DEV Community: Larry Downard

CMMC Level 1 Explained: The 15 Safeguards, the Self-Assessment, and the Yearly Affirmation

Larry Downard — Thu, 22 Oct 2026 19:00:00 +0000

If you hold a defense contract or subcontract that involves Federal Contract Information (FCI), CMMC Level 1 is the floor you have to meet. It's the most approachable level of the Cybersecurity Maturity Model Certification program, but "approachable" doesn't mean optional or informal. Every requirement has to be fully met, you assess yourself every year, and a senior official at your company signs off on the result.

This article walks through who needs Level 1, how FCI reaches you, the 15 safeguards in plain language, how the self-assessment and affirmation work, and the mistakes we see most often.

Who needs Level 1?

Level 1 applies when your contract requires CMMC Level 1 (Self) and your information systems process, store, or transmit FCI in performance of that contract.

FCI is defined in FAR 52.204-21 as information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service. It does not include information the government already makes public, or simple transactional information like what's needed to process a payment.

In practice, that's things like statements of work, drawings and specs that aren't public, delivery schedules, internal contract correspondence, and the reports you produce for the customer.

If your contract also involves Controlled Unclassified Information (CUI), Level 1 isn't enough. CUI brings in DFARS 252.204-7012 and the 110 requirements of NIST SP 800-171, which is Level 2 territory. Level 1 is not "the first 15 requirements of Level 2." It's its own standard, for FCI.

How FCI shows up through your contract

You don't have to guess whether you handle FCI. The contract tells you. Look for:

FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. This clause lists the 15 safeguards and applies to systems that process, store, or transmit FCI.
DFARS 252.204-7021, the CMMC clause. The contracting officer fills in the required level, such as CMMC Level 1 (Self).
Flow-downs from your prime. Both clauses require primes to pass the requirements down to subcontractors who will have FCI on their systems. If you're a sub, your purchase order or subcontract is where this shows up.

Read the clauses in your contract and your subcontract. They decide which level applies, not a guess about what kind of company you are.

The 15 safeguards, in plain language

The 32 CFR Part 170 rule defines the CMMC Level 1 requirements as the 15 safeguards in FAR 52.204-21(b)(1)(i) through (xv).

You may also see "17 practices" in older CMMC material. That's because the self-assessment uses the NIST SP 800-171A objectives, and one FAR requirement (the visitor and physical access one) maps to three separate NIST requirements. Same work, counted two ways. The current rule says 15.

Here they are, grouped by what they protect, with what that looks like at a small shop.

Access control (4)

Only authorized users, processes, and devices get in. Every person has their own account, and only company-approved devices connect.
Users only do what their job requires. Your shop-floor lead doesn't need admin rights on the file server.
Control connections to outside systems. Decide which personal devices, cloud apps, and remote access methods are allowed, and block the rest.
Control what goes on public systems. Someone reviews what gets posted on your website or social media so contract information doesn't end up there.

Identification and authentication (2)

Identify users, processes, and devices. No shared logins like "frontdesk" or "shop."
Verify identity before granting access. Passwords at minimum. Multi-factor authentication is a smart addition even though Level 1 doesn't list it by name.

Media protection (1)

Wipe or destroy media before disposal or reuse. Old laptops, drives, and USB sticks that held FCI get wiped or shredded, and you keep a record.

Physical protection (2)
Limit physical access to authorized people. Locked doors, a locked server closet, and badges or keys for the people who need them.
Escort visitors, log physical access, and manage keys and badges. A visitor sign-in sheet, an escort rule, and a list of who holds which keys. Collect them when people leave.

System and communications protection (2)

Monitor and protect your network boundaries. A properly configured firewall between your network and the internet.
Keep public-facing systems separate from internal ones. If you host anything public, put it on its own network segment or with a hosting provider, not on the same network as your accounting PC.

System and information integrity (4)

Find and fix flaws promptly. Turn on automatic updates and patch regularly.
Protect against malicious code. Anti-malware on every computer that handles FCI.
Keep that protection updated. Automatic signature and engine updates.
Scan regularly, and scan files from outside sources in real time. Scheduled scans plus real-time scanning of downloads, email attachments, and USB files.

For each safeguard with evidence examples, see our CMMC Level 1 requirements page.

How the self-assessment works

1. Set your scope. Before you assess, write down which systems, people, facilities, and outside service providers process, store, or transmit FCI. Systems that don't touch FCI are out of scope.

2. Assess every requirement. Use the NIST SP 800-171A objectives that map to each Level 1 requirement, reading "FCI" wherever the objective says "CUI." Each requirement is scored MET or NOT MET. There is no partial credit.

3. All 15 must be MET. Level 1 doesn't use the 110-point scoring you see at Level 2, and Plans of Action and Milestones (POA&Ms) are not allowed at Level 1 at any time. If something isn't done, finish it before you claim compliance.

4. Enter the results in SPRS. The Supplier Performance Risk System entry includes the CMMC level, the status date, the assessment scope, the CAGE codes covered, and the result.

5. Affirm it. A senior official submits an affirmation in SPRS.

6. Keep your evidence. The rule requires you to keep the artifacts behind your assessment for six years.

7. Repeat every year. Both the self-assessment and the affirmation are annual. Under the CMMC contract clause, a Final Level 1 (Self) status counts as current only if it's no older than one year.

Timing matters too. When a contract requires Level 1 (Self), you need the status and the affirmation in SPRS before award, not after.

What the affirmation means

The Affirming Official is a senior person at your company who is responsible for CMMC compliance and has the authority to speak for the company. By affirming, they're telling the government your company has implemented, and will keep implementing, every Level 1 requirement for every system in scope.

That's a statement to the federal government, and it's tied to getting paid on federal contracts. A knowingly false or reckless affirmation can create liability under the False Claims Act. Treat the affirmation as a statement you need to be able to back up with evidence, not a checkbox.

Where things stand right now

CMMC is in Phase 1, which uses self-assessments. On July 13, 2026, the Department suspended the planned Phase 2 rollout while a CMMC Reform Task Force reviews the program. Level 1 wasn't suspended. Contracts can still require Level 1 (Self), and the FAR 52.204-21 safeguards apply whenever that clause is in your contract.

Common mistakes

Treating policy as proof. A written policy says what you intend. The assessment checks what's actually in place.
Shared accounts. One login for the front desk or the shop floor breaks the identification and authentication requirements.
Forgetting the physical side. No visitor log, no escort rule, and no record of who holds keys are common gaps.
Leaving out cloud and outside providers. If your email, file sharing, or IT provider handles FCI, it belongs in your scope.
Skipping the yearly repeat. Level 1 isn't one and done. A status older than one year isn't current.
Affirming without evidence. If you can't show it, don't sign it.
Assuming Level 1 covers CUI. If DFARS 7012 or CUI markings show up in your contract, look at Level 2.

A quick Level 1 checklist

I've read my contract and subcontract clauses (FAR 52.204-21, DFARS 252.204-7021, prime flow-downs).
I've written down which systems, people, facilities, and providers handle FCI.
Every user has a unique account, with access limited to their role.
Outside connections and public posting are controlled.
Old media is wiped or destroyed, with records.
Doors are locked, visitors are escorted and logged, and keys and badges are tracked.
A firewall protects the network edge, and public-facing systems are separated.
Patching, anti-malware, updates, and scans are running.
All 15 requirements are MET, with evidence saved for six years.
Results are in SPRS, and our Affirming Official has affirmed.
Next year's assessment and affirmation are on the calendar.

Want a second set of eyes?

Cyberneza is a veteran-owned cybersecurity firm in Orlando, FL, with a 100% US-based team. We help defense contractors confirm their scope, check each Level 1 requirement against how their systems actually run, and get ready to affirm with confidence. Start with our CMMC page.

From Point-in-Time to Always-On: Preparing Your NIST 800-171 Evidence for Whatever CMMC Becomes

Larry Downard — Thu, 22 Oct 2026 16:00:06 +0000

CMMC reform news could arrive soon. The Cyber AB holds its next Town Hall on Tuesday, October 27, and the CMMC Reform Task Force's findings still aren't public.

At September's Town Hall, presenters shared what they openly called speculation: DoD may be moving away from point-in-time assessments that go stale quickly. Nobody outside DoD knows for sure. But if the program shifts toward ongoing proof that your security works, the teams that already collect evidence continuously will be ready.

Here's how to start, regardless of what's announced.

Treat evidence like logs, not like homework

Most teams gather screenshots and exports the week before an assessment. Flip that around. Set up your systems to produce evidence on a schedule:

Export MFA enrollment and conditional access reports monthly
Keep vulnerability scan results with dates attached
Save your patch compliance reports
Retain the record of each access review, including who approved it

Centralize your audit logs

NIST SP 800-171 already requires you to create and retain audit logs (3.3.1) and to review them (3.3.3). Send logs from your identity provider, endpoints, firewall, and cloud apps to one place. Alerting on what matters is what turns "we have logs" into "we watch our environment."

Map evidence to requirements

For each of the 110 requirements, write down:

What proves it's working
Where that proof lives
How often it's refreshed
Who owns it

That list belongs in your System Security Plan (SSP), and it's what makes your SPRS score defensible on any given day.

Automate the boring checks

Small scripts go a long way. A weekly job can flag accounts without MFA, devices missing encryption, or users who haven't signed in for 90 days. Each run is both a fix list and a piece of dated evidence.

Keep the basics current

None of this replaces the fundamentals. If your contract includes DFARS 7012, you still need to protect CUI under NIST SP 800-171 and keep an accurate SPRS score today, whatever reform brings.

Need a hand?

Cyberneza is a veteran-owned, 100% US-based cybersecurity firm that helps defense contractors prepare for CMMC. Start with our free SPRS Score Worksheet or get in touch.

The SSP and POA&M Aren't New: Lessons From Four Generations of DoD Security Rules

Larry Downard — Thu, 22 Oct 2026 15:00:00 +0000

When small defense contractors first meet CMMC, the System Security Plan and the Plan of Action and Milestones (POA&M) can feel like brand-new paperwork. They aren't. I've been writing them for DoD work for almost 20 years, under four different sets of rules.

Four generations, same core documents

DITSCAP: on the Ground-Based Midcourse Defense program, I wrote System Security Authorization Agreements and SSPs for the Missile Defense Agency.
DIACAP: supporting DISA customers, I prepared system security plans and tracked open findings in POA&M reports.
RMF: on defense training systems, I wrote SSPs under NIST SP 800-53 and backed them with STIG hardening and ACAS scans.
CMMC: today, Level 2 asks contractors to document how they meet the 110 requirements in NIST SP 800-171, in an SSP, with a POA&M for allowed gaps.

The acronyms changed. The core idea didn't: write down how your system is protected, prove it, and track what's still open.

What carried over every time

The SSP has to match reality. Assessors compare the plan against the actual systems. A generic template that doesn't describe your environment fails fast.

Scope decides everything. Every framework started with defining the system boundary. In CMMC terms, that means knowing exactly where CUI lives and keeping that environment small.

A POA&M is a commitment, not a parking lot. Open items need owners and dates. Under CMMC, the rules are tighter: you need at least 88 of 110 points, some requirements can't be deferred, and open items must close within 180 days.

Evidence beats intentions. Scan results, configuration baselines and logs carried more weight than policy language in every assessment I supported.

What this means for small contractors

If you're facing CMMC for the first time, you're not starting from zero. You're joining a process DoD has refined for decades. Start with the contract, scope the CUI tightly, and write an SSP that describes how your team actually works.

I put together a plain-English walkthrough of CMMC Level 2 here:

https://cyberneza.com/blog/cmmc-level-2-plain-english

Larry Downard is a CMMC Registered Practitioner, CISSP and US Air Force veteran, and the founder of Cyberneza, a veteran-owned cybersecurity firm with a 100% US-based team.

CMMC Scoping 101: Decide What's In Scope Before You Fix Anything

Larry Downard — Wed, 21 Oct 2026 16:00:00 +0000

Most CMMC Level 2 projects go wrong at the very first step: scope. If you don't know which systems handle Controlled Unclassified Information (CUI), you can't know which systems need the 110 NIST SP 800-171 requirements.

Start with the contract

CUI reaches you through a contract. Look for DFARS 7012, flow-down clauses from your prime, and CUI markings on the documents you receive. Those tell you what data you're protecting.

Follow the data

Once you know what the CUI is, trace where it goes:

Where it arrives (email, file share, a prime's portal)
Where it's stored
Who and what can access it
Where it leaves

Sort your assets

The CMMC Level 2 scoping guidance puts assets into five groups:

CUI assets that store, process, or transmit CUI
Security protection assets that protect those systems, like your firewall, identity provider, or SIEM
Contractor risk managed assets that could reach CUI but are kept from it by policy and controls
Specialized assets such as IoT, OT, test equipment, and government property
Out-of-scope assets that can't touch CUI at all

Consider an enclave

Many small contractors keep CUI in a separate, tightly controlled environment (an enclave) instead of applying every requirement to the whole company. A smaller scope means fewer systems to protect, simpler compliance, and an easier assessment.

Write it down

Document your scope in your System Security Plan (SSP) with a network diagram and an asset inventory. An assessor will start there, and so should your SPRS score.

Need a hand?

Cyberneza is a veteran-owned, 100% US-based cybersecurity firm that helps defense contractors scope and prepare for CMMC. Get in touch, or start with our free SPRS Score Worksheet.

How to Calculate Your SPRS Score for NIST SP 800-171

Larry Downard — Wed, 21 Oct 2026 00:38:07 +0000

If your defense contract includes DFARS 7012, you're required to protect Controlled Unclassified Information (CUI) using the 110 security requirements in NIST SP 800-171. DFARS 7019 and 7020 add one more step: you score yourself against those requirements and post the result in the Supplier Performance Risk System (SPRS).
The math is simple. The hard part is being honest about what's actually in place.

Start at 110

Every requirement is worth points. You start with a perfect score of 110 and subtract points for each requirement that isn't fully implemented.

Subtract by weight

Each requirement carries a weight from the DoD Assessment Methodology:

5 points for high-impact requirements, such as MFA, encryption of CUI, incident response, and limiting system access to authorized users- 3 points for medium-impact requirements- 1 point for lower-impact requirementsPartial credit doesn't count. If a requirement is only half done, you take the full deduction. ## The two exceptions Two requirements allow partial credit:
MFA (3.5.3): subtract 5 if it isn't implemented, or 3 if it covers remote and privileged access but not all users- FIPS-validated encryption (3.13.11): subtract 5 if CUI isn't encrypted at all, or 3 if it's encrypted but the module isn't FIPS-validated## No SSP, no score Without a System Security Plan (requirement 3.12.4), you don't have a valid assessment at all. Write the SSP first, then score against it. ## How low can it go? If nothing is implemented, the score bottoms out at -203. Negative scores are common on a first honest pass, and that's fine. A real number gives you a starting point. ## What a POA&M does (and doesn't) do A Plan of Action and Milestones (POA&M) documents how you'll close gaps. It does not add points back. A requirement with an open POA&M item is still scored as not met. Under CMMC Level 2, you need at least 88 points to get conditional status with a POA&M, some high-weight requirements can't be left open on a POA&M, and open items have to be closed within 180 days. ## What you submit to SPRS Your SPRS entry includes:
Your score- The assessment date- The CAGE codes it covers- Your SSP name and date- The date you expect to reach 110A Basic self-assessment stays valid for three years, but update it whenever your environment changes. ## A worked example Say you're missing MFA for regular users (-3), haven't tested your incident response plan (-1), and haven't added a system-use notice to your login screens (-1). That works out to 110 - 3 - 1 - 1 = 105. ## Get a head start We built a free SPRS Score Worksheet that walks through all 110 requirements with their weights already filled in. If you'd like a second set of eyes on your score or your SSP, Cyberneza is a veteran-owned, 100% US-based cybersecurity firm that helps defense contractors with CMMC and NIST 800-171. Reach out here.

DEV Community: Larry Downard

CMMC Level 1 Explained: The 15 Safeguards, the Self-Assessment, and the Yearly Affirmation

Who needs Level 1?

How FCI shows up through your contract

The 15 safeguards, in plain language

Access control (4)

Identification and authentication (2)

Media protection (1)

Physical protection (2)

System and communications protection (2)

System and information integrity (4)

How the self-assessment works

What the affirmation means

Where things stand right now

Common mistakes

A quick Level 1 checklist

Want a second set of eyes?

From Point-in-Time to Always-On: Preparing Your NIST 800-171 Evidence for Whatever CMMC Becomes

Treat evidence like logs, not like homework

Centralize your audit logs

Map evidence to requirements

Automate the boring checks

Keep the basics current

Need a hand?

The SSP and POA&M Aren't New: Lessons From Four Generations of DoD Security Rules

Four generations, same core documents

What carried over every time

What this means for small contractors

CMMC Scoping 101: Decide What's In Scope Before You Fix Anything

Start with the contract

Follow the data

Sort your assets

Consider an enclave

Write it down

Need a hand?

How to Calculate Your SPRS Score for NIST SP 800-171

Start at 110

Subtract by weight