Seventeen Level 1 assessment objectives do not mean 17 additional practices. Confusing them can send a DIB contractor down the wrong compliance path. Before buying tools, determine whether your contract handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Also determine whether the required CMMC level permits self-assessment.
A CMMC self-assessment is not one universal checklist. Level 1 requires an annual self-assessment of 15 practices. It also requires an annual affirmation in SPRS. Many Level 2 contracts require an independent C3PAO assessment every three years.
Determine your CMMC self-assessment route
Determine the required assessment route before collecting a single screenshot.
Separate 15 practices from 17 objectives
Count 15 Level 1 practices, not 17. The 15 practices come from FAR 52.204-21. This federal rule covers basic protection of Federal Contract Information, or FCI. The often-cited 17 refers to assessment objectives. These are individual checks used to test certain practices.
Read clauses before picking a checklist
Read the solicitation, prime contract, subcontract, and flow-down language side by side.
- If the work handles only FCI, start with CMMC Level 1. FCI is contract-related data not intended for public release.
- If the work handles CUI, assess Level 2 requirements and NIST SP 800-171. CUI is sensitive government data that needs safeguards but is not classified.
- If the contract names a Level 2 self-assessment path, plan an annual assessment and annual SPRS affirmation.
- If the contract names a Level 2 C3PAO assessment path, plan independent certification every three years. Also plan annual affirmations.
The contract decides the route, not a generic checklist.
Assign the affirming official now
Name the affirming official before work begins. This senior official attests in the Supplier Performance Risk System, or SPRS. They confirm that results are accurate to the best of their knowledge.
For Level 1, plan between 20 and 60 internal staff hours when asset records and account lists exist. If systems lack records, scope discovery often takes 1 to 3 weeks before testing starts.
Confirm the legal entity and applicable CAGE code before creating or affirming an SPRS record. A CAGE code identifies a contractor entity or location in DoD business records. It does not automatically define the technical assessment boundary.
One organization may hold several CAGE codes. It may still share an identity platform, email tenant, managed service provider, or CUI environment. These shared services may fall within more than one assessment scope.
A separate CAGE code does not create scope by itself. Instead, it is in scope only if it handles covered FCI or CUI. Reconcile the contract recipient, CAGE code, locations, and system boundary. Do this before the affirming official submits the SPRS affirmation.
⚠️ Do not treat a CAGE code as a technical boundary without tracing the systems and shared services behind it.
The route is now clear. Next, trace where the covered information actually goes.
Map FCI and CUI across your environment
Map the information flow and expose the real assessment boundary.
Classify the data before systems
Classify each data type as public, FCI, CUI, or unknown. FCI is contract-related information not intended for public release. CUI has government-set handling requirements. It commonly leads to Level 2 protection under NIST SP 800-171.
Draw the boundary people actually use
Create a one-page scope map with boxes and arrows. Include managed endpoints, mobile devices, email, cloud storage, and collaboration tools. Include identity providers, privileged accounts, VPN, remote access, APIs, and backups. Add security tools and managed service providers.
Trace one CUI item before setting scope
1. Receive
Contract portal or email
2. Work
Endpoint and SaaS app
3. Protect
Identity, logs, backup
4. Support
Admin access and vendors
Every box that touches, carries, or controls the item belongs in the initial review boundary.
Reduce scope with proven separation
Use segmentation only when you can prove it. Network segmentation separates systems. A user or device outside the boundary must not reach the in-scope environment without controlled access.
The most frequent error here is mapping file storage but omitting identities, backups, and administrator access. Those services can still control the covered data.
⚠️ Do not exclude a managed service provider just because it does not store the file itself.
A valid boundary follows the data and control paths. The next task proves that controls work inside it.
Test controls and build your evidence matrix
Test each practice and produce evidence that shows it operates.
Record proof that a reviewer can trace
Use this matrix in a spreadsheet or governance tool.
| Evidence field | What to enter | Pass standard |
|---|
| Practice and owner | Requirement ID and named accountable person | One owner accepts accuracy |
| Artifact and date | Configuration export, log, ticket, or review record | Current within the stated review cycle |
| Test method and result | Examine, interview, or test; met or gap | Another reviewer can repeat it |
| Corrective action | Risk, action, target date, closure proof | Gap has a funded accountable action |
Verify operation, not written intent
Test multi-factor authentication through identity-provider settings and recent sign-in logs. Also perform one controlled user login. Test least privilege by comparing role assignments with job needs. Sample access for terminated users.
Test endpoint coverage against the asset inventory. Then match that inventory with endpoint detection and response console records. A policy alone does not prove that a control operates.
Write gaps into an actionable POA&M
Document each real gap in a Plan of Action and Milestones, or POA&M. State the affected practice, risk, and interim safeguard. Name the accountable owner and target date. Include the funding need and exact closure proof.
For a Level 2 readiness review, allow roughly 120 to 500 internal hours. Include IT, security, contracts, and business owners. Independent C3PAO costs in the United States often range from $30,000 to $100,000 or more. Scope, locations, evidence maturity, and remediation work affect cost. These are planning ranges, not DoD-set prices.
For a CMMC Level 2 assessment, use NIST SP 800-171A as the testing framework. It supports the 110 practices derived from NIST SP 800-171. Its procedures use examine, interview, and test activities. Do not rely on a policy review alone.
For example, access control needs more than an approved policy. Interview the system owner. Then test that a standard user cannot reach an administrative function.
Evidence must show the control works today.
Mapping CMMC assessment objectives to dated evidence makes reviews repeatable. It also helps contractor teams separate working practices from stated intentions.
⚠️ Do not close a POA&M with a policy update when the gap requires a configuration change or test result.
The evidence package reveals the real gaps. The next phase decides what must be fixed before SPRS entry.
Approve the assessment result and remediation decisions before entering anything in SPRS.
Prioritize the gaps that expose CUI
Fix gaps affecting privileged access, remote access, and multi-factor authentication first. Also fix asset inventory, logging, backups, incident response, and unmanaged endpoints. These gaps can expose CUI directly.
Keep scores separate from certification
For a Level 1 self-assessment, retain the 15-practice evidence package. Complete the annual affirmation required by the applicable CMMC rule. For Level 2, confirm whether the contract permits annual self-assessment. It may instead require a C3PAO assessment every three years.
A score and a certification are not the same thing.
⚠️ Do not submit an SPRS score or affirmation before the affirming official validates entity, scope, answers, evidence dates, and remediation plans.
The final check is contractual. Use the questions below before committing budget or submitting an affirmation.
This process does not replace a C3PAO assessment when a contract requires Level 2 or Level 3 certification. It is not a CMMC obligation without DoD contracts or subcontracts carrying CMMC requirements. First review contract clauses and customer requirements.
FAQs
Use these answers to check the decision before committing budget or submitting an affirmation.
Can I self-assess CMMC Level 1?
Yes. CMMC Level 1 requires an annual self-assessment of 15 practices. It also requires an annual SPRS affirmation by a senior official. The organization must show that practices operate on every in-scope FCI system.
Are there 17 CMMC Level 1 practices?
No. CMMC Level 1 has 15 practices derived from FAR 52.204-21. The number 17 refers to assessment objectives. Objectives test practices. They are not extra security practices.
Can I self-certify CMMC Level 2?
Only some Level 2 contracts permit annual self-assessment. A prioritized Level 2 acquisition requires an independent C3PAO assessment every three years. Read the solicitation and contract clauses first.
How long does a CMMC self-assessment take?
A prepared Level 1 assessment often takes between 20 and 60 internal hours. Level 2 readiness often takes several months. CUI scope, testing, remediation, and management approval need more coordination.
What evidence proves a CMMC practice is met?
Evidence must show operation through settings, logs, interviews, observation, or test results. A policy alone does not prove controls work. This applies to multi-factor authentication, least privilege, backups, and access reviews.
Does an SPRS score mean CMMC certified?
No. An SPRS score records a NIST SP 800-171 assessment result. It does not establish CMMC certification by itself. CMMC status depends on the contract's required level and assessment route.
Are Microsoft 365 and email in CMMC scope?
They are in scope if they process, store, transmit, or administer FCI or CUI. Email links and retention copies can extend the boundary. Identity accounts, audit logs, and backups can also extend it.
What should a CMMC POA&M include?
A CMMC POA&M should name the gap, owner, risk, interim safeguard, target date, and closure evidence. A useful closure record proves the fix. Use a new configuration export, test result, or review log.
Take the next defensible action
Choose the contract-driven path, then make the scope map match real work.
The essential points:- Level 1 means 15 practices, not 17, with annual self-assessment and affirmation where required.
- Level 2 assessment type comes from the contract, not from a generic checklist.
- Scope includes every system and identity that touches or controls FCI or CUI.
- Policies need operating proof, accountable owners, and dated remediation records.
- SPRS entries belong after senior-official validation, never before it.
