CMMC Level 1 is the foundation tier — for contractors that handle Federal Contract Information (FCI) but no CUI. It requires the 15 basic safeguarding requirements that federal contracts have carried for years under FAR 52.204-21, verified not by a third party but by an annual self-assessment entered in SPRS with an affirmation from a senior official, as laid out in 32 CFR Part 170. It is dramatically lighter than Level 2 — and knowing which one your contracts actually require is worth real money.
Who Level 1 covers: the FCI test
FCI is information not intended for public release that you receive or generate under a government contract — think statements of work, delivery schedules, performance information. Nearly every federal contractor holds FCI; that alone is Level 1 territory. The line that moves you up is CUI: drawings, technical data, and marked program information bring NIST SP 800-171 and Level 2 obligations. If you are unsure which side of the line your contracts sit on, who needs CMMC walks the decision, and reading your DFARS clauses settles it.
The 15 requirements, in plain terms
- Control who gets access — accounts for authorized users only, limited to the transactions their job needs.
- Control connections — verify and limit external systems, public information posting, and boundary protections.
- Identify and authenticate — unique IDs, authenticated users and devices.
- Keep the environment clean — sanitize media before disposal, escort visitors, limit physical access.
- Watch and fix — malicious-code protection kept current, periodic scans, timely flaw remediation.
The self-assessment and affirmation
Level 1 is self-assessed annually against all 15 requirements, with the result entered in SPRS and affirmed by a senior company official. Two details deserve respect: Level 1 permits no POA&M — the requirements are met or they are not — and the affirmation is a formal representation to the government, which puts honest scoping and real implementation squarely on leadership’s desk. "Self-assessed" does not mean "casual."
What Level 1 costs — and when to just build for Level 2
DoD’s own rulemaking analysis put small-entity Level 1 self-assessment costs in the low thousands annually — the cited figures and sources are in our cost guide. The strategic question is trajectory: if CUI is in your pipeline — a prime relationship maturing, an RFP that smells like technical data — building your environment Level 2-shaped from the start (a scoped enclave, the documentation spine) costs far less than retrofitting a Level 1 shop mid-award. We tell clients plainly which tier their contracts demand — and when spending less is the right answer.