You may see CMMC as a 15-control checklist. The real failure often starts before you assess a single safeguard.
FCI may already move through Microsoft 365, SaaS tools, employee devices, shared inboxes, and subcontractor workflows. These places may never have been scoped.
Miss one location, and a solid self-assessment can rely on incomplete proof. It can also leave unclear ownership and unsupported compliance claims.
CMMC Level 1 compliance means protecting Federal Contract Information (FCI) with 15 safeguards from FAR 52.204-21. It is not a one-time badge. Eligible contractors complete an annual self-assessment and submit an affirmation when the contract requires it.
CMMC level 1: decide if your contract requires it
CMMC Level 1 applies when a DoD contract or subcontract requires it. Your company must also handle FCI.
FCI is information created by or for the government under a contract. It is not meant for public release.
Does your work contain FCI or CUI?
FCI is nonpublic information tied to a contract. Controlled Unclassified Information (CUI) is a separate information type.
CUI has handling or sharing rules set by law, regulation, or government-wide policy. FCI and CUI are not the same thing.
This difference can change your required CMMC level.
Can a prime contractor flow it down?
A prime contractor can pass security duties to a subcontractor that supports DoD work. This can affect firms that never bill the DoD directly.
Examples include machine shops, staffing firms, logistics providers, and managed IT providers. The prime may require proof before sharing contract work.
Read the subcontract and flowdown terms closely.
Is level 1 self-assessed or audited?
CMMC Level 1 usually requires an annual self-assessment. A senior company official also makes an annual affirmation when the contract requires it.
Level 1 does not usually need the third-party certification audit tied to some Level 2 contracts. The contract clause decides what you must do.
Decision rule: Read the clause first. Classify the information second. Then map the systems. A firm with FCI and a Level 1 clause needs all 15 safeguards. A firm handling CUI must stop and assess Level 2 duties.
Scope FCI before the 15 safeguards
A defensible Level 1 self-assessment starts with an FCI map. Map every account, device, service, and third party that can access FCI.
Think of this map like tracing every spare key to a building. You cannot secure access if you do not know who holds a key.
Where can FCI hide outside file shares?
Start with real contract records. Follow each copy, alert, attachment, and system notice.
Review inbound and outbound mailboxes, shared mailboxes, and chat channels. Review cloud folders, print queues, backups, ticketing tools, and SaaS links.
The most common mistake here is treating the file share as the whole scope. Email alerts and connected apps often expose the same contract details.
Are personal devices in scope for FCI?
A personal laptop or phone is in scope if it can open FCI. The same applies if it can sync, download, photograph, or forward FCI.
BYOD does not become acceptable because employees prefer it. Company ownership does not decide scope.
Access decides scope.
Which SaaS vendors need review first?
Review identity, email, storage, collaboration, CRM, and help desk tools first. Also review e-signature, backup, and remote-support tools.
These services may hold FCI. They may also hold access tokens that can retrieve FCI.
| Location | Ask this question | In scope when | Evidence to retain |
|---|
| Email and chat | Can users send contract files or details? | FCI is sent, received, or searchable | Tenant settings and access logs |
| SaaS applications | Can the app store FCI or read it through an integration? | Data or API access exists | Vendor list and permissions review |
| Personal devices | Can the device open FCI? | Browser, mail, or sync access is allowed | Device policy or access block proof |
| Outside providers | Can the provider view or administer FCI systems? | Support or processing access exists | Agreement and access register |
Build evidence for all 15 safeguards
Each Level 1 requirement needs four items. You need a working setting, proof, a named owner, and a review date.
A written policy alone does not prove a safeguard works. Screenshots, system reports, tickets, and logs show that it works.
FCI evidence cycle
1. Find
Map FCI and access paths
2. Configure
Set access and device controls
3. Prove
Save reports and tickets
4. Review
Check owners annually
What evidence supports each requirement?
The following matrix is a usable self-assessment template. Mark each row Met, Not Met, or Not Applicable.
Record why you chose each status. “Not Applicable” needs a factual reason, not a preference.
| Safeguard | Working example | Evidence / owner / review |
|---|
| Limit authorized access | Named accounts only | User list; IT lead; quarterly |
| Limit permitted functions | Role-based folders and admin roles | Role export; IT lead; quarterly |
| Control external connections | Approved VPN and SaaS only | Access settings; IT lead; quarterly |
| Control public posting | Approval before web release | Approval tickets; contracts lead; each release |
| Identify users and devices | Asset and account inventory | Inventory export; IT lead; monthly |
| Authenticate identities | MFA for FCI access | MFA report; IT lead; monthly |
| Sanitize media | Approved wipe or destruction | Disposal log; operations; per event |
| Limit physical access | Locked office and cabinets | Access list; facilities; quarterly |
| Escort visitors | Visitor badge and escort rule | Visitor log; facilities; monthly |
| Keep physical access logs | Sign-in record or badge log | Log sample; facilities; monthly |
| Control remote access | MFA and approved remote path | VPN report; IT lead; monthly |
| Control mobile devices | Managed mobile access or block | MDM report; IT lead; monthly |
| Protect communications | Encrypted web and email paths | Configuration export; IT lead; quarterly |
| Fix system flaws | Patch process for supported systems | Patch report; IT lead; monthly |
| Update malware protection | Active endpoint protection updates | Console report; IT lead; weekly |
Multi-factor authentication, or MFA, asks for more than one identity proof. For example, it may require a password and an authenticator prompt.
MFA is a sensible Zero Trust control. It checks identity at the access point.
But MFA cannot fix shared accounts, missing device lists, open SaaS links, or weak physical controls.
Some older CMMC materials cite 17 Level 1 practices. Consultant checklists and archived CMMC 1.0 guides may also cite 17.
The current baseline has 15 FCI safeguards in FAR 52.204-21. The applicable contract clause controls your duties.
The number is not the only risk. A firm can document old items and miss a current duty.
One example is separating public system parts from internal systems. That gap can matter even when every checklist row looks complete.
Use the current CMMC Level 1 Assessment Guide and FAR text as your source of truth. Record the version used in your self-assessment.
Reassess the scope at once if CUI becomes relevant.
Costs, 90-day plan, and level 2 limits
A small contractor with 10 to 50 users can often prepare in 30 to 90 days. This assumes its identity, endpoint, and email tools are already managed.
Your starting condition drives both cost and time.
What should a level 1 budget include?
Costs vary by starting point. These United States planning ranges give leaders a usable first budget.
| Starting position | Likely cash cost | Typical duration | Main work |
|---|
| Managed Microsoft 365 or Google Workspace, MFA, managed endpoints | $1,500 to $6,000 | 30 to 45 days | Scope, evidence, access cleanup |
| Mixed SaaS, some unmanaged devices, optional adviser | $6,000 to $20,000 | 45 to 90 days | Device control, MFA coverage, evidence build |
| Shared accounts, BYOD access, no endpoint management | $20,000 to $50,000+ | 90 days or more | Reduce scope or rebuild controls |
What happens in the first 90 days?
Days 1 to 30: Get the clause and classify FCI versus CUI. Name an executive owner and inventory data paths.
Disable shared accounts and find unmanaged devices. These early actions expose the largest gaps.
Days 31 to 60: Enforce MFA on every FCI path. Restrict SaaS access and fix remote access.
Confirm endpoint protection. Create records for physical access and media handling.
Do not use this framework instead of Level 2 when your contract requires CUI protection. Do not assume CMMC applies to every firm with federal customers. Confirm the clause, information type, and prime contractor flowdown before making an affirmation.
Days 61 to 90: Close every open finding. Test each control within the CMMC system scope.
Collect a dated evidence package before the compliance decision. Check that Microsoft 365 FCI access is limited to named users.
Review SaaS apps that hold FCI or have admin links. Remove or block unmanaged devices that fail BYOD security rules.
The executive owner should review each Met, Not Met, and Not Applicable decision. The owner should confirm that access controls match the FCI inventory.
Keep screenshots, exports, policies, and fix tickets as evidence. This final period should also check subcontractor security duties.
It should also confirm the contract-specific annual affirmation process.
A realistic budget separates cash spending from internal labor. Managed email, MFA, endpoint protection, and device tools may limit new software costs.
Even then, teams may need 20 to 60 internal hours. IT, contracts, operations, and leaders must map FCI and review accounts.
They must also document media handling and gather proof. Optional advisers can speed scope work or gap fixes.
Training costs may include short sessions for employees and system administrators. Treat licenses, access reviews, employee setup, and evidence work as ongoing costs.
What people ask
How do I get CMMC level 1 certified?
CMMC Level 1 usually needs annual self-assessment and affirmation when the contract requires them. It does not usually need a third-party certification audit.
Scope FCI, meet all 15 FAR 52.204-21 safeguards, and keep evidence. Then follow the contract's required submission process.
What are the 15 CMMC level 1 requirements?
The 15 requirements cover access, identity checks, media disposal, physical access, remote access, mobile access, communications, patching, and malware protection. They come from FAR 52.204-21.
They are not the old 17-practice list.
How much does CMMC level 1 cost?
A contractor with 10 to 50 users may spend $1,500 to $20,000 when core cloud and endpoint tools exist. Costs can exceed $20,000 with shared accounts, unmanaged BYOD, or scattered SaaS access.
The largest cost often comes from fixing scope gaps.
What is the difference between CMMC level 1 and level 2?
Level 1 protects FCI through 15 FAR 52.204-21 safeguards. Level 2 protects CUI through 110 NIST SP 800-171 requirements.
Level 2 may need a third-party assessment under the applicable DoD contract.
What matters most:- Level 1 is a contract duty for FCI. It is not a blanket label for all federal work.
- The current CMMC 2.0 Level 1 baseline has 15 FAR 52.204-21 safeguards.
- Scope email, SaaS, devices, integrations, and providers before judging compliance.
- Each safeguard needs a setting, evidence, owner, and review date.
- Stop and reassess if CUI enters the workflow. Level 2 may then apply.
Related sources
These articles can help you explore the topic in more depth:
