Meet every CMMC Level 1 objective with evidence ready

CMMC Level 1 is the foundational level of the Department of Defense Cybersecurity Maturity Model Certification programme. It protects Federal Contract Information through 15 basic safeguarding requirements drawn from FAR 52.204-21, such as limiting system access to authorised users, authenticating users, sanitising media, controlling physical access, protecting network boundaries and patching flaws. Contractors confirm compliance through an annual self-assessment rather than a third-party audit.

The CMMC Level 1 assessment objectives are the 59 specific determination statements an assessor, or the contractor itself, checks to decide whether each of the 15 requirements is met. They are published in the official CMMC Level 1 assessment guide and adapted from NIST SP 800-171A. A requirement is only met when all of its objectives are met, so the objectives are the practical checklist for a self-assessment.

CMMC Level 1 applies to Department of Defense contractors and subcontractors whose contracts involve Federal Contract Information, meaning information provided by or generated for the government under a contract that is not intended for public release. Where a contract also involves Controlled Unclassified Information, Level 2 applies instead. Contracts solely for commercially available off-the-shelf items are excluded from CMMC requirements.

To complete a CMMC Level 1 self-assessment, scope the systems and people that handle Federal Contract Information, then assess each of the 59 objectives using examination, interviews and testing. All 15 requirements must be met, as plans of action are not permitted at Level 1. Results are entered in the Supplier Performance Risk System (SPRS) and a senior affirming official confirms compliance, then reaffirms every year.

If a contractor does not have a current CMMC Level 1 self-assessment and affirmation in SPRS when a solicitation requires it, it cannot be awarded that contract, and prime contractors cannot award it relevant subcontracts. An inaccurate affirmation is also a serious risk, because false statements to the government can create liability under the False Claims Act, which the Department of Justice actively pursues in cybersecurity cases.

CMMC Level 1 is a small subset of NIST SP 800-171: its 15 requirements correspond to 17 of the 110 NIST SP 800-171 Revision 2 controls used at CMMC Level 2. ISO 27001 does not satisfy CMMC on its own, but many of its controls, such as access control, malware protection and patching, overlap heavily, so an ISO 27001 programme gives a strong head start on Level 1 evidence.

How long CMMC Level 1 takes depends mostly on how well your basic controls are already in place and documented. The 15 requirements are foundational cyber hygiene, so organisations with established access control, patching and endpoint protection often only need to scope their FCI environment, close small gaps and gather evidence. Organisations starting from scratch will need longer to implement and evidence each objective.

Yes, CMMC Level 1 is mapped in the OneClickComply control library and is available on request. Mapped controls cover the 15 requirements and 59 assessment objectives, with automated evidence collection, policy generation and continuous monitoring. OneClickComply does not submit your SPRS score or affirm on your behalf: your affirming official remains responsible, and our in-house auditors can review your self-assessment before you submit it.