Level 1, in practice.

01When Level 1 is your level

Level 1 applies when a contractor information system handles FCI and nothing more sensitive — the ordinary, not-for-public-release paperwork of performing on a DoD contract. The Data covers what qualifies; the practical signal is the basic-safeguarding clause in your contract — FAR 52.204-21, appearing as FAR 52.240-93 in solicitations issued from February 2026 — together with the absence of CUI in the work.

Which level a contract requires is a fact about the contract, not a judgment call — The Levels covers how to read it, and Start Here lists the clause signals. Contracts exclusively for COTS items sit outside the requirement entirely (Glossary). One more scoping fact worth knowing early: if a system in scope handles CUI anywhere, that system’s conversation is a Level 2 conversation — Level 1 is not a partial credit tier for CUI environments.

02The fifteen requirements

All 15, condensed to their operative sentence, in the clause’s own order. They are real operational controls — visitor escort, media sanitization, boundary monitoring — not paperwork exercises. The right-hand column shows the NIST SP 800-171 requirement each one maps to for assessment purposes, because the objectives an L1 self-assessment actually checks come from NIST SP 800-171A through that mapping.

Fifteen requirements, seventeen mappings: requirement (ix) was split into three phrases when NIST SP 800-171 was developed, so its escort, logging, and access-device parts map to 3.10.3, 3.10.4, and 3.10.5 separately. FAR 52.204-21(b)(1); Table 2 to 32 CFR 170.15(c)(1)(ii)

Requirement (ix) is also why the visitor sign-in sheet matters more than it looks: escorting visitors, logging physical access, and managing keys and badges are each checked on their own. And the last four — flaw remediation through scanning — mean “we have antivirus” is only half an answer; the updates and the scans have to be demonstrably happening.

03The self-assessment, start to finish

The check itself runs on NIST SP 800-171A assessment objectives, applied through the mapping table above — with one substitution the rule makes explicit: wherever an objective says CUI, read FCI. Scope comes first, as always: the Level 1 CMMC Assessment Scope is defined by the Level 1 scoping requirements before any requirement gets checked against it. 32 CFR 170.15(c)(1); 170.19(a)–(b)

What goes into SPRS when you are done is specific, and shorter than people expect: the CMMC Level, the CMMC Status Date, the CMMC Assessment Scope, every CAGE code associated with the in-scope information systems, and the compliance result. What stays with you is longer-lived: the artifacts used as evidence must be retained for six years from the CMMC Status Date — the retention duty applies at Level 1, not just at certification levels. 32 CFR 170.15(a)(1)(i), (c)(2)

04The affirmation

A Level 1 self-assessment is not complete until a senior official — the Affirming Official — affirms continuing compliance in SPRS, and contract eligibility requires both: the status achieved and the affirmation submitted, for every information system in scope. The affirmation renews annually, alongside the self-assessment itself. 32 CFR 170.15(a)(2), (b); 170.22

The desk’s standing caution applies with full force here, precisely because Level 1 feels informal: an affirmation is a representation to the government, made by someone with the standing to know whether it is true, and the Department of Justice’s Civil Cyber-Fraud Initiative has pursued False Claims Act cases built on cybersecurity misrepresentations. Self-assessed does not mean without consequence.

05Where Level 1 goes wrong

Treating it as paperwork. The 15 include escorting visitors, sanitizing drives before disposal, and monitoring the network boundary — operational practices someone has to actually do, and be able to show. A policy binder with no visitor log behind it does not produce MET.

Scoping around the “contracts PC.” FCI moves through email, file shares, and quoting systems the same way CUI does (The Data, section 05, is written about CUI, but the hiding places are identical). A scope drawn around one workstation while purchase orders live in everyone’s inbox will not survive contact with the objectives.

Letting the calendar lapse. The status is annual. A self-assessment or affirmation that quietly ages out ends eligibility as surely as a failed requirement — and it is the easier of the two to prevent.

Assuming a POA&M can hold a gap open. It cannot, at this level, ever. The fourteen-of-fifteen shop does not have a Conditional Level 1; it has a gap to close before it has a status.

06Sources