CMMC Level 1 Self-Assessment: Steps and SPRS

A CMMC Level 1 self-assessment is the annual check, performed by the contractor itself, that the information systems handling federal contract information (FCI) meet the 15 basic safeguarding requirements in FAR 52.204-21. The organization records the result in the Supplier Performance Risk System (SPRS) and a senior official affirms it. No third-party assessor is involved, and no plan of action and milestones (POA&M) is allowed. This guide follows the text of 32 CFR Part 170 and FAR 52.204-21 as described on the eCFR on 2026-10-29, and it walks through the steps in the order the rule imposes them: scope, assess, report, affirm, repeat.

What it is and who runs it

Level 1 is the entry tier of the Department of Defense’s CMMC Program, which is set out in 32 CFR Part 170. Section 170.15 covers the Level 1 self-assessment and affirmation. The organization seeking assessment (OSA) runs it: under 170.15 the OSA must conduct the self-assessment under the procedures in 170.15(c)(1), and it must repeat it annually and submit the results in SPRS. There is no accreditation body or outside assessor at this level. For the Level 2 tracks, where a third party can be involved, see CMMC Level 2 assessment: self vs C3PAO.

Eligibility: when Level 1 applies

Level 1 is about FCI. FAR 52.204-21 defines FCI as information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service. It excludes information the Government has released to the public and simple transactional information, such as what is needed to process payments. If a contract involves FCI and not controlled unclassified information (CUI), Level 1 is the relevant tier; where CUI is involved the contract points to Level 2, covered in NIST SP 800-171 and CUI in University Research. The CMMC level that applies to a given award is set in the solicitation and contract, so the contract is the first thing to read.

Universities and research institutes should note how the rule frames scope. Section 170.19(b)(1) puts in scope for Level 1 the OSA information systems that process, store, or transmit FCI, and 170.19(b)(2) treats systems that do not as out of scope. The assessment scope is therefore drawn around the FCI systems for a contract, not around the whole campus by default. Institutional context is in CMMC compliance for research institutions and CMMC compliance for universities.

What Level 1 requires: the 15 basic safeguards

FAR 52.204-21(b)(1) lists the safeguards. In paraphrase, a contractor must:

limit information system access to authorized users, processes acting for them, and devices;
limit access to the types of transactions and functions that authorized users are permitted to execute;
verify and control connections to, and use of, external information systems;
control information posted or processed on publicly accessible systems;
identify information system users, processes, and devices;
authenticate those identities before granting access;
sanitize or destroy media containing FCI before disposal or reuse;
limit physical access to systems, equipment, and operating environments to authorized individuals;
escort visitors, monitor their activity, maintain audit logs of physical access, and control and manage physical access devices;
monitor, control, and protect communications at the external boundaries and key internal boundaries;
implement subnetworks for publicly accessible system components that are separated from internal networks;
identify, report, and correct information and system flaws in a timely manner;
provide protection from malicious code at appropriate locations;
update malicious code protection when new releases are available; and
perform periodic scans of the system and real-time scans of files from external sources as they are downloaded, opened, or executed.

Where a Level 1 objective is written for CUI, 170.15 says FCI should be substituted for CUI in that objective. The section gives the assessment method and objectives; the safeguard wording above is the contract clause itself.

Compliance steps

1. Scope the assessment

List the systems that process, store, or transmit FCI for the contract. Under 170.19(b)(2), systems that do not touch FCI are out of scope. The rule gives one concrete example: a virtual desktop infrastructure (VDI) endpoint that permits only keyboard, video, and mouse transfer is out of scope. It also states that Specialized Assets are not part of the Level 1 assessment scope. Record the scope, because it becomes the “CMMC Assessment Scope” you report.

2. Assess each safeguard

Work through the 15 safeguards above for the in-scope systems and record the result against each. Section 170.15 requires the assessment to follow its procedures; keep the working evidence, since the rule requires it to be retained (see below).

3. Enter the results in SPRS

Per 170.15, the SPRS entry includes the CMMC level, the CMMC status date, the assessment scope, the CAGE code or codes covering the in-scope systems, and the compliance result. SPRS entries for the NIST SP 800-171 score are a separate matter, covered in SPRS score: calculating and submitting your NIST 800-171 assessment.

4. Affirm

Affirmation of the Level 1 status is required for all Level 1 self-assessments. Under 170.22, the affirming official is the senior-level representative of the organization seeking assessment, with the authority to confirm ongoing compliance. The affirmation is entered electronically in SPRS and includes the official’s name, title, and contact information. It attests that the organization has implemented, and will maintain implementation of, all applicable CMMC security requirements for the in-scope systems. Before an award, the OSA must have submitted an affirmation of compliance in SPRS for all information systems within the assessment scope.

5. Repeat annually and keep the evidence

Section 170.15 requires a Level 1 self-assessment every year, with results again submitted in SPRS; 170.22 requires the affirmation after every assessment and annually thereafter. The supporting evidence is to be kept for six years from the CMMC status date.

Typical timeline phases

The rule fixes a cadence but no calendar of its own, so phases here are sequential rather than dated:

Before bid or award: read the solicitation for the required CMMC level and confirm FCI is involved; complete the self-assessment and affirmation so the SPRS entries exist before award.
During performance: maintain the safeguards, because the affirmation attests that the organization will keep them in place.
Each year: repeat the self-assessment, update SPRS, and reaffirm.
After the status date: retain the evidence for six years.

Common mistakes

Scoping too wide or too narrow. The rule scopes Level 1 around systems that process, store, or transmit FCI. Pulling in unrelated systems adds work; omitting an FCI system leaves the scope and the affirmation incomplete.
Treating public or transactional information as FCI. FAR 52.204-21 excludes publicly released information and simple transactional information.
Planning a POA&M. Section 170.15 states that no POA&Ms are permitted at Level 1. Every safeguard must be met when the assessment is submitted.
Submitting without the affirmation. Affirmation is required for all Level 1 self-assessments, and it recurs each year.
Forgetting subcontractors. FAR 52.204-21(c) requires the substance of the clause to be included in subcontracts where the subcontractor may have FCI, except for subcontracts for commercial off-the-shelf items.
Discarding evidence. The retention period is six years from the status date.

Related programs

Item	Who performs it	Source
CMMC Level 1 self-assessment	The organization itself; results in SPRS, annual affirmation, no POA&M	32 CFR 170.15, 170.22
FAR 52.204-21 basic safeguarding	The contractor, as a contract clause with 15 safeguards and a subcontract flowdown	FAR 52.204-21
CMMC Level 2 self-assessment	The organization itself, against NIST SP 800-171	32 CFR 170.16; see Level 2 assessment guide
CMMC Level 2 certification assessment	An authorized or accredited C3PAO	32 CFR 170.17; see Level 2 assessment guide

FAQ

Who performs a CMMC Level 1 assessment?

The contractor does. Section 170.15 requires the organization seeking assessment to conduct the self-assessment itself and submit the results in SPRS.

How often must it be done?

Annually. The affirmation is also required after every assessment and annually thereafter.

Can we use a POA&M at Level 1?

No. Section 170.15 states that no POA&Ms are permitted for CMMC Level 1.

What do we enter in SPRS?

The CMMC level, status date, assessment scope, CAGE code or codes, and the compliance result, plus the affirmation.

Who signs the affirmation?

The affirming official: the senior-level representative of the organization seeking assessment, with authority to confirm ongoing compliance (170.22).

How long must we keep the evidence?

Six years from the CMMC status date, per 170.15.

Sources

32 CFR 170.15, CMMC Level 1 self-assessment and affirmation requirements: ecfr.gov, checked 2026-10-29.
32 CFR 170.22, Affirmation: ecfr.gov, checked 2026-10-29.
32 CFR 170.19, CMMC scoping: ecfr.gov, checked 2026-10-29.
FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems: ecfr.gov, checked 2026-10-29.

CMMC Level 1 Self-Assessment: Steps, SPRS Entry and Annual Affirmation