Key takeaways
- Level 1 is a self-assessment route, not a third-party certification service.
- Identify FCI and your covered systems before checking safeguards.
- Fix gaps and keep accurate assessment and affirmation records.
CMMC Level 1 focuses on basic safeguarding of Federal Contract Information. Organizations with an applicable Level 1 requirement assess their own implementation and affirm their status; buying a course or hiring a consultant does not issue Level 1 certification.
This five-step checklist helps a beginner organize the work. The URL retains the original article’s “certification” wording to preserve existing links, while the article now uses the more precise self-assessment terminology.
1. Identify FCI and confirm your obligation
FCI is nonpublic information provided by or generated for the government under a contract, with exclusions such as public information and simple payment transactions. Review the FAR safeguarding clause and your contract to understand what information and systems are covered.
Do not assume FCI and CUI are interchangeable. If you handle CUI, confirm the additional requirements and assessment route that apply to your work.
2. Define the systems and people in scope
Map where FCI is stored, processed, or transmitted, including email, file shares, endpoints, and relevant service providers. Identify users and administrators with access.
A written scope gives you a consistent basis for checking controls. “We are a small company” is not a reason to omit a covered system.
3. Implement and check the basic safeguards
Level 1 aligns with the basic safeguards in FAR 52.204-21. Review the actual requirements and the applicable assessment guidance rather than relying on an abbreviated checklist alone.
Examples include limiting access to authorized users, identifying and authenticating users, protecting physical access, sanitizing media, and protecting systems from malicious code. These examples do not replace the full requirement set.
For each requirement, determine what is implemented and what evidence demonstrates it. Fix identified gaps before representing the requirement as met. Formal Level 1 assessment gaps cannot simply be deferred through a POA&M.
4. Complete an accurate self-assessment
Use the official assessment method and document the result for the defined scope. Assign someone who understands the environment to coordinate the records and confirm that conclusions match implementation.
Do not mark a requirement met because a policy exists or a vendor says a feature is available. Check that it is configured and used appropriately in your system.
5. Maintain the annual assessment and affirmation
Follow the applicable submission and affirmation process, retain supporting records, and schedule the required annual activity. Review changes between assessments so the information remains accurate.
Changes to users, systems, providers, or data handling can affect your scope and controls. Your next assessment should describe the current environment, not last year’s configuration.
Common beginner mistakes
- Treating Level 1 as a purchased third-party certificate.
- Confusing public information, FCI, and CUI.
- Checking a box without verifying implementation.
- Assuming an MSP takes over every obligation.
- Forgetting the ongoing assessment and affirmation schedule.
Sources and further reading
- FAR 52.204-21: basic safeguarding.
- 32 CFR Part 170 program requirements, including Level 1 assessment and affirmation provisions.
- Official CMMC guidance and our current program update.
