CMMC Level 1: 15 Requirements for Protecting Federal Contract Information (FCI)

CMMC Level 1 is the foundational cybersecurity level for contractor information systems thatprocess, store, or transmit Federal Contract Information. It requires all 15 basic safeguarding requirements inFAR 52.204-21, an annual self-assessment, and an annual affirmation of compliance.

Who Needs CMMC Level 1?

CMMC Level 1 is designed for contractor information systems that process, store, or transmit Federal Contract Information but do not require the higher protections associated with Controlled Unclassified Information.

This can include primes and subcontractors of any size. A small manufacturer, professional-services firm, logistics provider, technology company, or specialty subcontractor may need Level 1 if FCI resides in or transits its systems and the applicable contract requires Level 1 status.

Key point: Level 1 is not “CMMC for small businesses.” It is CMMC for environments that need to protect FCI. If your organization handles CUI, review CMMC Level 2 instead.

What Is Federal Contract Information (FCI)?

Federal Contract Information is information not intended for public release that is provided by or generated for the federal government under a contract to develop or deliver a product or service.

It does not include information the government has already made public or simple transactional information such as data
needed only to process payments.

Practical examples: Depending on the contract, FCI can include non-public contract performance information, project schedules, non-public deliverable details, internal contract communications, or other information generated or exchanged to perform the federal contract that is not designated for public release.

Scope note: Before assessing Level 1, identify where FCI enters your business, which users access it, which devices and applications process it, where it is stored, and how it is transmitted to other parties

How the CMMC Level 1 Self-Assessment Works

Level 1 is assessed by the organization seeking the status. The organization evaluates whether all 15 Level 1 safeguards are implemented within the defined Level 1 assessment scope, records the result in SPRS, and completes the required affirmation of continuous compliance.

Step 1: Define the Level 1 assessment scope around systems that process, store, or transmit FCI.
Step 2: Evaluate each of the 15 FAR safeguards and collect evidence showing the requirement is implemented.
Step 3: Remediate any missing requirement before claiming Final Level 1. Level 1 does not allow a POA&M for unresolved safeguards.
Step 4: Enter the self-assessment result and required information in SPRS.
Step 5: Complete the affirmation after the assessment and maintain an annual affirmation. Repeat the Level 1
self-assessment annually.

What Evidence Should You Maintain for CMMC Level 1?

A self-assessment should still be evidence-based. Your organization should be able to demonstrate that each safeguard exists and is operating in the scoped environment.

Evidence 1: User and device inventories showing who and what is authorized.
Evidence 2: Access-control settings, permission groups, and authentication configurations.
Evidence 3: Remote-access and external-system connection rules.
Evidence 4: Public-information review/approval process.
Evidence 5: Media sanitization and disposal records.
Evidence 6: Physical access procedures, visitor logs, badge/key controls, and restricted-area practices.
Evidence 7: Firewall/boundary protection and network-segmentation configurations.
Evidence 8: Patch, vulnerability, malware-protection, update, and scanning records.

Bottom line: Evidence should reflect what your environment actually does. Policies that describe controls that
are not implemented - or technical settings that are not reflected in documentation - create avoidable risk.

Common CMMC Level 1 Gaps

Gap 1: Shared accounts or unclear user ownership make it difficult to prove authorized access.
Gap 2: Former employees, contractors, or devices retain access longer than they should.
Gap 3: FCI is copied to personal email, unmanaged devices, unapproved cloud storage, or public collaboration links.
Gap 4: Visitor and physical access procedures exist informally but are not consistently logged or enforced.
Gap 5: Patch and malware protections are installed but there is no reliable evidence that updates and scans occur consistently.
Gap 6: The organization assumes its MSP “handles security” without defining which Level 1 safeguards the MSP actually performs and which remain the contractor’s responsibility.

Closing: The fastest path to Level 1 readiness is usually not buying more technology. It is clearly identifying FCI, reducing the scope, assigning ownership, and validating that the 15 safeguards operate consistently.

Get CMMC Level 1 Right Without Overbuilding Your Environment

MAD Security helps defense contractors identify what information is actually in scope, map the systems that handle it, assess the 15 Level 1 safeguards, close gaps, and create evidence that reflects the real operating environment.

If your contract path may eventually involve CUI, we can also help you design Level 1 improvements so they do not become dead-end investments. The goal is an environment that is secure, supportable, and aligned to the requirements you actually have.

How many requirements are in CMMC Level 1?

CMMC Level 1 has 15 basic safeguarding requirements taken directly from FAR 52.204-21

What information does CMMC Level 1 protect?

Level 1 is focused on Federal Contract Information, or FCI, processed, stored, or transmitted on contractor
information systems.

Is CMMC Level 1 a self-assessment?

Yes. Under the current program, Level 1 is an organization-conducted self-assessment performed annually, with
the result and required affirmation maintained in SPRS.

How often is CMMC Level 1 assessed?

Level 1 self-assessment is required annually, with annual affirmation of continuous compliance.

Can we use a POA&M for CMMC Level 1?

No. Level 1 does not permit a Plan of Action and Milestones for missing safeguards. The applicable Level 1
requirements must be met for Final Level 1 status.

Do we need CMMC Level 1 if we only handle FCI?

If your applicable contract or flow-down requires CMMC Level 1 and your systems handle FCI, you need to meet
the Level 1 status requirement. Review the specific solicitation or contract language to confirm applicability.

Does CMMC Level 1 require NIST SP 800-171?

Level 1 itself is based on the 15 safeguards in FAR 52.204-21. NIST SP 800-171 Rev. 2 is the Level 2 baseline
used for protecting CUI.

Does CMMC Level 1 require MFA?

Level 1 requires organizations to authenticate users, processes, or devices before granting access. The exact
technical implementation should be selected based on your environment, other applicable contract requirements,
and good security practice. Do not assume one product setting alone proves the full requirement.

What happens if we handle CUI?

If your environment processes, stores, or transmits CUI, Level 1 is not the appropriate endpoint. Review CMMC
Level 2 and NIST SP 800-171 requirements for the CUI environment

Can MAD Security perform our Level 1 self-assessment for us?

MAD Security can support readiness, gap validation, scoping, evidence development, and technical remediation.
The organization remains responsible for its official self-assessment and affirmation in SPRS.

CMMC Level 1: 15 Requirements for Protecting Federal Contract Information (FCI)

What Is CMMC Level 1?

CMMC Level 1 Is Active in Phase I