CMMC Level 1: the requirements and the self-assessment.

Who needs it, and where the rollout stands

CMMC rests on two rules: the program rule at 32 CFR Part 170 (effective 16 December 2024) and the DFARS acquisition rule (effective 10 November 2025), which put the requirement into contracts through DFARS 252.204-7021. Phase 1 began on 10 November 2025 with self-assessments. On 13 July 2026 the Department of War suspended Phase 2, which was due to start on 10 November 2026, and said all Phase 1 self-assessment requirements remain in place; solicitations may specify only Level 1 (Self) or Level 2 (Self) for now. Check the DoD CIO CMMC page for the latest.

Federal Contract Information is information not intended for public release that is provided by or generated for the government under a contract. It excludes information the government has released to the public and simple transactional information, such as what is needed to process payments.

The 15 requirements, in plain English

The official text is FAR 52.204-21(b)(1)(i) to (xv). The CMMC identifiers come from 32 CFR 170.15.

• AC.L1-b.1.i Only authorised people, processes and devices get into your systems.
• AC.L1-b.1.ii Each user can do only the transactions and functions they are allowed to.
• AC.L1-b.1.iii Check and control connections to outside systems, and their use.
• AC.L1-b.1.iv Control what is posted on public websites and other publicly accessible systems.
• IA.L1-b.1.v Identify every user, process and device.
• IA.L1-b.1.vi Verify those identities (passwords or better) before allowing access.
• MP.L1-b.1.vii Wipe or destroy media holding FCI before disposal or reuse.
• PE.L1-b.1.viii Only authorised people get physical access to systems, equipment and the rooms they are in.
• PE.L1-b.1.ix Escort and watch visitors, keep a log of physical access, and control keys, badges and other access devices.
• SC.L1-b.1.x Monitor, control and protect communications at your network’s outer edge and key internal boundaries.
• SC.L1-b.1.xi Keep publicly accessible systems on a separate subnetwork from your internal network.
• SI.L1-b.1.xii Find, report and fix flaws in a timely way: install updates.
• SI.L1-b.1.xiii Protect against malicious code at appropriate points.
• SI.L1-b.1.xiv Update that protection when new releases are available.
• SI.L1-b.1.xv Scan systems periodically, and scan files from outside sources in real time as they are downloaded, opened or run.

Self-assessment checklist

1. Set the scopeList the people, systems, devices and places that process, store or transmit FCI. The DoD CIO publishes a Level 1 scoping guide.
2. Work through the 15For each requirement, write down how you meet it and the evidence: settings, screenshots, policies, logs, visitor sign-in sheets. The DoD CIO’s Level 1 Assessment Guide (version 2.13) sets out what an assessor looks for.
3. Score each oneEach requirement is met or not applicable. If any is not met, fix it before you affirm; Level 1 allows no plans of action.
4. Enter the result in SPRSAt minimum: the CMMC level, the status date, the assessment scope, every CAGE code in scope, and the result.
5. AffirmA senior official responsible for compliance, the Affirming Official, affirms in SPRS that you have implemented and will maintain all the requirements, with their name, title and contact details.
6. Give the contracting officer your CMMC unique identifierSPRS assigns one for each assessment.
7. Repeat every yearA Level 1 status is current for one year, with an annual affirmation. Keep the evidence for six years from the status date.

Getting outside help is allowed, but it is still a self-assessment; it does not result in a certification.

What BSJ is not. BSJ Ventures is not a CMMC assessment organisation and does not perform or certify CMMC assessments. This guide is a plain reading of the published rules.

Questions people ask

What are the CMMC Level 1 requirements?

Fifteen basic safeguarding requirements from FAR 52.204-21(b)(1), numbered 52.240-93 under the FAR overhaul: limit access to authorised users and functions, control external connections and public posting, identify and authenticate users, sanitise media, limit and log physical access, protect network boundaries, separate public systems, patch flaws, and protect against and scan for malicious code.

Is a CMMC Level 1 self-assessment annual?

Yes. Under 32 CFR 170.15, the Level 1 self-assessment is done annually, the results are entered in SPRS, and an Affirming Official affirms compliance in SPRS after each assessment and annually.

Can I have a POA&M at CMMC Level 1?

No. 32 CFR 170.15 says no plans of action and milestones are permitted for CMMC Level 1. Every requirement must be met, or not applicable, before you affirm.

What do I enter in SPRS for CMMC Level 1?

At minimum the CMMC level, the CMMC status date, the assessment scope, every CAGE code covered by the scope, and the compliance result, followed by the Affirming Official's affirmation. SPRS then assigns a CMMC unique identifier that you give to the contracting officer.

Has CMMC Phase 2 started?

No. On 13 July 2026 the Department of War suspended Phase 2, which was due to begin on 10 November 2026. Phase 1 self-assessment requirements remain in place, and for now solicitations may specify only Level 1 (Self) or Level 2 (Self).

Primary sources

• 32 CFR Part 170, CMMC Program, final rule 89 FR 83092 (15 October 2024), effective 16 December 2024; eCFR current as of 8 October 2026.
• DFARS CMMC acquisition rule (DFARS Case 2019-D041), 90 FR 43560, 10 September 2025, effective 10 November 2025.
• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (Nov 2021); 52.240-93 (prescribed at 40.303-2; definitions at 40.301) under the FAR overhaul Part 40, updated 28 September 2026.
• DoD, Implementing the Suspension of CMMC Phase II, 13 July 2026.
• DoD CIO, CMMC Assessment Guide, Level 1, version 2.13, September 2024.

General information, not legal advice. BSJ Ventures publishes methods; it never publishes clients, cases or verdicts, and it claims no relationship with any agency or maker named here.