CMMC Level 1 Self-Assessment: A Checklist for a 20-Person Subcontractor

A prime contractor has just told your office manager that before the next purchase order goes out, your company needs a CMMC Level 1 self-assessment posted in SPRS. You are a 20-person subcontractor, the prime says what you receive is Federal Contract Information rather than CUI, and nobody in the building has opened the regulation.

Level 1 is short and its rules are written plainly in 32 CFR Part 170. Those rules also leave no room for partial credit, and the person who signs the affirmation is putting their name to a statement the government can check.

What does Level 1 actually require?

Level 1 is the FAR basic safeguarding clause and nothing more. 32 CFR 170.14(c)(2) says the Level 1 requirements are those in 48 CFR 52.204-21(b)(1)(i) through (xv), and the definitions in the same part call them the 15 Level 1 requirements. The DoD CIO program page agrees: an annual self-assessment and annual affirmation against the 15 security requirements in FAR clause 52.204-21.

If you have seen a larger number, the regulation's mapping table shows where it can come from. Table 2 to 170.15 maps each requirement to NIST SP 800-171A objectives, and a footnote explains that FAR requirements were broken apart by phrase when NIST wrote 800-171. The visitor and physical access requirement, PE.L1-b.1.ix, appears as three rows, so the table has 17 rows for 15 requirements. Count requirements, not rows. You assess against the mapped 800-171A objectives, reading FCI wherever an objective says CUI.

What is in scope when you only handle FCI?

The FAR clause defines FCI as information not intended for public release that is provided by or generated for the Government under a contract, excluding information the Government has made public and simple transactional information such as what is needed to process payments. Statements of work, delivery schedules and the status reports you send back can all qualify.

Scoping follows the information. Under 170.19(b), systems that process, store, or transmit FCI are in scope; systems that do not are out of scope, with no documentation requirements. The DoD Level 1 Scoping Guide spells out the verbs: process means FCI is accessed, entered, edited, generated, manipulated, or printed; store includes paper documents; transmit covers physical as well as digital transport. The regulation tells you to consider the people, technology, facilities, and external service providers that touch FCI.

Two carve-outs matter. Specialized Assets, which include IoT, operational technology, government furnished equipment and test equipment, are not part of the Level 1 scope and are not assessed. An endpoint running a VDI client that passes nothing beyond keyboard, video and mouse is out of scope. A system security plan is recommended at Level 1 but not required, and a new assessment is needed after significant boundary changes such as network expansions or mergers.

What do the self-assessment and affirmation require?

• Every requirement must be MET. Level 1 results are scored MET or NOT MET in their entirety, and no POA&M is permitted.
• N/A counts as MET; the DoD assessment guide's example is SC.L1-b.1.xi when no publicly accessible systems are in scope.
• Evidence must be final. Working papers, drafts, and unofficial or unapproved policies are unacceptable.
• SPRS gets, at minimum, the level, the CMMC Status Date, the scope, every CAGE code tied to in-scope systems, and the result.
• The self-assessment repeats on an annual basis, with an affirmation at completion and annually thereafter.

The Affirming Official is the senior level representative responsible for CMMC compliance who has authority to affirm it. The affirmation carries that person's name, title and contact information and a statement that the company has implemented and will maintain all applicable requirements. In a 20-person company that is normally the owner, not the outside IT provider. Hiring help does not change the category: the assessment guide says a third party that assists is still a self-assessment and does not result in a certification.

The DoD SPRS briefing shows the Level 1 entry asking for the assessment date, enterprise or enclave scope, number of employees, FAR 52.204-21 compliance and included CAGE codes. The finished record shows a UID, a Final or No CMMC Status, and an expiration date. Without the SPRS Cyber Vendor User role, the entry screen does not appear.

When does it become a contract condition?

DFARS 204.7502 says contracting officers shall not award to an offeror without a current CMMC status at the required level, and that CMMC level 1 requires a final CMMC level for award. 32 CFR 170.15(b) says the same from your side: before award of a contract or subcontract requiring Level 1 (Self), you must hold that status and have submitted the affirmation in SPRS.

The contract clause is DFARS 7021, in section 252.204. For Final Level 1 (Self), current means not older than one year, with an affirmation not older than one year. The contractor may only process, store, or transmit FCI on systems holding the required status, and must flow the clause down to subcontracts involving FCI or CUI. That is why the request reached you: 170.23 says a subcontractor handling only FCI needs Level 1 (Self), and the clause has the prime ensure subcontractors affirm before subcontract award.

On timing, the DoD CIO states the first phase began on November 10, 2025, and under 170.3 Phase 1 is when DoD intends to make Level 1 (Self) a condition of contract award. On July 13, 2026, the Department suspended Phase II, which had been scheduled for November 10, 2026, and said all Phase I self-assessment requirements remain in place. For an FCI-only subcontractor, nothing about the prime's request changes.

A checklist pass for a 20-seat shop

The 15 requirements in FAR order, with evidence a small office can keep. The evidence is modeled on the examples in the DoD Level 1 guide, not a mandated set; whatever you keep must be final and dated.

• Authorized access. A list of authorized users and devices, and an account export reconciled against it. The guide's examine list includes active system accounts with the individual associated with each.
• Transactions and functions. A role list showing who holds administrator rights, and the permissions on the contract files folder.
• External connections. A written rule on personal devices and outside systems, and the sign-in control that enforces it. The guide's example tells staff to use company laptops, not personal ones.
• Public information. A short list of who may post to the website, and a dated review before anything about a DoD job goes public. The guide states that only government officials can be authorized to publicly release FCI.
• Identification. A unique user name per person, no shared logins, and a name for each device; the guide's example is as simple as SW001.
• Authentication. The sign-in policy and a record that default passwords on new laptops, printers and network gear were changed.
• Media disposal. A shred log or destruction certificates, and wipe records for reused machines. The guide points to NIST SP 800-88 Revision 1.
• Physical access. A list of key and badge holders, and printers placed where output is not exposed.
• Visitors and access devices. A sign-in sheet, an escort rule, and a key inventory with returns checked off. You set retention; the guide's example keeps paper sign-in sheets for one year in a locked cabinet.
• Boundary protection. A one-page network diagram, the firewall rule set, and its log or blocked-traffic report.
• Public-facing separation. A written N/A statement, or evidence that a public server sits on a separate subnetwork such as a DMZ.
• Flaw remediation. A written patch timeline, such as the guide's weekly for end-user computers and monthly for servers, and the report showing it happened.
• Malicious code protection. An inventory showing anti-malware on every workstation, server and email path.
• Updating protection. The setting showing definition updates on a schedule, daily in the guide's example.
• Scanning. Scheduled and real-time scan settings, including files from USB drives.

A worked example

A 20-seat machine shop builds brackets for a prime, which has confirmed in writing that it sends only FCI: statements of work, delivery schedules, purchase orders. Eighteen people have accounts, two shop-floor tablets display job travelers, there is a CNC cell and an office file server, and an outside IT provider manages the firewall.

The office manager follows the information rather than the floor plan. FCI arrives by email, is saved to one shared folder, and is printed for the floor. In scope: the email tenant, the file server, the office laptops, the tablets, the printer, the firewall, the office, and the IT provider. The CNC controllers are operational technology, a Specialized Asset outside the Level 1 scope. The break-room TV touches no FCI and needs nothing documented.

Thirteen requirements come back MET and one N/A, with evidence in a folder named for the assessment date. One does not: nobody can say who holds the office keys. Because Level 1 allows no POA&M, the shop does not submit a gap with a promise. The manager collects the keys, rekeys the locks whose keys are missing, writes the inventory, and only then marks PE.L1-b.1.ix MET. Public-facing separation is N/A because the website is hosted elsewhere and holds no FCI, and a one-line statement says so.

The owner, as Affirming Official, reviews the evidence folder rather than a summary before affirming in SPRS under the shop's CAGE code. The calendar gets the annual reassessment a month before the anniversary, plus a prompt to re-scope if a new building or file system appears.

Where does it go wrong?

Scoping too wide. Pulling in the CNC cell and building controls volunteers you to show MET on equipment you cannot fully secure, when Specialized Assets are not assessed at Level 1 at all.

Scoping too narrow. The usual miss is the path FCI really takes: the personal phone with company email, the USB stick carried to the floor, the IT provider's remote tool. Transmit includes physical transport, and service providers are on the scoping list.

Affirming without evidence. MET requires final evidence, and the affirmation is a signed statement of continuing compliance. The Justice Department's MORSECORP settlement shows how a self-reported number becomes liability, in a NIST SP 800-171 case rather than Level 1. The company submitted a score of 104, a consultant later told it the score was actually -142, and it did not update the DoD system until three months after a subpoena. It agreed to pay $4.6 million to resolve False Claims Act allegations, and the whistleblower's share was $851,000.

Letting it lapse. Current means not older than one year. An affirmation past its anniversary leaves you without a current status at the next award.

The decision rule

If FCI touches a system, a person, a room or a provider, it is in scope; if not, leave it out. If you cannot show final evidence for all 15 requirements today, do not affirm; fix the gap first, because Level 1 has no POA&M and no conditional status. If the prime later says the work involves CUI, stop: 170.23 makes Level 2 (Self) the minimum, and a Level 1 affirmation does not cover it.