Prepare for your CMMC Level 1 self-assessment with confidence

CMMC Level 1 is the foundational level of the US Department of Defense's Cybersecurity Maturity Model Certification programme. It requires contractors that handle Federal Contract Information to meet the 15 basic safeguarding requirements in FAR 52.204-21, such as limiting system access to authorised users, sanitising media before disposal, patching flaws and running malware protection. Compliance is shown through an annual self-assessment and an affirmation by a senior company official in SPRS.

Any DoD contractor or subcontractor that processes, stores or transmits Federal Contract Information, but not Controlled Unclassified Information, needs CMMC Level 1 when its contract includes the CMMC clause. This includes non-US suppliers, such as UK firms in the defence supply chain. Prime contractors must flow the requirement down to subcontractors that handle FCI, so smaller suppliers are often asked for their Level 1 status by their customers.

The 15 CMMC Level 1 requirements come from FAR 52.204-21 and cover six domains. Access Control has four (authorised access, transaction control, external connections, public information). Identification and Authentication has two. Media Protection has one (media disposal). Physical Protection has two (limiting physical access and managing visitors). System and Communications Protection has two (boundary protection and public system separation). System and Information Integrity has four (flaw remediation and three malware protection requirements).

You comply with CMMC Level 1 by implementing all 15 requirements across the systems that handle FCI, then carrying out a self-assessment against the DoD Level 1 Assessment Guide. Every requirement must be met, as plans of action are not allowed at Level 1. The results go into SPRS, and a senior official affirms continued compliance. Both the self-assessment and the affirmation must be repeated every year.

CMMC Level 1 results in a CMMC status rather than a third-party certificate. Contractors assess themselves and record a Final Level 1 (Self) status in SPRS, backed by an annual affirmation. No external assessor is involved, unlike Level 2 certification assessments by a C3PAO or Level 3 assessments by the DoD. The self-assessment still carries legal weight, because the affirmation is a formal statement to the US government.

If you do not hold a current CMMC Level 1 status when a contract requires it, you are not eligible for award of that contract or for the subcontract. Affirming compliance when requirements are not actually met also creates legal risk, as false statements to the US government can lead to action under the False Claims Act. Keeping evidence current between annual assessments helps avoid both problems.

CMMC Level 1 overlaps heavily with ISO 27001 and Cyber Essentials, but neither replaces it. ISO 27001 Annex A covers all 15 Level 1 topics, such as access control, malware protection and physical security, and Cyber Essentials covers many of the technical ones. You still need to self-assess against the CMMC requirements and affirm in SPRS. Mapping one control set across all three avoids collecting the same evidence twice.

Yes. OneClickComply supports CMMC Level 1 today. You can track all 15 requirements, collect evidence automatically from connected tools, generate supporting policies and monitor for control drift. OneClickComply helps you prepare for your self-assessment and affirmation, but it does not submit to SPRS or certify compliance on your behalf.