CMMC Level 1 addresses protection of Federal Contract Information in covered defense contract work. It uses the 15 basic safeguards in FAR 52.204-21, an annual self-assessment and an authorized senior official’s affirmation in SPRS. Contract requirements and assessment scope determine applicability. Castle supports readiness; it is not a C3PAO or certified assessor.
What CMMC is and why Level 1 matters
The Cybersecurity Maturity Model Certification program sets requirements for safeguarding information in the defense supply chain. For a small contractor, Level 1 is about demonstrating that basic protections are operating where Federal Contract Information, or FCI, is handled. It is not a general-purpose badge for every business or a substitute for reading a solicitation.
The governing framework is 32 CFR Part 170. Its Level 1 requirements reference the 15 safeguards in FAR 52.204-21. Use the actual rule and the DoD CIO CMMC resources alongside your contract requirements, rather than relying on a generic checklist alone.
Who needs Level 1: FCI, CUI and subcontractors
FCI is information provided by or generated for the government under a contract that is not intended for public release, subject to the regulatory definition and exclusions. Publicly available information is not automatically FCI. Identify where covered information is processed, stored or transmitted before deciding which people, systems and services belong in scope.
Controlled Unclassified Information, or CUI, is a different category. Level 1 alone does not satisfy the higher requirements that may apply when a contractor handles CUI. Do not assume a company’s size determines the required level.
Subcontractors can also have safeguarding and CMMC obligations when covered information flows down to them. Review the prime contract, subcontract language and required CMMC status with the responsible contracting parties. Questions about applicability should be resolved before treating readiness work as complete.
The 15 safeguards, grouped by practice family
32 CFR 170.14(c)(2) points to FAR 52.204-21(b)(1)(i) through (xv). The following is a plain-language orientation, not a replacement for the assessment objectives.
Access Control: four safeguards
- Limit system access to authorized users, processes acting for them and devices.
- Limit authorized users to the transactions and functions they are permitted to perform.
- Verify and control connections to, and use of, external systems.
- Control information posted or processed on publicly accessible systems.
Identification and Authentication: two safeguards
- Identify system users, processes acting for users and devices.
- Authenticate or verify those identities before granting access.
Media Protection: one safeguard
Sanitize or destroy system media containing FCI before disposal or release for reuse.
Physical Protection: two FAR safeguards
- Limit physical access to systems, equipment and operating environments to authorized individuals.
- Escort visitors and monitor their activity, maintain physical-access audit logs, and control and manage physical-access devices.
The second FAR safeguard groups several assessment expectations together. Count the FAR safeguards consistently rather than assuming every phrase is a separate new safeguard. This practice family describes the contractor’s obligations; it is not an offer of physical-security installation services from Castle.
System and Communications Protection: two safeguards
- Monitor, control and protect communications at external boundaries and key internal boundaries.
- Separate publicly accessible system components from internal networks, physically or logically.
System and Information Integrity: four safeguards
- Identify, report and correct system flaws in a timely manner.
- Protect appropriate system locations against malicious code.
- Update malicious-code protection when new releases are available.
- Perform periodic system scans and real-time scans of files from external sources as they are downloaded, opened or executed.
How the annual self-assessment works
Start by defining the assessment scope and identifying the assets that handle FCI. For each requirement, determine whether the relevant objectives are met and retain evidence that supports the result. Evidence may include configuration records, procedures, interviews and demonstrations; a purchased tool alone does not establish that a requirement is met.
Under 32 CFR 170.15, all Level 1 requirements must receive a MET result. Plans of action and milestones do not provide a conditional Level 1 status. Submit the required self-assessment results in the Supplier Performance Risk System (SPRS) and complete the required affirmation by the responsible affirming official.
Repeat the self-assessment and affirmation annually to maintain status. Section 170.15 also requires retention of assessment evidence for six years from the CMMC Status Date. Level 1 is a self-assessment route; it does not require a third-party certification assessment.
Contract rollout: check current official requirements
CMMC contract implementation is phased. As checked on October 20, 2026, the DoD CIO resources page reports that Phase II requirements scheduled for November 10, 2026 were suspended on July 13, 2026, while Phase I self-assessment requirements remain in place. Do not use the earlier Phase II date as an assured future deadline.
Check the current official announcement and rule links, then confirm what the relevant solicitation or contract requires. This guide does not determine your contract’s obligations or promise eligibility.
Common hurdles for a small team
Gaps often become visible when the team maps the scope: untracked devices, shared accounts, unclear responsibilities or safeguards that exist but lack supporting evidence. Start with the actual environment, assign remediation owners and verify the work rather than checking boxes from memory.
Keep the scope and evidence current as systems change. Our CMMC Level 1 mistakes guide explores preparation problems in more detail.
How Castle supports Level 1 readiness
Castle Technology Partners helps with gap reviews, remediation planning and implementation, documentation and policy templates, and preparation for the organization’s self-assessment. Castle is not a C3PAO or certified assessor, does not conduct third-party certification assessments and cannot guarantee a compliance or contract outcome.
Founded in 2019 and based in Daphne, AL, Castle supports businesses that need a practical plan for the work their own organization must verify and affirm. Explore CMMC Level 1 readiness and self-assessment support for the service scope.
Related reading and your next step
Read about the business reasons for CMMC readiness, common preparation mistakes and cybersecurity risk assessments. Then discuss the scope, gaps and evidence your team needs to address before affirming its status.
Frequently asked questions
Who needs CMMC Level 1?
It can apply to contractors and subcontractors that process, store or transmit FCI for covered defense work. Confirm the required level and scope in the applicable solicitation, contract or subcontract.
Is CMMC Level 1 a self-assessment?
Yes. Level 1 uses an annual self-assessment and the required affirmation in SPRS. It does not require a third-party certification assessment.
How many practices are in CMMC Level 1?
The rule references the 15 basic safeguarding requirements in FAR 52.204-21(b)(1)(i) through (xv). Use the official assessment objectives to evaluate each requirement.
How long does Level 1 readiness take?
The work depends on the systems in scope, existing safeguards and available evidence. A gap review helps identify the remediation and documentation needed; there is no universal completion time.
Is Castle a CMMC assessor?
No. Castle provides Level 1 readiness, remediation, documentation and self-assessment preparation support. Castle is not a C3PAO or certified assessor.
What happens if we do not comply?
A contractor may be ineligible for an award that requires Level 1 status if it has not achieved the required status and submitted its affirmation. Confirm the requirements for the particular contract.