What CMMC Level 1 Actually Requires
CMMC Level 1 applies if your contract involves Federal Contract Information (FCI) but no Controlled Unclassified Information (CUI). It maps directly to the 17 safeguarding requirements in FAR 52.204-21, not the fuller 110-control NIST SP 800-171 set that Level 2 requires. If you are a small manufacturing or services sub working under a prime with no CUI flowing down to you, Level 1 is very likely your bar.
Level 1 is a self-assessment. There is no third-party assessor, no C3PAO, and no SPRS score to calculate. You evaluate your own environment against the 17 practices, keep a record of that evaluation, and have a senior company official affirm it annually in the Supplier Performance Risk System (SPRS).
What Belongs in a Level 1 Self-Assessment Template
A usable template is not a generic checklist. It needs to hold up if a prime or contracting officer asks to see it. At minimum, it should include:
- All 17 practices, organized by the six FAR 52.204-21 families: Access Control, Identification and Authentication, Media Protection, Physical Protection, System and Communications Protection, and System and Information Integrity.
- An implementation status per practice: met, partially met, or not met, with a short note on how it is met (a policy, a configuration, a physical control).
- An evidence pointer: where the proof lives, whether that is a screenshot, a policy document, or a configuration export.
- A named senior official and a signature and date field for the annual affirmation, since SPRS requires an individual to attest to the assessment.
- A review date so the assessment does not quietly go stale past its one-year window.
Common Mistakes Small Subs Make
- Treating Level 1 as a one-time exercise instead of an annual requirement.
- Marking a practice "met" with no evidence behind it, which falls apart the moment a prime asks for documentation.
- Confusing FCI-only scope with CUI scope and building a Level 1 template when the contract actually requires Level 2.
- Losing track of the affirmation itself. The self-assessment only counts once it is posted in SPRS by an authorized official.
Where Threshold Fits
Threshold ships the full Level 1 self-assessment structure already built out: all 17 practices, evidence storage tied to each one, and the affirmation record your senior official needs to sign. The Free tier covers a complete Level 1 scorecard with no cost and no sales call required.