CMMC Level 1 Self-Assessment: How to Do It and Submit Your SPRS Score

A CMMC Level 1 self-assessment means checking your own systems against the 15 basic safeguarding requirements in FAR 52.204-21, marking each one met or not met, entering the result in SPRS, and having a senior official affirm it. You repeat it every year. No outside assessor is involved, and no POA&M is allowed at Level 1: every requirement has to be met.

This guide walks through who needs it, what the 15 requirements say in plain language, and how to finish the submission.

Who needs a CMMC Level 1 self-assessment?

Contractors and subcontractors whose systems store, process or transmit federal contract information (FCI) but not controlled unclassified information (CUI). FCI is information provided by or generated for the government under a contract that isn't meant for public release. If you handle CUI, you are in Level 2 territory. Start with our plain explainer, CUI Explained: The Most Confusing Part of CMMC, and see where CMMC fits next to SOC 2 and NIST.

Is Level 1 still required while CMMC Phase 2 is paused?

Phase 1, which allows self-assessments, began November 10, 2025. On July 13, 2026, DoD suspended Phase 2, the step that would have required third-party (C3PAO) assessments for most Level 2 contractors starting November 10, 2026. During the suspension, program offices may include only Level 1 (Self) or Level 2 (Self) requirements in solicitations. Level 1 was already a self-assessment, so the pause doesn't change what you do. As of October 27, 2026, Phase 2 is still suspended and DoD has not announced a replacement date. Suspended is not canceled. Treat Level 1 as live.

What are the 15 requirements, in plain language?

They come from FAR 52.204-21. In short, you need to:

1. Limit system access to authorized users, processes and devices.
2. Limit what those users can do.
3. Verify and control connections to external systems.
4. Control what is posted on public systems.
5. Identify users, processes and devices.
6. Authenticate them before granting access.
7. Sanitize or destroy media that holds FCI before disposal or reuse.
8. Limit physical access to systems and equipment.
9. Escort visitors, keep physical access logs and manage access devices such as keys and badges.
10. Monitor, control and protect communications at your network boundaries.
11. Keep public-facing components on a separate subnetwork from your internal network.
12. Find and fix system flaws promptly.
13. Protect against malicious code.
14. Keep that protection updated.
15. Run periodic scans and scan files from external sources in real time.

How do you complete the self-assessment?

1. Set your scope. List the systems and locations that touch FCI, and the CAGE codes tied to them.
2. Walk each requirement. Ask what you do today, who owns it, and how you would show it.
3. Score each one met or not met. If it isn't met, fix it first. Level 1 does not allow a POA&M.
4. Collect evidence. Screenshots, configuration exports, visitor logs, patch reports. Keep it for six years from your status date.
5. Get the affirmation. A senior official who has authority over compliance affirms the result.
6. Enter it in SPRS. You provide the CMMC level, status date, scope, CAGE codes and the result.
7. Put the renewal on the calendar. You repeat the assessment and resubmit every year.

Where do small contractors struggle to defend a "met"?

• Shared logins or accounts nobody owns (requirements 1, 2, 5, 6).
• No visitor log or badge process (8, 9).
• Old laptops, USB drives and printers leaving with data on them (7).
• Patches and antivirus on some machines but not all (12 to 15).
• A guest or public Wi-Fi network that isn't separated from the office network (10, 11).

If you can't show proof for a requirement today, it isn't met yet.

What is the legal risk of getting the affirmation wrong?

Law firms advising contractors warn that SPRS scores and affirmations can carry False Claims Act exposure. The Justice Department's Civil Cyber-Fraud Initiative uses the False Claims Act against contractors that misrepresent their cybersecurity practices. An affirmation is a statement to the government. Score what you can prove.

Where does FirstCall fit?

FirstCall prepares companies for CMMC. For Level 1, you perform the self-assessment and your senior official affirms it. We can review your results and scope what's left. Book a free results review and scoping call. For a deeper look at the program, see our CMMC page.

FAQ

Do I still need a Level 1 self-assessment if Phase 2 is paused?

Yes, if your contracts call for Level 1 (Self). The suspension affects Phase 2 third-party assessments, not self-assessments.

How often do I repeat it?

Every year. Resubmit to SPRS and keep your evidence for six years from the status date.

Who signs the affirmation?

A senior company official with authority to affirm continuing compliance.

Can I use a POA&M at Level 1?

No. All requirements must be met.

What is the difference between Level 1 and Level 2?

Level 1 protects FCI with 15 requirements. Level 2 protects CUI and is based on NIST SP 800-171 (110 requirements).

Sources

• 32 CFR 170.15, CMMC Level 1 self-assessment and affirmation (eCFR)
• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (acquisition.gov)
• Department of War, "Department of War Suspends CMMC Phase II Requirements" (July 13, 2026)
• DoD memorandum, Implementing the Suspension of CMMC Phase II (July 2026)
• U.S. Department of Justice, Civil Cyber-Fraud Initiative announcement (October 6, 2021)
• Latham & Watkins, What Defense Contractors Should Know About DoD's Suspension of CMMC Phase 2 (July 30, 2026)
• Federal News Network, RFI offers path forward for DoD with CMMC (October 27, 2026)

Reviewed: October 28, 2026