Technical Guide #1: How to Get CMMC Level 1, Step by Step

By Josh Hammer

This guide gives you the working sequence.

First, an important correction: CMMC Level 1 is not a certification. It is an annual self-assessment against 15 basic safeguarding requirements, followed by an executive affirmation recorded in the Supplier Performance Risk System, or SPRS. There is no third-party assessor at Level 1.

You must fully meet every applicable requirement before submitting. No partial credit is available, and Level 1 does not permit a Plan of Action and Milestones, commonly called a POA&M.

The process below is designed for a competent IT professional who has never completed a compliance assessment and needs to know what to do next.

Before you begin: audit first, plan second, tools third

Do not begin by purchasing a compliance platform or downloading a policy template.

Start with an audit of how your company actually operates:

1. What federal information do you handle?
2. Which people, devices, applications, cloud services, and facilities can access it?
3. Which of the 15 requirements are implemented today?
4. What evidence proves that each requirement works?
5. Which gaps must be corrected before you submit?

A compliance tool can organize evidence and map controls. It cannot make an unimplemented safeguard MET. The compliance process comes first. Technology should support that process, not replace it.

Step 1: Confirm that Level 1 is actually your requirement

The first question is not “Which software should we use?”

It is: Do you handle Federal Contract Information, or Controlled Unclassified Information? See how to determine whether you handle FCI or CUI if you need a structured way to make that call.

CMMC Level 1 applies to systems that process, store, or transmit Federal Contract Information, or FCI. FCI is non-public information provided by or generated for the government under a contract, excluding public information and simple payment-processing information.

The 15 Level 1 requirements come from FAR 52.204-21, as incorporated into the CMMC requirements.

If your environment handles CUI, you are generally looking at CMMC Level 2 requirements instead. Level 2 is materially broader and involves the 110 security requirements in NIST SP 800-171 Revision 2.

Do not guess here. Review:

• Your prime contract and subcontracts.
• The clauses incorporated into those agreements.
• Data labels and handling instructions.
• Statements from your prime contractor about FCI or CUI.
• The systems where government information is stored, transmitted, or used.

A wrong classification changes everything downstream. If you treat a CUI environment as an FCI-only environment, your assessment may be incomplete even if every Level 1 requirement is implemented.

Step 2: Define and document your assessment scope

CMMC is assessed against a defined environment. You need to identify the systems and assets that process, store, or transmit FCI.

Create a written scope document before testing controls. At minimum, include:

• Workstations and laptops.
• Servers and network devices.
• Cloud applications and storage.
• Email and collaboration platforms.
• Remote-access tools.
• Managed service providers and other external service providers.
• Facilities where in-scope systems are located.
• Users and administrators who can access FCI.
• The CAGE code or CAGE codes associated with the information systems.

Think of this as drawing a boundary around the environment. If you need a practical method for mapping your scope, see mapping your CUI boundary. If you cannot explain what is inside the boundary, you cannot reliably answer the assessment questions.

A useful format is a simple table:

Do not assume that an application is out of scope simply because it is not labeled “security.” If a user accesses FCI through it, or FCI passes through it, investigate it.

Step 3: Work through all 15 requirements

CMMC Level 1 contains 15 requirements from FAR 52.204-21. Work through them one at a time. Record a clear result and identify the evidence that supports it.

The requirements group naturally into six practical areas.

Access control

1. Limit system access to authorized users, processes, and devices.
2. Limit access to the types of transactions and functions users are permitted to execute.
3. Verify and control connections to external information systems.
4. Control information posted or processed on publicly accessible systems.

In practice, you are checking whether users have only the access they need, whether external connections are controlled, and whether someone reviews information before it is posted publicly.

Identification and authentication

5. Identify users, processes, and devices.
6. Authenticate or verify identities before allowing access.

You should be able to identify who is using an account or device and show how the system verifies that identity. Shared accounts create problems because they make accountability difficult.

Media protection

7. Sanitize or destroy media containing FCI before disposal or reuse.

This includes retired computers, removable drives, backup media, and other storage devices. Your process should cover both digital sanitization and physical destruction where appropriate.

Physical protection

8. Limit physical access to systems, equipment, and operating environments to authorized individuals.
9. Escort visitors, monitor visitor activity, maintain physical access logs, and control physical access devices.

This area applies to offices, server rooms, wiring closets, and other locations where in-scope systems operate.

System and communications protection

10. Monitor, control, and protect communications at external and key internal boundaries.
11. Separate publicly accessible system components from internal networks.

Your firewall, network segmentation, remote access, and public-facing services matter here. A public website or externally accessible application should not provide an uncontrolled path into internal systems.

System and information integrity

12. Identify, report, and correct system flaws in a timely manner.
13. Provide protection from malicious code.
14. Update malicious-code protection when new releases are available.
15. Perform periodic system scans and real-time scans of files from external sources.

This includes vulnerability management, antivirus or endpoint protection, patching, malware updates, and scanning behavior.

These requirements are not isolated from higher-level compliance work. CMMC Level 1 requirements map to specific objectives in NIST SP 800-171A, based on NIST SP 800-171 Revision 2. For example:

• AC.L1-b.1.i maps to NIST SP 800-171 requirement 3.1.1.
• IA.L1-b.1.v maps to 3.5.1.
• SI.L1-b.1.xv maps to 3.14.5.

That means the work you do for Level 1 can form a useful foundation for later CMMC Level 2 or NIST SP 800-171 readiness. It does not mean Level 1 satisfies Level 2. Level 2 requires substantially more practices, a different data classification, and a broader assessment.

Step 4: Prove that each requirement functions

A policy is not proof that a control works.

Evidence should demonstrate that the safeguard is implemented in the actual environment within your assessment scope. Collect evidence while you test each requirement instead of waiting until the end. That evidence should also align with your System Security Plan, especially if you expect this work to support broader CMMC or NIST SP 800-171 readiness later.

Examples of useful evidence include:

• A screenshot of a multi-factor authentication setting showing the system name and capture date.
• An exported list of authorized users from an identity platform.
• A current firewall or network configuration export.
• A signed visitor log showing dates, names, escorts, and access areas.
• A media destruction or sanitization record.
• An endpoint protection report showing current definitions and scan status.
• A ticket or vulnerability report showing that a flaw was identified, assigned, corrected, and closed.
• A network diagram showing separation between public-facing components and internal systems.

Evidence should answer three questions:

1. What system or process does this prove?
2. When was it true?
3. How can another person locate and understand it?

Name files consistently. For example:

AC-01-M365-Authorized-Users-2026-09-19.xlsx

SC-02-Firewall-Configuration-2026-09-19.xml

PE-02-Visitor-Log-2026-Q3.pdf

The evidence used for your assessment must be retained for six years from the CMMC Status Date. Store it in a controlled location with restricted access, backups, and a retention process. Do not leave the only copy in an employee’s personal folder.

Step 5: Get SPRS access before you need it

This is the step that most often delays otherwise prepared companies.

Access to SPRS runs through the Procurement Integrated Enterprise Environment, or PIEE. You need the correct PIEE account, organization association, and role. A Contractor Account Administrator, or CAM, must approve the request.

Start this process early. Do not wait until the day before a proposal deadline.

The practical sequence is:

1. Confirm that your company has an active SAM.gov registration.
2. Confirm the company’s CAGE code.
3. Create or verify your PIEE account.
4. Associate your account with the correct company organization.
5. Request the role needed to work with SPRS.
6. Have the organization’s CAM approve the request.
7. Log into PIEE and open the SPRS application once access is active.
8. Test that you can view the appropriate contractor functions before the assessment deadline.

Role names and screen labels can change. If you are unsure which role applies, stop and resolve that question with your CAM or PIEE support rather than selecting a role at random.

Technical Guide #2 in this series will cover PIEE, CAM approval, roles, and SPRS access in detail.

Step 6: Enter the assessment results in SPRS

After the 15 requirements are assessed, enter the result in SPRS.

The CMMC Level 1 regulation identifies the minimum information that must be included:

• CMMC Level.
• CMMC Status Date.
• CMMC Assessment Scope.
• All industry CAGE codes associated with the in-scope information systems.
• Compliance result.

For Level 1, every applicable requirement must be MET before you submit a Final Level 1 (Self) result. No POA&Ms are permitted.

That means you cannot submit a result that says:

“Fourteen requirements are MET, and we will finish the last one next month.”

You must either complete the requirement and gather evidence, or you are not ready to submit a compliant result.

Review your scope and CAGE codes carefully before saving the entry. A technically correct assessment attached to the wrong scope or missing an associated CAGE code can create a separate administrative problem.

Step 7: Have the Affirming Official sign

The assessment is not complete when the IT team finishes its spreadsheet.

A senior representative with authority to attest on behalf of the company must provide the affirmation in SPRS. At a small business, this is often the owner, president, or another executive.

The person affirming should understand:

• What systems were assessed.
• Which requirements were tested.
• What evidence supports the result.
• What limitations or assumptions existed.
• That the result will need to be maintained.

This is not a rubber stamp - but it is also important to be precise about where the legal exposure actually sits.

An inaccurate affirmation does not, by itself, create liability under the False Claims Act. The Act requires that a person knowingly present, or cause to be presented, a false or fraudulent claim for payment. The “knowingly” element matters, and it is defined to include deliberate ignorance and reckless disregard, not simple error. That does not lower the stakes - it raises them. It means that signing an affirmation without understanding the environment, or without reviewing the evidence behind it, is where an organization’s exposure can grow.

One recent enforcement matter is frequently cited in this context, and it is worth getting the facts right. In September 2026, Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations that it failed to comply with NIST SP 800-171 requirements on a defense-contract network while submitting claims for payment. The conduct window ran from April 2020 through December 2023, and the matter originated in a whistleblower complaint brought by a former employee. The settlement resolved allegations only and did not constitute an admission or a finding of liability.

Note what that case was and was not. It concerned compliance and payment claims - the government’s theory was that claims for payment were submitted under contracts the contractor allegedly was not complying with. It was not a false-affirmation case, and no false SPRS affirmation by a signer was alleged.

The lesson for an affirming official is therefore narrower and more useful than the headline version: the gap between what an organization’s representations say and what its environment actually does is the terrain where exposure develops. Approving an affirmation you cannot substantiate is a risk you do not need to take.

The pause of Phase II third-party assessments does not eliminate independent cybersecurity obligations under applicable defense-contract clauses.

The affirming official should electronically sign in SPRS only after reviewing the assessment record and supporting evidence.

Step 8: Calendar the renewal immediately

Level 1 is annual.

The day you submit the assessment and affirmation, create renewal reminders. Use more than one:

• 120 days before the status date.
• 90 days before.
• 60 days before.
• 30 days before.
• The renewal date.

A lapsed affirmation can end contract eligibility just as surely as a failed assessment when a contract requires a current Level 1 status.

The annual review should not be a completely new project. Maintain evidence throughout the year, review user access regularly, track vulnerabilities, monitor endpoint protection, and document changes to the assessment scope.

Troubleshooting: what usually blocks people

“Our SAM.gov registration is not active.”

Fix: Check the entity’s SAM.gov status and renewal date. Correct any registration issue and allow time for the information to synchronize before attempting PIEE or SPRS access again.

“Our CAGE code is not linked in PIEE.”

Fix: Ask the CAM or organization administrator to verify the organization association and CAGE-code relationship. Do not create duplicate accounts to work around an association problem.

“No CAM has been appointed.”

Fix: Identify the person responsible for administering the company’s PIEE users and have the appropriate organization administrator establish the CAM role. Until someone can approve access requests, your SPRS workflow may remain stuck.

“I requested the wrong role.”

Fix: Do not assume that any PIEE role will provide SPRS access. Review the available contractor roles, withdraw or correct the incorrect request if necessary, and have the CAM approve the role that matches your responsibility.

“We cannot answer the scope questions.”

Fix: Stop the assessment and document the environment. Build an inventory of systems, users, locations, cloud services, external providers, and CAGE codes. Scope uncertainty is an assessment problem, not a wording problem.

“We marked a requirement MET, but it is not fully implemented.”

Fix: Change the result. Do not mark a control MET because a policy exists, a project is underway, or a vendor says a feature is available. Implement the safeguard, test it, collect evidence, and then reassess it.

“The evidence exists, but nobody can find it.”

Fix: Create an evidence index immediately. Give each artifact a control reference, system name, owner, date, storage location, and retention date. If the team cannot retrieve evidence quickly, the evidence-management process is not functioning.

What to do, in order

Print this list and check off each line:

1. Confirm whether your environment handles FCI only or CUI.
2. Confirm that Level 1 is the correct requirement for the applicable contract.
3. Document every system, service, user, facility, and CAGE code in scope.
4. Review all 15 FAR 52.204-21 requirements.
5. Test each requirement and mark it MET only when fully implemented.
6. Collect, name, store, and index evidence for every MET result.
7. Start PIEE and SPRS access, including CAM approval, before submission day.
8. Enter the Level 1 result, status date, scope, CAGE codes, and compliance result in SPRS.
9. Have the authorized Affirming Official review and sign the affirmation.
10. Retain evidence for six years and calendar the next annual assessment.

Sources

• FAR 52.204-21 - Basic Safeguarding of Covered Contractor Information Systems
• 32 CFR § 170.15 - CMMC Level 1 Self-Assessment Requirements
• Nixon Peabody alert - Honeywell settlement shows FCA risk for NIST 800-171 gaps

Read next in this series: Technical Guide #2: How to Access SPRS, Technical Guide #3: How to Determine Whether You Handle FCI or CUI, and the free compliance readiness check.

The repetitive part of Level 1 is collecting evidence and keeping it current for six years. That work becomes more demanding when the same controls must also support other frameworks. Complynt is an enterprise compliance automation platform for control mapping, evidence collection, continuous monitoring, pre-built content packs, and policy-as-code across more than 150 frameworks, including CMMC, NIST SP 800-171, NIST SP 800-53, RMF, SOC 2, HIPAA, and ISO 27001. It runs on FedRAMP High and DoD IL5 authorized infrastructure on Palantir’s federal cloud, and H&V is EDWOSB certified. H&V does not issue certification and cannot guarantee any assessment outcome. The right sequence remains: audit first, plan second, tools third. Start with the free compliance readiness check or visit hvfsusa.com.