CMMC Level 1 requirements: are you doing the self-assessment and affirmation right?

If your firm designs, engineers or builds under a DoD contract or subcontract, and your systems hold project information the government has not made public, the CMMC Level 1 requirements apply to you. Level 1 has no outside assessor, so it is easy to treat as paperwork. It still ends with a senior official at your firm signing a statement to the government that every control is in place. Here is what the self-assessment checks, where AEC firms slip, and what to finish before your next affirmation is due.

Who needs a CMMC Level 1 self-assessment?

Any contractor or subcontractor whose DoD contract requires CMMC Level 1 (Self), which applies where your systems handle Federal contract information (FCI) but not controlled unclassified information (CUI). FAR 52.204-21 defines FCI as information, not intended for public release, that is provided by or generated for the government under a contract. It excludes information the government publishes and simple transactional information such as what is needed to process payments.

For an architecture, engineering or construction firm, FCI is often the everyday material of a federal project: scopes of work, schedules, meeting minutes, RFIs, submittals and site details that the government has not made public. If those files sit in your email, file shares or project management platform, those systems are part of the picture.

Did the CMMC Phase 2 suspension change Level 1?

No. The Department of War suspended Phase 2 on July 13, 2026, which paused Level 2 third-party certification as a condition of award. Phase 1, which began November 10, 2025, covers Level 1 and Level 2 self-assessments, and it remains in effect. Contracts that call for Level 1 (Self) still require a current self-assessment and affirmation in SPRS before award. For what else still applies during the suspension, see our Phase 2 briefing.

How many CMMC Level 1 requirements are there, and what do they cover?

CMMC Level 1 has 15 requirements: the basic safeguarding requirements in FAR 52.204-21(b)(1), applied to every system in scope. In plain terms they cover:

• Access: limit system access to authorized users and to the transactions they need, control connections to external systems, and control what is posted on public systems.
• Identity: identify users, processes and devices, and authenticate them before allowing access.
• Media: sanitize or destroy media containing FCI before disposal or reuse.
• Physical: limit physical access to systems, escort and monitor visitors, keep physical access logs and manage access devices such as keys and badges.
• Boundaries: monitor and protect communications at the network edge, and put publicly accessible components on a separate subnetwork.
• System integrity: identify and fix flaws in a timely manner, run malicious code protection, keep it updated, and perform periodic and real-time scans.

Under 32 CFR 170.15, you assess each requirement using the objectives in NIST SP 800-171A (June 2018), substituting FCI wherever an objective mentions CUI. Each requirement breaks into several objectives, and every objective has to be satisfied for the requirement to be MET.

Which systems are in scope?

Every system that processes, stores or transmits FCI. 32 CFR 170.19(b) places those systems in scope and leaves systems that never touch FCI out of scope, with no documentation required for them. Specialized assets, such as IoT devices, operational technology, government furnished equipment and test equipment, are not assessed at Level 1. You should consider the people, technology, facilities and external service providers involved with FCI when drawing the line.

The most common scoping mistake is drawing the boundary around one project folder and forgetting the paths FCI takes to get there: the email system that received it, the laptops that downloaded it, the phones that sync it and the cloud collaboration platform shared with the owner and subcontractors.

Can you pass Level 1 with gaps on a POA&M?

No. Section 170.15 requires a MET result for every Level 1 requirement and states that no POA&Ms are permitted for CMMC Level 1. This is the biggest difference from Level 2, where certain 1-point gaps can sit on a plan of action for up to 180 days under a Conditional status. At Level 1, a single NOT MET means you cannot claim the status, so every gap has to be closed before you enter results.

What goes into SPRS, and who affirms it?

Five data points and a signed affirmation. Section 170.15 requires you to enter, at minimum, the CMMC level, the CMMC Status Date, the assessment scope, every CAGE code tied to the in-scope systems, and the overall compliance result.

The affirmation comes from the Affirming Official defined in 32 CFR 170.22: the senior level representative responsible for the firm's CMMC compliance with authority to affirm it. The affirmation includes that person's name, title and contact information and a statement that the firm has implemented, and will maintain, all applicable CMMC security requirements. For Level 1 it is due at the completion of each self-assessment and annually thereafter. DFARS 252.204-7021 makes the same point from the contract side: the contractor must keep a current affirmation of continuous compliance in SPRS for each CMMC unique identifier tied to systems handling FCI or CUI. Our guide to keeping your SPRS entry and annual affirmation current covers the calendar in more detail.

Why does the affirmation carry so much weight?

Because it is a representation to the government that can be tested later. There is no outside assessor at Level 1, so the affirmation is the firm's own word. The Justice Department has pursued False Claims Act cases where contractors sought payment while not meeting required cybersecurity standards. On September 1, 2026, for example, it announced that Honeywell Aerospace agreed to pay $2,042,518 to resolve allegations that a business unit failed to comply with NIST SP 800-171 requirements its contract required. The claims were allegations only, with no determination of liability. That case involved CUI controls; the same logic applies to any affirmation signed without evidence behind it.

Section 170.15 also requires you to keep the artifacts used as evidence for six years from the CMMC Status Date. If an affirming official cannot point to that evidence, the affirmation is hard to defend.

Where do firms usually get Level 1 wrong?

In the requirements that sound simple and leave little paper behind:

• Visitor escort and physical access logs at offices and jobsite trailers where FCI is viewed or printed.
• Media sanitization records for retired laptops, drives and plotters with internal storage.
• Shared logins on field tablets or plotters, which defeat the identification and authentication requirements.
• Patch and scan evidence that shows timely flaw remediation and current antivirus on every in-scope device, including personal phones used for project email.
• Public website and portal content reviewed before posting, since controlling information on public systems is its own requirement.
• Re-signing last year's affirmation without repeating the assessment.

What should you do this quarter?

• Confirm which of your DoD contracts and subcontracts call for Level 1 (Self) and which CAGE codes they use.
• Map where FCI flows today and write down the assessment scope, including email, endpoints and collaboration platforms.
• Walk each of the 15 requirements against the NIST SP 800-171A objectives and collect dated evidence for every one.
• Close every gap before entering results, since Level 1 allows no POA&M.
• Brief the affirming official on what they are signing, put the annual renewal on the calendar, and store the evidence where it will survive six years.

How does s90 help?

s90 works with AEC firms on DoD projects to scope FCI systems, run the annual Level 1 self-assessment against the 800-171A objectives, and keep the evidence your affirming official relies on. When a prime or contracting officer asks for proof, our agreements commit to producing it within 24 hours. If your affirmation is coming due, we are glad to walk through it with you.