CMMC Level 1 Self-Assessment Guide

Who Must Complete a Level 1 Self-Assessment, and Why It Matters Now

If your company holds, or wants to hold, a Department of Defense contract or subcontract that involves Federal Contract Information, CMMC Level 1 applies to you. FCI is information provided by or generated for the government under contract that is not intended for public release. That definition is broader than most contractors expect. Delivery schedules, technical drawings marked for limited distribution, performance reports, contract correspondence, and pricing details all typically qualify. If the only government data touching your systems is information the government has already published publicly, you may fall outside the requirement, but very few active contractors are in that position.

The obligation flows down the supply chain. Prime contractors are required to verify that their subcontractors meet the appropriate CMMC level before awarding work, which means a machine shop three tiers down from a prime can lose an order because it has no current Level 1 self-assessment in SPRS. As the 48 CFR acquisition rule phases CMMC requirements into new solicitations, contracting officers will be unable to award covered contracts to companies without a valid assessment and affirmation on file. In practical terms, the self-assessment is becoming a condition of doing business with the defense industrial base, not a nice-to-have.

It is worth being precise about what Level 1 is not. It is not an audit, it is not a certification issued by a third party, and it does not cover Controlled Unclassified Information. If your contracts involve CUI, such as export-controlled technical data or information marked under a CUI category, you are in Level 2 territory, which means all 110 NIST SP 800-171 requirements and, for most contractors, a triennial third-party assessment by a C3PAO. Our CMMC Level 2 compliance guide covers that path in detail. Getting the level determination right at the start is the single most consequential scoping decision you will make, because assessing at Level 1 when your data actually requires Level 2 leaves you noncompliant no matter how carefully you complete the self-assessment.

FAR 52.204-21, the Federal Acquisition Regulation clause on basic safeguarding of covered contractor information systems, lists 15 security requirements. The original CMMC 1.0 model restated those same obligations as 17 practices, because it split two of the physical protection requirements into separate line items for clarity. When CMMC 2.0 arrived and the program was codified in the 32 CFR and 48 CFR final rules, the count returned to the FAR's original 15 requirements. Nothing was added or removed in substance; older checklists simply counted the same protections differently.

This matters when you build your CMMC Level 1 checklist. If you are working from a resource that lists 17 practices, it is describing the legacy CMMC 1.0 numbering, and you should map it back to the current 15 requirements before you record anything in SPRS. The identifiers used today follow the pattern AC.L1-b.1.i through SI.L1-b.1.xv, matching the lettered paragraphs of the FAR clause. The table of requirements below uses the current structure.

None of these requirements is exotic. They are the baseline hygiene any competent IT provider should already maintain. The gap for most small contractors is not capability but proof: knowing exactly which systems are in scope, being able to demonstrate each safeguard is actually working, and documenting the result well enough to defend an affirmation. That is where a structured self-assessment, or a guided one through our CMMC consulting services, earns its keep.

Step one deserves more attention than it usually gets. You cannot assess what you have not scoped, and scoping mistakes cut both ways. Scope too narrowly, by forgetting the accounting workstation where invoices with contract data live, or the personal phone that receives contract email, and your assessment misses systems the requirements actually cover. Scope too broadly and you take on remediation work for systems that never touch FCI. Draw the boundary deliberately, write it down, and be able to explain why each asset is in or out. Contractors who want a hard separation often stand up a dedicated enclave for government work so the rest of the business stays out of scope entirely.

Step three is where honesty pays. For each of the 15 requirements, the Department of Defense publishes assessment objectives that break the requirement into specific things that must be true. Take AC.L1-b.1.i as an example: it is not enough that you have user accounts; access must be limited to authorized users, authorized processes, and authorized devices, and you should be able to point to the mechanism doing the limiting. Walk the objectives one at a time, record what you observed, and resist the temptation to mark something MET because it is "mostly there." An affirmation built on generous self-grading is exactly the kind of statement the Department of Justice has pursued under the False Claims Act.

Steps five and six are administrative but unforgiving. The SPRS entry is made through the Procurement Integrated Enterprise Environment (PIEE), which means someone in your company needs a PIEE account with the SPRS "cyber vendor" role before the deadline pressure hits. The affirmation must come from a senior official with the authority to bind the company, not from your IT vendor. Put both the assessment anniversary and the affirmation renewal on the corporate calendar the day you first submit, because a lapsed affirmation makes you ineligible for covered awards just as surely as a failed assessment. If you also need to understand where you stand numerically for other contract requirements, our CMMC self-scoring guide explains how the related SPRS scoring works.

If your company has a capable IT provider and only a handful of systems in scope, DIY is realistic; this guide plus the DoD's Level 1 assessment guide will get you there. The guided path earns its cost when scope is murky, when a prime is asking for your SPRS status this quarter, or when nobody internally wants their name on an affirmation they cannot personally verify.

ComplianceArmor and the Petronella Level 1 Engagement

Petronella Technology Group approaches Level 1 the way it approaches every framework: build the real security program first, and let the paperwork fall out of it. The engagement starts with the FCI-versus-CUI determination and a scoping workshop, then walks all 15 requirements against the DoD assessment objectives in your actual environment. Gaps get fixed hands-on, whether that means segmenting a flat network, rolling out unique accounts with multi-factor authentication, or standing up a documented media disposal process. Nothing is marked MET until it is observably true.

The documentation layer runs on ComplianceArmor, the firm's proprietary compliance platform. Its CMMC module generates the policies and procedures behind each requirement, organizes evidence by control, and monitors the recurring obligations, patching cadence, access reviews, and log retention, so the annual re-assessment is a review rather than a rebuild. When the assessment is complete, the team walks your senior official through the SPRS submission in PIEE and the affirmation itself, so the mechanics never block a contract award. And because roughly the same team handles the full CMMC program up through Level 2 readiness, a contractor whose pipeline later adds CUI work extends the same program instead of starting over.

The credentials behind that work are verifiable. Petronella Technology Group has operated since April 2002, has held a BBB A+ rating since 2003, and is a CyberAB Registered Provider Organization (RPO #1449) with a CMMC-RP certified team. Founder Craig Petronella, a CMMC Registered Practitioner and author of the CMMC 2.0 Certification Guide, has spent 30+ years in IT and cybersecurity and holds CCNA and CWNE certifications, an NC Digital Forensics Examiner license (#604180-DFE), and MIT certifications in cybersecurity and AI. The firm is headquartered in Raleigh, North Carolina and serves defense contractors across the Research Triangle and nationwide, with the broader practice covering everything from compliance consulting across frameworks to full managed cybersecurity.