Terms / Certification

Level 1

The 15 basic safeguarding requirements for FCI, assessed by you every year. No plan of action is permitted at Level 1, ever.

Also called CMMC Level 1, Level 1 (Self).

Official Source Material

The OSA must complete and achieve a MET result for all security requirements specified in § 170.14(c)(2) to achieve the CMMC Status of Final Level 1 (Self). No POA&Ms are permitted for CMMC Level 1.

Source: 32 CFR 170.15(a)(1), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

Level 1 is 15 requirements and an annual self-assessment.

The requirements are the basic safeguarding controls in FAR 52.204-21. You assess yourself, submit the result to SPRS, and affirm it. There is no outside assessor and no certificate. If your contracts give you only Federal Contract Information, this is your whole obligation.

Every requirement must be met before you affirm, because no plan of action is allowed.

Section 170.15(a)(1) says it directly. There is no partial credit, no Conditional status, and no 180 days. Fix first, then affirm. That inversion catches companies used to hearing about plans of action at Level 2.

The assessment is annual, not every three years.

Level 1 renews yearly, along with the affirmation. Put it in the calendar with a named owner. A lapsed Level 1 affirmation is a compliance gap on a live contract, and it is entirely avoidable.

Scope is still a decision at Level 1, even though it is simpler.

Federal Contract Information lives in mailboxes, shared drives, laptops, and phones. The systems that process, store, or transmit it are in scope. A Level 1 assessment covering only a server room misses most of where the information actually sits.

What falls short

An affirmation signed while a requirement is unmet. All 15 must be met, and the affirmation says so.
An assessment that covers the office network and not the mail service. The information decides the scope.
Antivirus that has not updated in months. Keeping malicious code protection current is one of the 15.

Edge cases

Your contract also involves Controlled Unclassified Information. Level 2 applies to the systems that hold it, and achieving Level 2 (Self) satisfies Level 1 for the same scope.
A prime contractor asks for more than the subcontract requires. Section 170.23 sets Level 1 (Self) for a supplier handling only Federal Contract Information.
You use a cloud service for email and files. The service is in scope, and the settings you control are your evidence.

Over-engineering

A system security plan for Level 1. The requirement does not exist at this level.
An enclave built to separate Federal Contract Information. Nothing asks you to separate it from the rest of your business.

Connects to

FAR 52.204-21 The clause holding the 15 basic safeguarding requirements for Federal Contract Information. It is the whole of CMMC Level 1. The contract
SPRS The Supplier Performance Risk System. It holds your NIST SP 800-171 score, your CMMC status, and the annual affirmation you sign. Assessment
Federal Contract Information (FCI) FCI is information a contract provides to you or generates for the Government that is not for public release. Holding only FCI means CMMC Level 1. What you protect
Level 2 The 110 requirements of NIST SP 800-171, assessed by you or by a C3PAO depending on what your contract says. This is where most CMMC work happens. Certification
Affirmation The annual statement by a senior official that you still meet the requirements. It is entered in SPRS and it carries personal weight. Certification
Scope The set of assets that will be assessed. Scope is the single decision that drives your cost, your evidence burden, and your assessment length. Scope and assets
Controlled Unclassified Information (CUI) CUI is unclassified information a law, regulation, or Government-wide policy requires you to protect. Handling it puts you at CMMC Level 2. What you protect
Prime contractor The company holding the contract directly with the Government. It owns the CMMC obligation for the whole supply chain beneath it. The contract
System Security Plan (SSP) The document describing your system and how it meets each requirement. It is itself a requirement, and it cannot go on a POA&M. Assessment
Enclave A separated environment built to hold the controlled work and nothing else. It is the usual way a small company keeps its assessment small. Scope and assets

Referenced by

CMMC The Cybersecurity Maturity Model Certification. It is the program that verifies a defense contractor meets the security requirements already in its contract. Certification
Conditional certification The status you hold when your assessment left items on a POA&M. It lasts 180 days and expires if the closeout does not happen. Certification
Final certification The status you hold when every requirement is met. It lasts one year at Level 1 and three years at Level 2 and Level 3. Certification
MP.L2-3.8.3 Media Disposal Media Protection (MP)