CMMC Level 1 for small suppliers: the self-assessment in plain English

Are you Level 1 or Level 2?

• Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not meant for public release. If you only have FCI, Level 1 is the likely target.
• Controlled Unclassified Information (CUI) carries specific markings and handling rules. If you receive or store CUI, you are likely looking at Level 2 and NIST SP 800-171.

Check your contract and ask your prime. The FCI vs CUI guide explains the difference in more detail.

The 15 basic requirements, grouped

Who can get in

• Only authorized users, processes and devices can access company systems.
• Users can only do the things they are authorized to do.
• Connections to outside systems are controlled.
• Information posted to public systems is controlled.
• Users and devices are identified and authenticated (passwords, and ideally multi-factor authentication) before access.

The physical side

• Physical access to systems and equipment is limited to authorized people.
• Visitors are escorted and monitored, and physical access is logged.
• Physical access devices, such as keys and badges, are controlled.

Protecting the systems

• Media containing FCI is sanitized or destroyed before disposal or reuse.
• Communications at the boundary of your systems are monitored and protected.
• Publicly accessible systems are separated from internal networks.
• System flaws are found, reported and corrected in a timely way (updates).
• Malicious code protection is in place, kept updated, and scans run.

This is a plain-language summary. Read the official requirements in FAR 52.204-21 and the CMMC program rule before you affirm anything.

The annual self-assessment and SPRS

Level 1 is self-assessed every year. The results are entered in the Supplier Performance Risk System (SPRS), and a senior official of the company affirms that the business meets the requirements. That affirmation is a statement to the government, so it should rest on real evidence: screenshots, a short policy, an access list, update records.

Where small shops usually get stuck

• One shared login on the shop computer.
• Guest Wi-Fi on the same network as the machine that holds drawings and purchase orders.
• No record of who has keys, and no visitor log.
• Old laptops and drives thrown out without wiping.

A short readiness engagement usually fixes these in weeks, not months. See NIST 800-171 and CMMC readiness and CMMC help for suppliers near Vandenberg.

Where CMMC stands

CMMC rules and timelines have changed several times. As of October 2026, Phase 2 third-party assessments were suspended pending review, while self-assessments continue. Check the DoD CIO CMMC site and your contract for current requirements. This is general information, not legal advice.