Understanding CMMC Level 1 Requirements

CMMC Level 1 is the foundational level of the Cybersecurity Maturity Model Certification program. It applies to organizations that handle Federal Contract Information (FCI) and requires implementation of 15 basic safeguarding practices aligned with FAR 52.204-21. These practices address areas such as access control, password protection, device security, physical protection, and incident reporting. Level 1 is assessed through an annual self-assessment and affirmation rather than a C3PAO assessment.

For CMMC Level 1, organizations generally complete an annual self-assessment rather than obtain a third-party C3PAO certification. Start by identifying where FCI is received, stored, or transmitted; implement the 15 required safeguarding practices; document how practices operate; collect supporting evidence; and ensure the appropriate company official submits the required affirmation in SPRS. Review applicable contract clauses and DoD guidance to confirm your obligations.

There is no single CMMC Level 1 price because Level 1 relies on self-assessment rather than a required third-party assessment. Costs can include staff time, policy development, security tools, training, documentation management, and remediation of gaps. QMS Learning offers early-access pricing for its CMMC pilot cohort, with pricing provided after a demo. A free two-seat pilot may be available for qualified teams using the document management platform.

The 15 Level 1 practices are basic safeguards derived from FAR 52.204-21. They cover limiting system access, controlling external connections, identifying users and devices, sanitizing or destroying media, escorting visitors, maintaining physical access controls, monitoring and protecting systems, updating malicious-code protection, and reporting cyber incidents. Organizations should map each practice to a responsible owner, operating procedure, and retained evidence before completing their self-assessment.

Usually, no. CMMC Level 1 is intended for contractors handling Federal Contract Information but not Controlled Unclassified Information (CUI). Organizations that process, store, or transmit CUI may be subject to CMMC Level 2 requirements, which align with the 110 requirements in NIST SP 800-171 and involve a more extensive assessment approach. Review contract language, data flows, and DFARS obligations carefully to determine the right level.

Retain evidence that shows each safeguarding practice is implemented and operating. Useful records can include access-control procedures, user account lists, training acknowledgements, endpoint protection settings, facility visitor procedures, incident-reporting instructions, media-handling records, and screenshots or system reports where appropriate. Keep version-controlled policies and dated records so your team can substantiate its annual self-assessment and quickly locate evidence if contract requirements change.

Preparation time depends on the condition of your current security practices, the number of systems that handle FCI, and the availability of existing documentation. Organizations with established access controls, endpoint protection, and written procedures can focus on evidence collection and gap closure. Teams starting from scratch should allow time to identify FCI flows, assign ownership, implement safeguards, train users, test procedures, and organize supporting records before affirming compliance.

Yes. QMS Learning offers CMMC training focused on cybersecurity requirements, compliance obligations, and audit readiness, plus a NIST SP 800-171 course for organizations handling CUI. Its CMMC & Defense Cybersecurity Training Pathway also includes ISO 27001, SOC 2, and data privacy content. The AI Workbench is trained on CMMC assessment guides, NIST SP 800-171, and DFARS clause flow-down requirements to support practical readiness work.