How do I do a CMMC Level 1 self-assessment?

By Hugh Donatello, LAN Service Group · Reviewed October 19, 2026

Short answer

Define the scope (every system, person, facility and service provider that handles Federal Contract Information), then check each of the 15 FAR 52.204-21 requirements against its NIST SP 800-171A objectives. Each one must be fully MET, and no POA&M is allowed. Enter the result in SPRS, have a senior Affirming Official affirm it, keep the evidence for six years, and repeat the assessment and affirmation every year.

Who needs a Level 1 self-assessment

You need one when a DoD solicitation or contract requires a CMMC Status of Level 1 (Self). That requirement applies to contractor information systems that process, store or transmit Federal Contract Information (FCI) and no Controlled Unclassified Information (CUI). FCI is information not intended for public release that is provided by or generated for the government under a contract to develop or deliver a product or service. It does not include information the government makes public or simple transactional information such as what is needed to process payments.

Under 32 CFR 170.15(b), you must have a CMMC Status of Level 1 (Self) and an affirmation in the Supplier Performance Risk System (SPRS) before award of any contract or subcontract that requires it. If your systems handle CUI, the contract will call for Level 2 instead. Under 32 CFR 170.16(a) and 170.17(a), a CMMC Status of Level 2 (Self) or Level 2 (C3PAO) also satisfies Level 1 (Self) for the same CMMC Assessment Scope.

Newer contracts written under the Revolutionary FAR Overhaul may cite the basic safeguarding clause as FAR 52.240-93 rather than 52.204-21. The 15 requirements are the same.

Step 1: Define the assessment scope

32 CFR 170.19(b) requires you to specify the CMMC Assessment Scope before you start. Every information system that processes, stores or transmits FCI is in scope and must be self-assessed. To find those systems, the rule tells you to consider the people, technology, facilities and External Service Providers in your environment that handle FCI. In practice that means email, file shares and cloud storage, laptops and phones, the office or shop floor where contract documents are kept, and any IT provider or cloud service that touches the data.

Two kinds of assets fall outside the Level 1 scope. Out-of-Scope Assets are systems that do not process, store or transmit FCI, and the rule sets no documentation requirement for them. Specialized Assets, such as IoT and industrial devices, operational technology, government-furnished equipment, restricted information systems and test equipment, can handle FCI but cannot be fully secured. Under 170.19(b)(2)(ii) they are not part of the Level 1 CMMC Assessment Scope and are not assessed against CMMC requirements. That scoping rule does not lift the FAR clause's safeguarding duty for systems that handle FCI.

Write the scope down. SPRS asks whether the assessment covers your whole enterprise or a defined enclave, and which CAGE codes it applies to. A smaller, well-defined FCI footprint means fewer systems to secure and check.

Step 2: Check each requirement against its assessment objectives

32 CFR 170.15(c) says you must assess each Level 1 requirement using the assessment objectives in NIST SP 800-171A (June 2018) for the NIST SP 800-171 requirement it maps to, reading FCI wherever an objective says CUI. The rule maps the 15 FAR requirements to 17 NIST requirements, because the visitor and physical-access requirement (b)(1)(ix) was split into three phrases when NIST SP 800-171 was written. The table shows the mapping and examples of evidence that can support each one.

Scoring is all or nothing. Under 32 CFR 170.24(c)(1), every Level 1 requirement must be fully implemented to count as MET, results are scored MET or NOT MET in their entirety, and no POA&M is permitted. There is no 110-point score at Level 1. An objective that does not apply can be marked Not Applicable, which counts the same as MET. The rule's own example is public-system separation (the matching Level 2 requirement) when no publicly accessible systems are in scope. Evidence must be in final form: the rule says drafts, working papers and unapproved policies are not acceptable evidence.

The 15 FAR 52.204-21 requirements, their CMMC IDs and NIST SP 800-171A objectives
FAR 52.204-21(b)(1)	Requirement (summarized)	CMMC ID	NIST SP 800-171A	Example evidence	Source
(i)	Limit system access to authorized users, processes acting for them, and devices	AC.L1-b.1.i	3.1.1	User and device list, account approval records	[1] [2] [7]
(ii)	Limit access to the transactions and functions authorized users may perform	AC.L1-b.1.ii	3.1.2	Role and permission settings, admin rights list	[1] [2] [7]
(iii)	Verify and control or limit connections to and use of external systems	AC.L1-b.1.iii	3.1.20	Policy on personal devices and outside cloud services, configuration showing it is enforced	[1] [2] [7]
(iv)	Control information posted or processed on publicly accessible systems	AC.L1-b.1.iv	3.1.22	List of who may post publicly, review procedure	[1] [2] [7]
(v)	Identify users, processes acting for users, and devices	IA.L1-b.1.v	3.5.1	Unique account per person, device inventory	[1] [2] [7]
(vi)	Authenticate those identities before allowing access	IA.L1-b.1.vi	3.5.2	Sign-in and password settings, no shared logins	[1] [2] [7]
(vii)	Sanitize or destroy media containing FCI before disposal or reuse	MP.L1-b.1.vii	3.8.3	Wipe or destruction records, certificates of destruction	[1] [2] [7]
(viii)	Limit physical access to systems, equipment and operating environments to authorized people	PE.L1-b.1.viii	3.10.1	Locks, badge or key lists, list of who has access	[1] [2] [7]
(ix), first phrase	Escort visitors and monitor visitor activity	PE.L1-b.1.ix	3.10.3	Visitor policy, sign-in sheets	[1] [2] [7]
(ix), second phrase	Maintain audit logs of physical access	PE.L1-b.1.ix	3.10.4	Visitor or badge access logs, retained	[1] [2] [7]
(ix), third phrase	Control and manage physical access devices	PE.L1-b.1.ix	3.10.5	Key and badge issue and return records	[1] [2] [7]
(x)	Monitor, control and protect communications at external and key internal boundaries	SC.L1-b.1.x	3.13.1	Firewall configuration, network diagram	[1] [2] [7]
(xi)	Put publicly accessible system components on subnetworks separated from internal networks	SC.L1-b.1.xi	3.13.5	Network diagram showing separation, or Not Applicable if no public systems	[1] [2] [7]
(xii)	Identify, report and correct system flaws in a timely manner	SI.L1-b.1.xii	3.14.1	Patch settings and patch reports	[1] [2] [7]
(xiii)	Provide protection from malicious code at appropriate locations	SI.L1-b.1.xiii	3.14.2	Anti-malware console showing coverage	[1] [2] [7]
(xiv)	Update malicious code protection when new releases are available	SI.L1-b.1.xiv	3.14.4	Automatic update settings, current definition versions	[1] [2] [7]
(xv)	Perform periodic scans, and real-time scans of files from external sources as they are downloaded, opened or executed	SI.L1-b.1.xv	3.14.5	Scan schedule and real-time protection settings	[1] [2] [7]

Requirement wording is summarized from FAR 52.204-21(b)(1); the CMMC IDs and NIST mapping are from Table 2 to 32 CFR 170.15(c)(1)(ii). The evidence column gives examples, not an official list. Assess against the full objectives in NIST SP 800-171A.

Step 3: Fix every gap before you post

Because Level 1 allows no POA&M, a single NOT MET requirement means you cannot post a passing result. Fix the gap, collect the evidence that shows it is fixed, then finish the assessment. Gaps to look for at this level include shared logins, former employees who still have accounts, laptops without current malware protection or patches, no visitor log, and old drives thrown out without being wiped.

Keep a short record of how each requirement is met, who checked it and when, and where the evidence lives. The rule does not require a System Security Plan for Level 1, but a one-page description per requirement makes the annual reassessment much faster and gives your Affirming Official something concrete to review.

Step 4: Enter the result in SPRS

SPRS stores the result; it does not run the assessment. To enter it, you need a Procurement Integrated Enterprise Environment (PIEE) account with the SPRS Cyber Vendor User role for your CAGE code. In SPRS, open Cyber Reports (CMMC & NIST), choose your CAGE and hierarchy, open the CMMC Assessments tab and select Add New CMMC Level 1 Self-Assessment.

32 CFR 170.15(a)(1)(i) requires the entry to include at minimum the CMMC level, the CMMC Status Date, the assessment scope, every CAGE code covered by that scope, and the compliance result. The SPRS entry screen asks for the assessment date, whether the scope is Enterprise or Enclave, the number of employees covered, a Yes or No answer on whether you meet the FAR 52.204-21 requirements, and the included CAGE codes from your company hierarchy. SPRS takes the hierarchy from SAM, so fix any errors in your SAM registration first.

Step 5: Have the Affirming Official affirm it

32 CFR 170.22 requires an Affirming Official to affirm continuing compliance after the assessment and every year after that. The Affirming Official is the senior representative of your company who is responsible for CMMC compliance and has the authority to affirm it. The affirmation includes that person's name, title and contact information, and a statement that the company has implemented, and will keep in place, all applicable CMMC requirements for every system in the assessment scope.

The Affirming Official needs their own PIEE account with the SPRS Cyber Vendor User role. SPRS pulls the official's name and contact details from that PIEE profile, and they can only be changed in PIEE, so check them first. If the person entering the assessment is not the Affirming Official, SPRS lets them transfer the record to the official by email. The official reviews it, checks the certification box and selects Affirm. A Yes result becomes a CMMC Status of Final Level 1 Self-Assessment and SPRS assigns a CMMC Unique Identifier (UID). A No result becomes No CMMC Status. According to SPRS, Final Level 1 Self-Assessment is the only Level 1 status government users can see.

Take the affirmation seriously. It is a representation to the government that the requirements are in place and will stay in place. The Affirming Official should see the evidence, not just a summary.

Step 6: Keep the evidence and repeat every year

Under 32 CFR 170.15(c)(2), you must keep the artifacts used as evidence for six years from the CMMC Status Date. To keep a Final Level 1 (Self) status, 170.15(a)(1) requires you to conduct a new Level 1 self-assessment every year and submit the results in SPRS, and 170.22 requires a new affirmation every year. SPRS marks a lapsed Level 1 record as No CMMC Status (Expired Assessment).

Once a record is Final, SPRS does not let you edit it; if the details change, you delete it and enter a new one. Reassess sooner than a year if something material changes, such as a move to a new email or file platform, a new office or a new IT provider that handles FCI.

Does the 2026 CMMC suspension change Level 1?

The Level 1 procedure did not change, but whether your contract still requires it can. On July 13, 2026, the Department of War CIO suspended the Phase 2 transition and put all pending CMMC milestones on hold, and the Under Secretary of War for Acquisition and Sustainment issued a memo implementing that suspension the same day. Neither memo amends 32 CFR 170.15 or 170.22, and new requirement documents may still designate Level 1 (Self) or Level 2 (Self).

DFARS Class Deviation 2026-O0025, Revision 3, also tells contracting officers to work with requiring activities to remove or revise CMMC requirements in new and existing solicitations and contracts. Read each solicitation and contract modification to see which CMMC level, if any, it now requires. FAR 52.204-21, or 52.240-93 in newer contracts, is a contract clause in its own right and applies whenever it is in your contract, with or without a CMMC requirement.

Common follow-up questions

Can I use a POA&M for CMMC Level 1?

No. 32 CFR 170.15 and 170.24 prohibit a POA&M for Level 1. Every one of the 15 requirements must be MET (an objective that is Not Applicable counts as MET) before you can post a Final Level 1 (Self) status and affirm it.

Is there a score for CMMC Level 1?

No. Level 1 is scored MET or NOT MET for each requirement, and you answer Yes or No in SPRS on whether you meet all FAR 52.204-21 requirements. Level 1 has no point score; the 110-point scale is used for Level 2 and for the separate NIST SP 800-171 DoD Assessment score in SPRS.

How often do I have to do a Level 1 self-assessment?

Every year. 32 CFR 170.15 requires an annual Level 1 self-assessment with results submitted in SPRS, and 32 CFR 170.22 requires the Affirming Official to affirm continuing compliance annually. Keep the evidence for six years from the CMMC Status Date.

Who can be the Affirming Official?

A senior representative from within your own company who is responsible for CMMC compliance and has the authority to affirm it, as defined in 32 CFR 170.4. An outside IT provider or consultant can help prepare the assessment, but cannot affirm for you.

Do I need a third-party assessor for Level 1?

No. Level 1 is a self-assessment that your company performs and affirms. No C3PAO assessment or certificate is involved. Outside help can prepare and check your evidence, but the result and the affirmation are yours.

What do I need to log in to SPRS?

A PIEE account with the SPRS Cyber Vendor User role for your CAGE code. That role lets you view and add CMMC records, affirm them, and edit records that are not yet affirmed. The Affirming Official needs the same role. Users with only the Contractor/Vendor Support role can view results but cannot enter or affirm them.

Need help with this?

LAN Service Group's ISSO-led CMMC practice helps defense suppliers scope where FCI lives, implement and evidence the 15 basic safeguarding requirements, and prepare the Level 1 self-assessment for your Affirming Official to review and affirm in SPRS each year. We prepare clients; we never certify them, and the affirmation stays with your company.

Talk to LAN Service Group LAN Service Group CMMC services → (888) 281-7243