The CMMC Level 1 self-assessment, step by step

What the Level 1 self-assessment is

CMMC Level 1 is the entry level of the Defense Department's Cybersecurity Maturity Model Certification program. It covers the 15 basic safeguarding requirements in FAR 52.204-21(b)(1), things like controlling who gets onto your systems, keeping antivirus current and escorting visitors.

At Level 1 there's no outside assessor. Your company assesses itself under 32 CFR 170.15, records the result in the Supplier Performance Risk System (SPRS), and a senior person at your company affirms that the result is true.

Three rules shape the whole thing:

• Met or not met. Level 1 has no point score. Each requirement is scored MET or NOT MET, and every one has to be MET.
• No plan of action. Level 1 doesn't allow a POA&M, so you can't post now and fix later.
• Evidence must be real. A MET finding has to be based on evidence, and that evidence has to be in final form, not a draft.

Who has to do it

Level 1 is for companies that handle Federal Contract Information (FCI): information that isn't meant for public release and is provided by or generated for the government under a contract. Public information and simple transactional information, like what's needed to process payments, don't count.

The requirement reaches you through your contract. When a DoD contract includes DFARS 252.204-7021 at Level 1, the contractor has to have and keep a current Level 1 status for the systems that handle FCI. Primes must flow the clause down to subcontracts that will process, store or transmit FCI (commercially available off-the-shelf items are excluded), and subcontractors must affirm before the subcontract is awarded.

If you receive Controlled Unclassified Information (CUI), like controlled drawings or specs, you're likely looking at Level 2, which is a bigger project.

How often: every year

The self-assessment is done on an annual basis. Under DFARS 252.204-7021, a Final Level 1 (Self) status only counts as "current" if it's not older than one year, nothing about your compliance has changed since, and the affirmation is also not older than one year. Your status is checked before award, so a lapsed one can cost you a contract or an option.

What gets entered and affirmed in SPRS

Under 32 CFR 170.15, the results you submit include:

• The CMMC level (Level 1)
• The CMMC Status Date, which is the date the results are submitted to SPRS
• The assessment scope
• Every CAGE code tied to the systems in scope
• The compliance result

Then your Affirming Official enters an affirmation in SPRS. Under 32 CFR 170.22 it includes their name, title and contact information, and a statement that your company has implemented, and will keep implementing, all the applicable requirements.

Step by step

1. Confirm it applies. Read your contract or purchase order for FAR 52.204-21 and DFARS 252.204-7021. Look at what you actually receive from your prime or the government.
2. Draw the boundary. List the systems, people and places that touch FCI: laptops, email, file storage, the office, and any outside providers. Some specialized assets, like operational technology and test equipment, are out of scope at Level 1.
3. Walk the 15 requirements. Go through each one against its assessment objectives and mark it MET or NOT MET. Our FAR 52.204-21 checklist lists each one in plain English.
4. Collect the proof. For every MET, save the evidence: screenshots, settings, logs, lists, signed policies. Final versions only.
5. Fix gaps before you post. With no POA&M allowed, anything NOT MET has to be fixed first.
6. Get SPRS access. SPRS roles are requested through PIEE, and your company's PIEE administrator has to approve them. Do this early.
7. Enter the results and affirm. Someone with the right role enters the assessment, then the Affirming Official reviews and affirms it. See our SPRS affirmation guide.
8. Keep records and set a reminder. Keep the evidence for six years from the CMMC Status Date, and calendar the one-year mark so your status doesn't lapse.

Where Onyx fits

We do the written side: policies, an evidence binder for all 15 requirements, and a guided SPRS affirmation, in about 21 days at a fixed price. Your IT person stays responsible for the technical side. See pricing.

Common questions

Do we need an outside assessor for Level 1?

No. Level 1 is a self-assessment that your own company conducts and affirms in SPRS. You can get outside help preparing, but the affirmation comes from a senior person at your company.

Is there a Level 1 score?

No. Level 1 has no point values. Each requirement is MET or NOT MET, and all of them have to be MET.

What if one requirement isn't met?

Then you can't claim a Final Level 1 (Self) status yet. Level 1 doesn't allow a plan of action and milestones, so fix the gap first, then assess and affirm.

How long do we keep the evidence?

Six years from the CMMC Status Date, under 32 CFR 170.15.

Did the July 2026 CMMC suspension change Level 1?

No. The July 13, 2026 suspension paused Phase 2 third-party assessments. Phase 1 self-assessments, including Level 1 and its annual affirmation, remain in place. See our CMMC status page.

Sources

• 32 CFR 170.15, CMMC Level 1 self-assessment (eCFR)
• 32 CFR 170.24, CMMC scoring methodology (Cornell LII)
• 32 CFR 170.22, Affirmation (Cornell LII)
• 32 CFR 170.4, definitions incl. Affirming Official (eCFR)
• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (acquisition.gov)
• DFARS 252.204-7021, Contractor Compliance with CMMC Level Requirements (acquisition.gov)
• DoD CIO, About CMMC
• McDermott Will & Emery, CMMC from the bottom up: Level 1
• Johns Hopkins APL, CMMC Supplier Webinar: SPRS Updates (Aug 2026)
• WilmerHale, Pentagon suspends CMMC Phase 2 requirements (July 20, 2026)

General information, not legal advice. Back to Onyx home.