# CMMC Level 1: What a Small Machine Shop Has to Prove to Keep DoD Work

URL: https://limehawk.io/reports/cmmc-level-1
Published: 2026-10-02
Author: Corey Watson, Managing Member
Topic: Guides
Read time: 7 min

CMMC Level 1 is an annual self-assessment against the 15 FAR 52.204-21 safeguards for FCI, affirmed in SPRS by a senior official. No third-party audit.

> **TL;DR** CMMC Level 1 applies when your shop handles Federal Contract Information (FCI) on a DoD contract or subcontract but no CUI. It's the 15 basic safeguarding requirements in FAR 52.204-21: access control, user authentication, media disposal, physical access, boundary protection, patching, and malware protection. You assess yourself once a year, enter the result in SPRS, and a senior person at your company affirms it. Every requirement has to be met. There's no plan-of-action grace period at Level 1. CMMC requirements started showing up in contracts on November 10, 2025. In July 2026 the DoD suspended the move to Phase 2, so the program is paused in Phase 1, and Level 1 self-assessments still apply.

- Level 1 security requirements: 15

## What is CMMC Level 1?

CMMC Level 1 is the entry tier of the DoD's Cybersecurity Maturity Model Certification program. It applies to contractors and subcontractors that process, store, or transmit Federal Contract Information (FCI) but not Controlled Unclassified Information (CUI). The rule at [32 CFR 170.14](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170) says the Level 1 requirements "are those set forth in 48 CFR 52.204-21(b)(1)(i) through (xv)."

That FAR clause isn't new. What CMMC adds is the proof. You now have to assess yourself against it, post the result, and have someone with authority sign off every year.

The [FAR definition of FCI](https://www.acquisition.gov/far/4.1901) is information "not intended for public release, that is provided by or generated for the Government under a contract." It excludes information the government has already made public and "simple transactional information, such as that necessary to process payments." For a machine shop, think purchase orders, part drawings and specs that come down from a prime, delivery schedules, and the email threads about them.

## Does CMMC Level 1 apply to my shop?

If you supply a DoD prime and the subcontract involves FCI but not CUI, yes. Under [32 CFR 170.23](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170), primes have to flow CMMC requirements down "throughout the supply chain at all tiers." A subcontractor that only handles FCI needs a CMMC Status of Level 1 (Self).

Your prime decides which level goes in your subcontract, based on the information you'll touch. If the drawings coming to you are marked CUI, you're in Level 2 territory, and that's a bigger project. We cover it in our [CMMC Level 2 requirements guide](/reports/cmmc-level-2-requirements). This guide stays on Level 1.

The rule also excludes contracts solely for commercially available off-the-shelf (COTS) items, and those at or under the micro-purchase threshold.

## What are the 15 Level 1 requirements?

Level 1 is the 15 basic safeguarding requirements in [FAR 52.204-21](https://www.acquisition.gov/far/52.204-21), paragraph (b)(1). The DoD CIO's [About CMMC page](https://dodcio.defense.gov/cmmc/About/) describes Level 1 as an "annual self-assessment and annual affirmation of compliance with the 15 security requirements in FAR clause 52.204-21." In plain terms, here's the list:

1. Limit system access to authorized users, processes, and devices.
2. Limit users to the transactions and functions they're permitted to run.
3. Verify and control connections to external systems.
4. Control what gets posted on publicly accessible systems.
5. Identify users, processes, and devices.
6. Authenticate them before granting access.
7. Sanitize or destroy media holding FCI before disposal or reuse.
8. Limit physical access to systems and equipment to authorized people.
9. Escort visitors, monitor them, keep physical access logs, and manage keys and badges.
10. Monitor, control, and protect communications at external and key internal boundaries.
11. Put publicly accessible systems on subnetworks separated from internal networks.
12. Identify, report, and correct system flaws in a timely manner.
13. Provide malware protection at appropriate locations.
14. Update malware protection when new releases are available.
15. Run periodic system scans and real-time scans of files from outside sources.

Nothing on that list is exotic. It's accounts, passwords, a locked door, a firewall, patching, and antivirus. Level 1 is hard because you have to do every item and be able to show it.

## How does the self-assessment and SPRS affirmation work?

You assess yourself once a year, enter the result in the Supplier Performance Risk System (SPRS), and a senior official affirms it. Under [32 CFR 170.15](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170), the shop "must complete and achieve a MET result for all security requirements," and "no POA&Ms are permitted for CMMC Level 1." You can't log a gap and promise to fix it later.

The assessment uses the objectives in NIST SP 800-171A for the matching requirements, with FCI substituted for CUI. The SPRS entry includes the CMMC level, status date, assessment scope, the CAGE codes covered, and the result.

Then comes the affirmation in [32 CFR 170.22](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170). An "Affirming Official," a senior person with authority over compliance, attests in SPRS that the company "has implemented and will maintain implementation" of the requirements. That happens after each assessment and every year after. Both the self-assessment and the affirmation have to be in SPRS before you're awarded a contract that requires Level 1. You also keep the evidence for six years from the status date.

That's the owner's or a senior manager's signature on a federal attestation. It should rest on evidence, not a hunch.

## When does CMMC Level 1 start, and where is the rollout now?

It already started. The [DFARS acquisition rule](https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of) took effect November 10, 2025, which began Phase 1. In Phase 1, the [CMMC program rule](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170) has the DoD putting Level 1 (Self) or Level 2 (Self) into applicable solicitations as a condition of award.

The rule planned three more phases, one year apart. Phase 2 was due November 10, 2026. On July 13, 2026, the department [suspended the Phase 2 transition](https://dodcio.defense.gov/Portals/0/Documents/Library/ImplementingSuspensionCMMC-PhaseII.pdf) pending a 60-day CIO review. During the suspension, programs may only require Level 1 (Self) or Level 2 (Self). On September 3, 2026, DoD made that binding in contracts with [Class Deviation 2026-O0025 Revision 3](https://www.acq.osd.mil/dpap/dars/classdev/DFARS_RFO/Part-240/2026-O0025_Rev3_TAB_A_Deviation_Memo.pdf). The DoD CIO's page, as of late September 2026, says "All Phase I self-assessment requirements remain firmly in place" and that the program "is paused in Phase 1."

For a Level 1 shop, the pause changes nothing. Third-party Level 2 audits are what got pushed back. Self-assessments did not.

## What does IT have to prove for Level 1?

IT has to show that each of the 15 requirements is in place across every system that touches FCI. Start with scope. [32 CFR 170.19](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170) puts systems that "process, store, or transmit FCI" in scope. You can't scope what you haven't inventoried.

Here's the evidence we'd want in hand before anyone signs in SPRS:

- **An asset list** of every computer, server, and cloud service that holds FCI. We've built this from live data before. See our [312-asset hardware inventory](/reports/automated-hardware-inventory).
- **A user list** with one account per person, no shared logins, and departed employees removed.
- **Access rights** showing people only have what their job needs.
- **Firewall configuration** showing what's allowed in and out, and nothing exposed that shouldn't be. Remote Desktop open to the internet is exactly what requirement 10 is there to catch. We found exactly that during [onboarding discovery for a new client](/reports/open-rdp-onboarding-discovery).
- **Patch reports** showing updates applied on a schedule.
- **Antivirus status** on every in-scope machine: installed, updating, and scanning.
- **Media disposal records** for old drives and laptops.
- **Physical access controls**: locked server closet, visitor log, a list of who holds keys or badges.

One thing helps manufacturers. Under 32 CFR 170.19, OT, industrial IoT, and test equipment that "are unable to be fully secured" are Specialized Assets. They "are not part of the Level 1 CMMC Assessment Scope." That old CNC controller doesn't get graded at Level 1. The front-office PC where the drawings land does. It still makes sense to segment the plant floor from the office, which we cover on our [manufacturing IT page](/industries/manufacturing).

## Key takeaways

- Level 1 covers FCI only: contract information not meant for the public. If you handle CUI, you need Level 2.
- It's the 15 safeguards in FAR 52.204-21, self-assessed every year, with results and an affirmation entered in SPRS before award.
- Every requirement must be MET. No POA&Ms are allowed at Level 1, and you keep the evidence for six years.
- OT and shop-floor equipment that can't be fully secured are Specialized Assets and sit outside the Level 1 scope. Your office computers do not.
- Phase 2 was suspended in July 2026. Phase 1 self-assessment requirements remain in place, so Level 1 is still live.

## What this looks like when we do it

We're not a C3PAO or a Registered Practitioner Organization, and we don't perform CMMC assessments. Level 1 doesn't need one. It's your self-assessment and your affirmation. Our job is making sure the IT side holds up when your Affirming Official signs.

For a shop supplying DoD primes, that starts with an inventory and a scope: which machines and accounts touch FCI. Then we close the gaps that show up in almost every small office: shared logins, former employees still active, a firewall nobody has looked at in years, patching that stopped. We run patching, endpoint protection, and inventory through our RMM, so the reports you'd hand over come from the same tools doing the work. On the plant floor, we isolate legacy Windows and controllers instead of forcing replacements. More on that on our [manufacturing IT support page](/industries/manufacturing).

Have a prime asking for your SPRS entry and not sure your office would pass all 15? [Get in touch](/contact) and we'll walk through it with you.