CMMC Level 1 Requirements

CMMC Level 1 establishes the foundational cybersecurity requirements organizations must implement to protect Federal Contract Information (FCI).

Contractors and subcontractors that process, store, or transmit Federal Contract Information (FCI) typically need CMMC Level 1 when a Department of War (DoW) contract requires it. FCI is information not intended for public release that’s provided by or generated for the government under a contract. If you also handle Controlled Unclassified Information (CUI), Level 2 likely applies instead.

Yes. CMMC Level 1 is a self-assessment. Organizations evaluate their own implementation of the 15 security requirements in Federal Acquisition Regulation (FAR) 52.204-21, enter their results in the Supplier Performance Risk System (SPRS), and have a senior official affirm compliance. This happens every year, and no third-party assessment is required.

Unlike Level 2, Level 1 doesn’t allow a Plan of Action and Milestones (POA&M), so all 15 requirements need to be met. Because a senior official is affirming the results, it’s worth confirming that your answers reflect how your environment actually works. That’s where an experienced advisor can help.

 There are 15 CMMC Level 1 requirements. They come from Federal Acquisition Regulation (FAR) 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, and focus on protecting Federal Contract Information (FCI). They cover foundational practices such as limiting system access to authorized users, authenticating users, sanitizing media before disposal, controlling physical access, and protecting systems from malicious code. 

You may see 17 in older materials. That number comes from CMMC 1.0, which counted Level 1 practices differently. Under the current CMMC program, the requirement is 15. Though the list is short, each requirement needs to be fully met, so it’s worth making sure your practices match what each one asks for. 

Federal Contract Information (FCI) is information that isn’t intended for public release and is provided by or generated for the government under a contract to develop or deliver a product or service. It can include items such as statements of work, delivery schedules, and project communications exchanged under a contract.

FCI doesn’t include information the government makes public, or simple transactional information such as what’s needed to process payments. Knowing where FCI lives in your environment is the first step in understanding which CMMC requirements apply to you.

Yes, if they process, store, or transmit Federal Contract Information (FCI) under a Department of War (DoW) contract. Prime contractors are required to flow CMMC requirements down to their subcontractors, so the level you need depends on the information shared with you, not the level your prime holds.

If you receive Controlled Unclassified Information (CUI), Level 2 likely applies instead. If you receive neither FCI nor CUI, CMMC may not apply to your subcontract. Contracts solely for commercially available off-the-shelf (COTS) items are exempt. If you’re not sure where you fit, confirm the required level with your prime, and one of our advisors can help you understand what it means for your organization.