The policies for your CMMC Level 1 self-assessment

CMMC Level 1 is the first level of the Defense Department's Cybersecurity Maturity Model Certification program, set out in 32 CFR Part 170. It covers contractors that handle federal contract information (FCI) but not controlled unclassified information. Once a year the company assesses itself against the 15 requirements in FAR 52.204-21, enters the result in SPRS and has a senior official affirm it.

It depends on the information you handle, not on your size. Department of War has been a second name for the Department of Defense since a September 2025 executive order, and the requirements did not change with the name. If you handle only federal contract information (FCI), your contracts likely include FAR 52.204-21, and when they do, you must meet its 15 basic safeguarding requirements. When a solicitation or contract includes the CMMC clause, you also do a CMMC Level 1 self-assessment each year and affirm it in SPRS. If you handle controlled unclassified information (CUI), DFARS 252.204-7012 requires the 110 requirements in NIST SP 800-171 Rev. 2 and reporting cyber incidents within 72 hours. That is CMMC Level 2 and beyond this kit.

You need one if your company processes, stores or transmits FCI on its own systems under a DoD contract or solicitation that calls for CMMC Level 1. Company size does not change it; a two-person shop is covered.

Yes, if they will have FCI on their systems. When a prime contract includes the CMMC clause, the prime has to pass the Level 1 requirement down to subcontractors that will process, store or transmit FCI, and confirm before award that each one has a current Level 1 status. So a prime may ask you for it even if a contracting officer never has.

Not to those contracts. CMMC requirements and the FAR safeguarding clause do not apply to contracts that buy only commercially available off-the-shelf (COTS) items. If you also have contracts where you receive drawings, specs or other FCI, those contracts still count.

Federal contract information is information the government gives you, or that you produce for a contract, that is not meant to be public: drawings, specs, delivery schedules, most of a contract folder. If you hold a DoD contract and you are not selling standard products off a shelf, you almost certainly have it.

Level 1 protects federal contract information (FCI) with the 15 basic safeguarding requirements in FAR 52.204-21, and your company checks itself once a year. Level 2 protects controlled unclassified information (CUI) with the 110 requirements in NIST SP 800-171 Rev. 2. Depending on the contract, that means a self-assessment or a certified third-party assessment every three years, with an affirmation each year. Your solicitation or contract says which level applies. This kit covers Level 1 only.

They are the basic safeguarding requirements in FAR 52.204-21(b)(1): limit system access to authorized users; limit what each user can do; control connections to outside systems; control what is posted on public systems; identify users and devices; authenticate them before access; sanitize or destroy media holding FCI before disposal or reuse; limit physical access; escort visitors and log physical access; protect the network boundary; keep public-facing systems on a separate network; find and fix software flaws promptly; run malware protection; keep it updated; and scan systems and incoming files.

Every year. Your company redoes the self-assessment, posts the new result in SPRS and files a new affirmation. You need a current result in SPRS for as long as the contract runs.

No. Level 1 is a self-assessment, and no certification body is involved. You can hire help or do it yourself. DoD can still assess you later.

DoD's rulemaking estimated about $6,000 a year in labor for a small business to do the Level 1 self-assessment and affirmation, assuming the safeguards are already in place. Posting in SPRS is free. Fixing what the assessment turns up, such as replacing shared logins or adding antivirus to an old computer, costs extra and depends on what you already have.

Then you cannot affirm yet. Level 1 has no partial credit and does not allow a POA&M (a plan to finish later): a requirement counts as met only when every objective under it is true. Fix the gaps first, then post your self-assessment and affirm. Until you do, you are not eligible for a contract award that requires Level 1.

SPRS, the Supplier Performance Risk System, is the DoD database where contractors post assessment results. After your self-assessment is entered, your Affirming Official, the senior official responsible for the company's compliance, affirms in SPRS that the company meets the requirements.

No. The Affirming Official has to be a senior official of your own company, such as an owner or officer, who is responsible for the company meeting the requirements. An outside IT provider can do much of the work and gather the evidence. The person who affirms needs their own PIEE account with the SPRS Cyber Vendor User role.

If you handle only FCI, give them your CMMC Level 1 (Self) status, the date you posted it in SPRS and your CMMC UID, the number SPRS assigns to the assessment. The 110-point score comes from the Level 2 requirements, and Level 1 does not produce one. If the prime still wants a score, ask whether the subcontract involves CUI, because that would change which level applies.

The affirmation is a statement to the government, so a false one can bring liability under the False Claims Act, which allows triple damages plus a penalty for each claim. In June 2026 the Justice Department settled with LOGZONE, an Alabama defense contractor, for $507,144 after a government assessment scored it at minus 170 against the 110 it had reported in SPRS. That case involved the larger NIST SP 800-171 requirements, but the same law covers a Level 1 affirmation.

No. The awareness and training practices start at CMMC Level 2 (AT.L2-3.2.1 through AT.L2-3.2.3). Some primes ask about training in their questionnaires anyway, and phishing reaches companies at every level, but nothing in Level 1 requires it.

No. On July 13, 2026, the Department of War suspended Phase 2 of the CMMC rollout, the phase that adds third-party Level 2 assessments. Its announcement says, "All Phase I self-assessment requirements remain firmly in place." Level 1 is a Phase 1 self-assessment, so Level 1 requirements stay in force.

Not if a solicitation or contract asks for it. When a solicitation includes the CMMC clause and names Level 1, you need a current self-assessment and affirmation in SPRS to be eligible for award, and the suspension did not change that. The 15 safeguarding requirements in FAR 52.204-21 are a separate duty: they apply whenever that clause is in your contract, CMMC or not.

That depends on a review still under way. The same announcement set up a CMMC Reform Task Force to review the program and report to the department CIO within 60 days, with lowering barriers for small, medium and non-traditional businesses as a stated goal. That report was due around mid-September 2026, and as of Nov. 1, 2026, we have not found a published outcome. Even if CMMC changes, the FAR safeguarding clause has been in federal contracts since 2016 and does not depend on it. If the rules change within 12 months of your purchase, you get the updated kit.

Not unless you handle controlled unclassified information (CUI). The announcement says that during the review, the department will enforce NIST SP 800-171 Rev. 2 through self-assessments and some government-led assessments, and that DFARS 252.204-7012 still applies. Both cover CUI, which is CMMC Level 2. If your company handles only FCI, your safeguarding requirements are the 15 in FAR 52.204-21. If you handle CUI, you need more than this kit, and you can write to us about Level 2 work.

No. Some new solicitations issued under the Revolutionary FAR Overhaul deviations cite the basic safeguarding clause as FAR 52.240-93, while the codified FAR and 32 CFR Part 170 still say FAR 52.204-21. The 15 requirements are the same under either number.

No. Compliance is your company doing the 15 things and truthfully affirming that it does them. The kit saves you the drafting and tells you what each requirement asks for. It cannot do the practices for you.

No. The kit guides you through the Level 1 process with templates and instructions, but it is not legal advice. For advice about your company's situation, talk to your attorney.

Your purchase includes every update we release for 12 months. We email you when one is out, and your original download link gets the new version for 12 months after purchase. The files are yours to keep either way. The templates already carry both clause numbers and both styles of requirement ID: the current AC.L1-b.1.i style and the older AC.L1-3.1.1 style you will still see in some tools and prime questionnaires.

Delivery and access problems: a download that will not open, a receipt you cannot find. We do not review your assessment, file it for you or answer compliance questions by email.