CMMC Level 1 self-assessment: what it takes

What a CMMC Level 1 self-assessment requires for a contractor that handles only FCI

When a contract or subcontract requires CMMC Level 1 and you handle only Federal contract information, you must meet the 15 basic safeguarding requirements of FAR 52.204-21. Every one of them must be MET, there is no plan of action and milestones to fall back on, and your organization performs the self-assessment and affirms the result itself. No outside assessor issues a report or certificate. Under 32 CFR 170.14(c)(2), Level 1 adds no requirements beyond that clause, so the work is the clause itself, tested against the NIST SP 800-171A objectives that the rule maps to those requirements. How much work this takes depends on three things: how tightly you draw the scope, how well you can show evidence for each objective, and who signs for the company. Under 32 CFR 170.19(b), the scope is the systems that process, store or transmit FCI, so a narrow boundary with a few well-managed systems is far less work than a company-wide sweep. The Affirming Official, a senior representative responsible for compliance, must affirm continuing compliance in SPRS at the end of the assessment and each year after, so that person needs to see the evidence before signing. DoD's 2024 final rule estimated $4,042 per year for an other-than-small entity and $5,977 per year for a small entity, covering the self-assessment and affirmation. That estimate assumed no implementation cost, because the 15 safeguards already apply under the clause. Ask any provider whether its quote includes the work to close gaps, since that work is usually where the real expense sits. Before you start, confirm the scope in writing, list the in-scope systems and their owners, and check whether any FCI sits on assets you have not counted, such as a shared mailbox or a file share used by a subcontractor. Then collect evidence for each objective and keep it for six years from the status date, as 32 CFR 170.15(c)(2) requires. Current requirements and the DFARS clause language are set out in the eCFR text of 32 CFR 170.15, which is the reference your assessor-facing records should follow.

How the 15 FAR 52.204-21 requirements map to 17 assessment objectives

Level 1 requires the 15 basic safeguarding requirements in FAR 52.204-21, and the self-assessment tests them with NIST SP 800-171A objectives for the mapped requirements. Because three FAR requirements split by phrase, the assessment counts 17 objectives, and every objective reads FCI wherever the source text says CUI.

Why 17 objectives, not 15

The 15 FAR requirements do not all map one to one onto the NIST assessment objectives. Three FAR requirements split by phrase, which produces 17 mapped items. Read each objective as a separate test. A requirement is MET only when every applicable objective is satisfied, so a single unmet objective fails the whole requirement. Confirm the mapping against the June 2018 text of NIST SP 800-171A rather than relying on a summary.

Reading FCI in place of CUI

Level 1 applies to Federal contract information, so an objective that refers to CUI is tested against FCI. Assessors expect the contractor to show that the same safeguard covers FCI wherever it is stored, processed or transmitted. Document the substitution in the self-assessment record so a reviewer can see how each objective was interpreted for your environment.

Access control evidence

For access control, an assessor looks for a list of authorized users, a record of who approved each account, and proof that access to FCI systems is limited to those users and the transactions they need. Typical evidence includes account exports from the directory, role or group assignments, and screenshots or configuration exports showing that public access to FCI is blocked. Gather these from the systems themselves, not from policy statements.

Identification and authentication evidence

Identification objectives ask whether each user and device is uniquely identified before it reaches FCI. Evidence includes identity provider configuration, unique account naming, and records showing that shared or generic accounts are not used to reach FCI systems. Check that authentication settings in the directory match what your written procedure says, since assessors compare the two.

Media sanitization and physical access evidence

Media sanitization objectives require that FCI is removed from media before disposal or reuse. Keep sanitization logs, certificates from disposal vendors, and asset records that tie each device to its disposition. Physical access objectives ask who may enter areas holding FCI systems. Typical evidence is an access list, badge or key logs, and visitor records, all retained in a form an assessor can sample.

Malicious code and flaw remediation evidence

Malicious code objectives ask whether endpoints are protected against malware and whether signatures or engines are kept current. Flaw remediation objectives ask whether known system flaws are identified and corrected in a timely way. Evidence includes anti-malware console reports, patch management records with dates, and scan results showing that identified flaws were closed or tracked. Assessors check that the records cover the systems in scope, not just a sample machine.

How to run a Level 1 self-assessment from scoping to SPRS

This sequence takes a contractor from defining which systems handle Federal contract information to a posted SPRS entry and a senior affirmation of continuing compliance. Each step ends with a record that an assessor or contracting officer could later check.

Define the FCI systems in scope
Start by listing every system, application, device and network path that processes, stores or transmits Federal contract information. Under 32 CFR 170.19(b), Level 1 scope is limited to these systems, and specialized assets such as IoT, OT, government furnished equipment and test equipment are not assessed. The contractor's compliance lead or IT owner prepares the list, and the output is a scope statement that names each system and the CAGE codes it covers. You know this step is done when a reviewer can point to every FCI location and every excluded asset with a stated reason.
Map the 15 safeguards to current practices
Confirm that each of the 15 basic safeguarding requirements in FAR 52.204-21(b)(1) is implemented in the in-scope systems. The contractor owns this work, and an implementation partner can help configure systems, but the organization must make the practices true before assessing them. The output is a short working sheet linking each requirement to the system, owner and tool that carries it. You know this step is done when every requirement has a named owner and a practice that exists today, not one planned for later.
Assess each objective against final evidence
Test the 17 mapped objectives from NIST SP 800-171A (June 2018) against the in-scope systems, reading FCI wherever an objective says CUI. For each objective, collect evidence in final form such as configuration exports, account listings, screenshots with dates, policy documents approved and dated, and logs. Draft policies, unsigned procedures and undated screenshots do not count. The output is an evidence file with one entry per objective. You know this step is done when each objective has a finding of met or not met supported by evidence a third party could inspect.
Score the results all or nothing
Apply the Level 1 scoring rule: every requirement must be MET to achieve Final Level 1 (Self). No plan of action and milestones is permitted, and there is no conditional Level 1 status. If any objective is not met, the contractor fixes the gap, re-collects evidence and repeats the affected tests before scoring again. The output is a signed-off scoring record with the assessment date and the status date. You know this step is done when the record shows every requirement met, or it shows the assessment is not yet complete.
Enter the results in SPRS
Post the self-assessment result in the Supplier Performance Risk System (SPRS). The entry must include the CMMC level, the status date, the assessment scope, every CAGE code in scope and the compliance result, as set out in 32 CFR 170.15(a)(1). The contractor's designated user or service provider performs the entry, and the Affirming Official should check the content before submission. The output is an SPRS record that matches the scope statement and scoring record. You know this step is done when the posted entry reflects the same scope, dates and CAGE codes as the internal files.
Have the Affirming Official affirm compliance
A senior representative responsible for compliance, designated as the Affirming Official under 32 CFR 170.22, must affirm continuing compliance in SPRS at the end of the self-assessment. The affirmation confirms that the requirements remain met for the in-scope systems. The Affirming Official should review the evidence file and scope before signing, because the affirmation is a personal statement of the organization's compliance. The output is a current affirmation in SPRS. You know this step is done when the affirmation appears in SPRS with a date and the Affirming Official's details.
Retain evidence and repeat annually
Keep every artifact used as evidence for six years from the CMMC status date, as required by 32 CFR 170.15(c)(2). Under 32 CFR 170.15(a)(1), the self-assessment must be repeated annually, and the affirmation must follow each assessment and be renewed each year after that, as DFARS 252.204-7021 ties a Final Level 1 (Self) status to a one-year period. Calendar the next assessment, update the scope when systems change, and refresh the evidence. The output is a retained evidence archive and a dated plan for the next cycle. You know this step is done when a person outside the project could locate the evidence for any objective and the next review date is on the calendar.

What a Level 1 self-assessment costs and who gets paid

This table sets the DoD's 2024 per-year estimate against the costs it leaves out, such as internal staff time, tooling, consultants and remediation. Read the estimate as a floor for the assessment and affirmation step only, then use the rows to build your own budget. Expect the largest variable costs to come from closing gaps rather than from the assessment itself.

Cost component	Who is paid or who bears it	One-time or recurring
DoD estimate, other-than-small entity	Covers the self-assessment and affirmation per the DoD's 2024 final rule: $4,042 per year	Recurring, annually
DoD estimate, small entity	Covers the self-assessment and affirmation per the DoD's 2024 final rule: $5,977 per year, assuming an external service provider performs the work	Recurring, annually
Assumed implementation cost	The DoD's 2024 final rule assumed no implementation cost because FAR 52.204-21 already requires the 15 safeguards	Not included in the estimate
Internal staff time	Your IT, security and records staff who gather evidence, run the checks and sign off on results. Not in the estimate	Recurring, every annual cycle
Tooling and licenses	Software, logging, endpoint and backup tools you already use or buy to meet the 15 requirements. Not in the estimate	Mostly recurring
Consultant or implementation partner	An outside party you hire to prepare systems, evidence and the scope document. Not in the estimate. Ask for a written fixed scope	One-time for the first pass, then recurring for reassessment
Remediation of gaps	Hardware, configuration and process work to meet requirements you do not yet satisfy. Cost depends on your starting point	One-time, with ongoing upkeep
Affirming Official time	The senior representative who affirms compliance in SPRS. Their time is internal and not in the estimate	Recurring, annually
Record retention	Storing evidence for six years from the CMMC status date under 32 CFR 170.15(c)(2). Storage is internal or vendor-billed	Recurring, for six years

What makes Level 1 cheaper or more expensive in practice

The cost of a Level 1 self-assessment comes mostly from how much ground the assessment covers and how hard it is to prove each requirement. Scope, shared platforms, excluded assets, existing controls and the number of evidence owners move the effort in both directions. Each driver below names the decision that controls it and the evidence a reviewer will ask for.

Number of systems and CAGE codes

Every system that processes, stores or transmits Federal contract information must be assessed, and every CAGE code in scope must appear in the SPRS entry. A contractor with one laptop fleet and one email tenant has a short list of assets to walk through. A contractor with several business units, separate CAGE codes and duplicated file shares has several sets of evidence to build and keep current. Ask which systems touch FCI before any tooling is bought, and confirm which CAGE codes the SPRS entry must cover.

Shared or cloud platforms holding FCI

When FCI sits in a shared collaboration suite or a cloud tenant, the contractor still owns the 15 requirements for its own use of that platform. Assessors will ask which accounts, groups and sharing settings expose FCI and who approves them. Confirm whether the provider offers configuration records and admin logs you can export as evidence, and whether the provider's own assurance reports cover the controls you rely on. Storing FCI in a platform nobody administers is the most common reason a Level 1 assessment stalls.

Specialized assets excluded from scope

Under 32 CFR 170.19(b), specialized assets such as IoT devices, operational technology, government furnished equipment and test equipment are not assessed at Level 1, and out-of-scope assets need no documentation. Keeping these devices off the FCI network and recording that decision is often cheaper than hardening them. Check that no FCI reaches them through file transfers, shared accounts or remote support tools, because a single bridge can pull them back into scope.

Maturity of existing access and media controls

Access control and media handling carry much of the Level 1 work, including limiting access to authorized users, controlling who can reach FCI and handling removable media. Organizations that already run named accounts, role-based groups, and documented removable media rules spend far less time on evidence than those working from shared logins. Review account lists, group memberships and media logs against the 15 requirements before estimating effort, because gaps found late usually require rework.

Number of evidence owners

A Level 1 self-assessment is only as fast as the people who can show their work. IT, facilities, HR and the business unit that handles FCI each hold part of the evidence, such as account reviews, visitor logs, onboarding records and shipping procedures. When each owner must be chased for screenshots, the assessment takes longer and the evidence quality drops. Assign one owner per requirement area, set a retention location for artifacts that the six-year retention rule covers, and name the Affirming Official who will sign the annual affirmation.

Why all-or-nothing scoring and scope decide whether a contractor passes

A Level 1 self-assessment has no partial credit. Every one of the 15 requirements in FAR 52.204-21(b)(1), mapped to 17 NIST SP 800-171A objectives, must be MET before the organization can claim Final Level 1 (Self). The rule allows no plan of action and milestones and no Conditional Level 1 status, so one unmet objective means the contractor does not have the status. Before scoring, leadership should confirm that every objective is either satisfied with evidence in final form or fixed. Drafts, unsigned policies and screenshots taken for the assessment do not count as proof that a control operates. Under 32 CFR 170.15, the self-assessment must be repeated annually, so a control that slips after the status date can break the next cycle.

Scope decides how much work that all-or-nothing test covers. Under 32 CFR 170.19(b), Level 1 scope is limited to the systems that process, store or transmit Federal contract information. Specialized assets such as IoT devices, operational technology, government furnished equipment and test equipment fall outside that scope, and out-of-scope assets need no documentation. An illustrative case: a machine shop that uses a shop-floor controller and a CNC machine to build parts but sends quotes and invoices only through its finance system would scope the finance system, the email and file services that carry those documents, and the endpoints used to access them. The controller would stay out of scope unless it stores or transmits FCI.

An unclear boundary is the most common reason a Level 1 scope is challenged. If the team cannot show, with a current inventory and data flow diagram, which systems touch FCI, an assessor or a prime reviewing the SPRS entry has no basis to accept the claimed scope. Before the self-assessment starts, document where FCI enters, where it is stored and where it leaves the organization, then reconcile that map against the asset inventory. Confirm the scope with counsel or the contracting officer if the contract language is ambiguous. Record the scope statement, the CAGE codes in scope and the reasons excluded assets are excluded, because those entries feed the SPRS record and must be retained for six years from the status date.

Questions contractors ask before a Level 1 self-assessment

How long does a first CMMC Level 1 self-assessment take?

The supplied facts do not give a duration, so ask for an estimate built from your own scope rather than a generic figure. The main drivers are how many systems process, store or transmit Federal contract information (FCI), how many of the 15 FAR 52.204-21 safeguards already exist as documented practice, and how many people must gather evidence. A contractor with one email tenant, a few endpoints and written access and media procedures will move faster than one with several business units and undocumented practices. Ask any implementation partner for the work broken into scoping, gap review, remediation, evidence collection and scoring, with an estimate for each step.

Can we run the Level 1 self-assessment ourselves?

Yes, a Level 1 self-assessment is performed by the contractor, so no third-party assessor is required. Your organization owns the assessment, the scoring and the result entered in SPRS. Internal staff need to read each requirement, check the matching NIST SP 800-171A objectives with the FCI reading applied, and keep evidence that is final rather than draft. Many teams bring in outside help for scoping, remediation or a second review, but that help prepares systems and records and does not issue the result. Confirm internally who has the authority to sign and who will hold the evidence for six years.

What does the Affirming Official sign?

The Affirming Official signs an affirmation of continuing compliance in SPRS at the end of each Level 1 self-assessment and again every year after that. Under 32 CFR 170.22, this person must be a senior representative responsible for the organization's compliance. The affirmation states that the organization continues to meet the Level 1 requirements for the systems in scope. Because the signature is a personal and organizational attestation, choose someone with authority over the systems and the evidence, and confirm that every in-scope system and CAGE code is covered before signing. A self-assessment result that is not affirmed does not support award.

How long must we keep Level 1 assessment artifacts?

Keep artifacts used as evidence for a Level 1 self-assessment for six years from the CMMC status date, as set by 32 CFR 170.15(c)(2). The clock starts from the status date recorded for the assessment, not from the date you collected the evidence. Retention covers screenshots, policies, configuration exports, access reviews, training records and any other item you cite for a requirement. Store them in a location with controlled access and a clear version history, and set a reminder before each annual reassessment so superseded versions are kept and dated correctly.

Is Level 1 still required during the 2026 Phase II suspension?

Yes, Level 1 remains available to contracts during the suspension. The Department of War suspended CMMC Phase II on 13 July 2026, but DoW Class Deviation 2026-O0025, Revision 3 (3 September 2026) still allows requiring activities to include CMMC Level 1 (Self) assessments while the Phase 2 transition is suspended. Phase I self-assessments, SPRS postings and affirmations remain in place. Whether a particular solicitation requires Level 1 depends on its terms, so check the clause and the requirement in each contract or subcontract rather than assuming it applies or does not apply.

Do subcontractors that handle only FCI need Level 1?

Yes. Under 32 CFR 170.23(a)(1), a subcontractor that handles only Federal contract information, and not CUI, needs Level 1 (Self). The prime contractor must confirm that the subcontractor holds a Final Level 1 (Self) status and a current affirmation in SPRS for each system in scope before award. Scope follows the subcontractor's own systems that process, store or transmit FCI. Primes should ask for the SPRS record and the CAGE codes covered, and subcontractors should confirm that the status date and affirmation are still current, since a Final Level 1 (Self) status is current for 1 year under DFARS 252.204-7021.

What does a Level 1 self-assessment cost, and what drives it?

The DoD's 2024 final rule estimated a Level 1 self-assessment plus affirmation at $4,042 for an other-than-small entity and $5,977 for a small entity, each year, and assumed the small entity would use an external service provider. The same rule assumed no implementation cost because FAR 52.204-21 already requires the 15 safeguards. Treat these as federal estimates, not quotes. Your real cost depends on the number of in-scope systems, how many safeguards you must add or document, staff time for evidence gathering, and whether you pay an outside party for scoping or review. Ask any provider for a fixed-scope written quote that separates one-time work from annual reassessment work.

What does a Level 1 self-assessment never cover?

Level 1 covers the systems that process, store or transmit FCI and nothing beyond the 15 FAR 52.204-21 safeguards. Under 32 CFR 170.19(b), specialized assets such as Internet of Things devices, operational technology, government furnished equipment and test equipment are not assessed, and out-of-scope assets need no documentation. A Level 1 result therefore does not show that you protect CUI, which requires Level 2 under NIST SP 800-171. If a contract or subcontract involves CUI, the Level 1 result will not satisfy it. Confirm the information type in each contract before choosing the level.

Who owns the Level 1 self-assessment and who prepares it

The contractor owns the Level 1 self-assessment from start to finish. It decides the scope, owns the 15 safeguarding requirements of FAR 52.204-21, performs the assessment against the NIST SP 800-171A objectives used for Level 1, scores the result, and records it in SPRS. The Affirming Official, a senior representative responsible for compliance, must affirm continuing compliance in SPRS at the end of the assessment and annually after that. That affirmation is a personal and organizational statement, and it cannot be delegated to a consultant or partner.

Scope decisions: The contractor identifies every system that processes, stores or transmits Federal contract information.
Scoring: Every Level 1 requirement must be MET, because the result is all-or-nothing and no POA&M is permitted.
Affirmation: The Affirming Official signs the affirmation in SPRS, and the contractor answers for it.
Records: The contractor keeps the artifacts used as evidence for six years from the CMMC status date.
Renewal: The contractor repeats the self-assessment every year.

Before relying on any outside help, confirm with your contracting officer and your own counsel which affirmation and SPRS entries your contracts require.

What must be in place before scoring the 17 objectives

Level 1 scoring only means something if the evidence behind each objective is final, current and tied to the systems that actually handle Federal contract information. The cards below cover the checks an organization should complete before it marks any objective MET, and they are most useful when one person owns each check and can show the evidence on request.

Current inventory of FCI systems

Start with a written list of every system, device and account that processes, stores or transmits Federal contract information. Under 32 CFR 170.19(b), Level 1 scope is defined by FCI handling, so this list sets the boundary for every objective. Check that the inventory is dated, names an owner for each asset, and matches what IT actually operates. Out-of-scope items such as government furnished equipment still need to be identified so they can be excluded on purpose.

Documented access and identification controls

Assessors need to see how users and devices are identified, how accounts are granted and removed, and how access to FCI is limited to authorized users. Confirm that account lists are current, that shared or generic accounts are known, and that the procedure for removing access at departure is written down and has been followed. A policy that exists only as a draft does not count toward a MET result, so confirm the final approved version and the records showing it was applied.

Media sanitization and disposal records

The sanitization objective asks whether media containing FCI is cleared before it is reused or thrown away. Check for a written disposal procedure and a log of drives, printers, copiers and removable media that were sanitized or destroyed. Records should show what was done, when, by whom, and to which asset. If no media has been disposed of yet, that is a fact to state plainly, and the procedure should still be final before scoring.

Physical access evidence

Physical objectives cover who can reach the spaces and equipment that hold FCI. Gather the current list of people with badge or key access, visitor sign-in records, and any access logs or camera retention settings the organization uses. Confirm that facilities records match the asset inventory, since a server closet missing from the inventory will undermine the physical result. Records should be final exports or signed logs, not working spreadsheets.

Malicious code protection and flaw remediation records

Check that endpoints and servers in scope have malicious code protection that is enabled and updating, and collect the reports that show it is working. For flaw remediation, keep dated records of patches or updates applied to in-scope systems and the process used to identify them. Look for gaps where systems were not updated, and document how those gaps were handled. Evidence should come from the tools themselves, such as console exports or patch reports, not from recollection.

A named Affirming Official

Under 32 CFR 170.22, a senior representative responsible for compliance must affirm continuing compliance in SPRS at the end of each Level 1 self-assessment and annually after that. Name one person in writing, confirm that person has authority over the systems in scope, and make sure they review the evidence before signing. The affirmation is a personal statement, so the person should understand what each objective requires and where the supporting records are kept.

When an outside partner helps with Level 1 and what it should not do

Outside help is worth buying when the organization cannot yet say with confidence which systems process, store or transmit Federal contract information (FCI), when the FCI footprint spans several sites or cloud accounts, when the internal team is small enough that no one has time to gather evidence, or when an earlier attempt failed and nobody can explain why. In those cases a partner can do the groundwork: map the systems in scope under 32 CFR 170.19(b), configure the 15 FAR 52.204-21 safeguards on those systems, and write down how each one works so the organization can show it. A partner can also set up the logs, access settings, update routines and backups that produce evidence, and check that the evidence is in final form before anyone scores it.

The line that matters is what the partner must not do. Scoring the self-assessment against the NIST SP 800-171A objectives is the organization's job, and so is deciding whether each requirement is MET. Only the Affirming Official, a senior representative responsible for compliance, can affirm continuing compliance in SPRS under 32 CFR 170.22. A partner that scores the assessment, enters results or affirms on the organization's behalf is taking over a responsibility the rule assigns to the company. A partner also cannot certify compliance. DeployOpen prepares systems, controls and evidence for assessment, but DeployOpen is not an assessor and does not issue reports or certificates. Ask any firm to put this division of roles in the written scope before work starts.

Before signing, the organization should confirm three things in writing: which deliverables the partner produces (configured settings, documented procedures, an evidence set per requirement), who on the internal team owns each objective, and who signs the SPRS entry. Ask whether the partner will leave the organization able to repeat the assessment each year, since the rule requires annual repetition. Also confirm which costs are one-time and which recur, such as hosting, licenses and the annual affirmation. Because the scope agreed in writing defines the work, a scope that is vague about systems will produce a quote that is vague about effort.

How DeployOpen prepares Level 1 scope and evidence

DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure, so the systems that handle Federal contract information can be scoped and evidenced for a CMMC Level 1 self-assessment. The organization owns the self-assessment, the Affirming Official affirms compliance in SPRS, and DeployOpen prepares the systems, controls and evidence the organization reviews.

How we scope

Identify every system that processes, stores or transmits Federal contract information, as the scope definition requires.
Record out-of-scope assets such as IoT, OT, government furnished equipment and test equipment with the reasons they are excluded.
Agree the written scope, deliverables and timeline with the client before any work starts, as fixed-scope engagements do.

How we build

Configure the 15 FAR 52.204-21 safeguards on in-scope systems using open-source components the client selects and controls.
Map each safeguard to the 17 mapped NIST SP 800-171A objectives, reading FCI wherever an objective says CUI.
Test each objective on the built systems and record gaps so the client can close every one before self-assessment.

How we hand over

Deliver the system documentation, configuration records and evidence artifacts in final form, not drafts.
Set up a retention structure for artifacts that keeps evidence for six years from the CMMC status date.
Walk the client's assessor-facing owner through the evidence index so the organization can defend its self-assessment result.

How we support

Support the annual reassessment cycle, since a Level 1 self-assessment must be repeated every year.
Offer ongoing support, upgrades and continuous testing as a retainer, separate from the initial fixed-scope work.
Confirm with the client's counsel or contracting officer which requiring activities and contract clauses apply before the cycle begins.