps to a NIST SP 800-171 requirement number, which is why the Level 1 set is a proper subset of Level 2 rather than a separate standard.

Access Control (AC) — 4 practices

• AC.L1-3.1.1 Limit system access to authorized users, processes and devices.
• AC.L1-3.1.2 Limit users to the transactions and functions they are permitted to execute.
• AC.L1-3.1.20 Verify and control or limit connections to external systems.
• AC.L1-3.1.22 Control information posted on publicly accessible systems.

Identification and Authentication (IA) — 2 practices

• IA.L1-3.5.1 Identify users, processes and devices.
• IA.L1-3.5.2 Authenticate them before allowing access.

Media Protection (MP) — 1 practice

• MP.L1-3.8.3 Sanitize or destroy media containing FCI before disposal or reuse.

Physical Protection (PE) — 4 practices

• PE.L1-3.10.1 Limit physical access to systems and equipment to authorized people.
• PE.L1-3.10.3 Escort visitors and monitor their activity.
• PE.L1-3.10.4 Maintain audit logs of physical access.
• PE.L1-3.10.5 Control and manage physical access devices such as keys and badges.

System and Communications Protection (SC) — 2 practices

• SC.L1-3.13.1 Monitor, control and protect communications at external and key internal boundaries.
• SC.L1-3.13.5 Separate publicly accessible system components from internal networks.

System and Information Integrity (SI) — 4 practices

• SI.L1-3.14.1 Identify, report and correct system flaws in a timely manner.
• SI.L1-3.14.2 Provide protection from malicious code.
• SI.L1-3.14.4 Update malicious code protection when new releases are available.
• SI.L1-3.14.5 Perform periodic scans and real-time scans of files from external sources.

How the Level 1 self-assessment works

1. Define the scope. List the people, systems and facilities that process, store or transmit FCI. Everything else can stay out.
2. Assess each practice. Check every practice against its assessment objectives and record evidence: configuration screenshots, access lists, visitor logs, patch reports.
3. Fix what is not met. Because no POA&M is allowed, gaps must be closed before you affirm, not after.
4. Enter the result in SPRS. Record the self-assessment and have a senior official affirm continuing compliance.
5. Repeat annually. The affirmation lapses after a year, and it must also be revisited whenever the environment changes materially.

The same method, extended to a Level 2 self-assessment and an SPRS score, is set out in the CMMC self-assessment guide.

What Level 1 usually costs

Most of the 17 practices are satisfied by a competently managed Microsoft 365 or Google Workspace tenant with managed endpoints, current antivirus, a patching routine and basic building security. For many small contractors the work is documentation and evidence rather than new technology, measured in days rather than months. The CMMC cost guide breaks out where the money goes when it does.

Where Level 1 self-assessments go wrong

• Treating the affirmation as paperwork. It is a statement to the government by a named senior official. If a practice is not actually met, the affirmation is false, whatever the intent behind it.
• Forgetting the physical practices. Visitor escorts, physical access logs and badge management are three of the four physical practices, and they are the ones most often missing evidence in small offices and shop floors.
• Scoping by department rather than by information. FCI tends to travel through shared mailboxes, accounting systems and personal devices. If it reaches a system, that system is in scope.
• Not re-checking after change. A new office, a new cloud service or a new managed service provider can quietly break a practice that was met when you last affirmed.

When Level 1 is not enough

If technical drawings, specifications, export-controlled data or any other CUI category enters the environment, the systems that touch it move to Level 2: 110 requirements, 320 assessment objectives, a System Security Plan and a posted SPRS score. The Level 1 vs Level 2 comparison sets the two side by side.

If you are unsure which level applies, a CMMC readiness assessment starts by reading your contracts and tracing where FCI and CUI actually live, so you do not pay for Level 2 controls you do not owe.