CMMC Level 1: The Complete Plain-English Guide (2026)

Who needs CMMC Level 1

You need CMMC Level 1 if all four are true:

• You hold or seek a DoD contract or subcontract.
• The contract incorporates FAR 52.204-21 and/or DFARS 252.204-7021 (it flows down to subs automatically when the prime is in scope).
• You handle Federal Contract Information (FCI) — non-public information shared as part of the contract.
• You do not handle Controlled Unclassified Information (CUI). If you do, you need CMMC Level 2 instead.

If you only sell commercial products to commercial customers, CMMC does not apply. If you sell to civilian agencies (GSA, DHS, HHS), FAR 52.204-21 still applies but CMMC affirmation in SPRS does not — yet. The pending FAR CUI Rule (RIN 9000-AN56) may extend similar requirements government-wide.

Not sure? Walk the 4-question decision tree — it's the same tree a DoD contracting officer would use.

Concrete examples of who needs CMMC Level 1

If you see your business in this list, you almost certainly need CMMC Level 1. None of these businesses are "cybersecurity companies" — they're ordinary firms doing ordinary work for DoD:

• An electrical contractor wiring a hangar at a Navy base under a subcontract from a prime.
• A machine shop producing non-classified metal parts for a DoD aerospace supplier.
• An IT staffing firmplacing developers on a DoD project where the contract data isn't marked CUI.
• A janitorial or facilities subcontractor servicing a DoD installation.
• A logistics or freight firm moving non-sensitive DoD cargo.
• A SBIR Phase I winner in a non-CUI topic area — the Phase I contract triggers FAR 52.204-21 flow-down. See the CMMC timeline for SBIR Phase I winners.
• A software development sub building a non-CUI internal tool for a DoD agency.
• A construction subcontractor on a base renovation contract.

If your work touches anything marked CUI — technical drawings of weapons systems, ITAR-controlled data, export-controlled engineering specs — you need CMMC Level 2, not Level 1.

The 15 safeguarding requirements (and 17 CMMC practices)

CMMC Level 1 maps to 15 plain-language requirements at FAR 52.204-21(b)(1)(i)–(xv). The CMMC Assessment Guide expresses those as 17 practice IDsacross six security families. Every Level 1 affirmation in SPRS rolls up to a single "MET": every practice must be implemented for the overall affirmation to be valid (32 CFR § 170.24).

Each requirement is unpacked in plain English — including what evidence satisfies it — in the full walkthrough of the 15 FAR 52.204-21 requirements.

SPRS and the annual affirmation

The Supplier Performance Risk System (SPRS)is the DoD's central system for supplier risk data. For CMMC Level 1, your record in SPRS contains one thing: a senior official's annual affirmation that your organization meets the 15 FAR 52.204-21 safeguarding requirements.

There is no numeric "SPRS score" at Level 1. The 0–110 score you may have read about applies only to CMMC Level 2 (the NIST SP 800-171 Basic Assessment). At Level 1 the affirmation is binary. Read CMMC Level 1 Is Binary — There Is No Score for the long version, and what to send a prime that asks for your score for the email template. To run the assessment itself, follow the step-by-step CMMC Level 1 self-assessment guide. And if a prime told you to get “certified,” read how CMMC Level 1 certification actually works — there is no third-party certificate at Level 1.

What CMMC Level 1 actually costs in 2026

There is no government filing fee. The DoD does not charge you to post the affirmation. Real costs are time and tooling:

• DIY: $0–$1,500 in cash if you already pay for Microsoft 365 Business Premium or Google Workspace Business Plus + 20–40 hours of founder/admin time.
• vCISO / consultant: $6,000–$18,000 for a full Level 1 engagement at $150–$300/hour.
• Guided SaaS (Custodia): $249/month Self Service (or $2,496/year on annual — two months free) or $397/month with a credentialed Custodia compliance officer on call. 7-day free trial, no card.

See the full breakdown in CMMC Level 1 Cost in 2026: DIY vs Consultant vs SaaS, or compare the tools head-to-head in CMMC compliance software.

CMMC Level 1 vs CMMC Level 2

Long version with side-by-side examples: CMMC Level 1 vs Level 2. If you're unsure which data type you handle, start with What Is FCI?

7-day path to a CMMC Level 1 SPRS affirmation

1. Step 1
   Confirm CMMC Level 1 applies to you

   Verify your contract or solicitation includes FAR 52.204-21 (and DFARS 252.204-7021 at Level 1), and that the data you handle is Federal Contract Information — not Controlled Unclassified Information. If you handle any CUI, you need Level 2 instead.

   Deep dive →
2. Step 2
   Inventory your FCI assets

   List every device, account, and location that stores, processes, or transmits FCI. This is your assessment scope. For most small contractors it is one cloud tenant (M365 or Workspace), 5–25 endpoints, and one office.

3. Step 3
   Implement the 15 FAR 52.204-21 safeguarding requirements

   Enable MFA on all accounts, restrict admin privileges, install endpoint anti-malware, configure boundary controls, sanitize media before disposal, lock the office, escort visitors, and patch systems. Most of this is configuration of tools you already have.

   Deep dive →
4. Step 4
   Draft a System Security Plan (SSP)

   Document — in writing — how your environment satisfies each of the 15 safeguards. The SSP is the single artifact a prime, contracting officer, or DIBCAC reviewer will ask for. It does not need to be long, but it must be specific.

5. Step 5
   Run the annual self-assessment

   Walk through each of the 17 CMMC practice IDs (mapped from the 15 FAR requirements) and confirm MET against the NIST SP 800-171A assessment objectives. Document evidence (screenshots, logs, policies) for each.

6. Step 6
   Have a senior official sign the affirmation

   A senior company official (typically owner, CEO, or CISO) signs the SPRS affirmation, attesting under 32 CFR § 170.22 to the accuracy of the assessment. This person is personally responsible.

7. Step 7
   Post the affirmation in SPRS

   Log into PIEE (piee.eb.mil), open the SPRS module, select 'CMMC Level 1 (Self) Affirmation', enter the assessment date and CAGE code, and submit. The post is free. Save the confirmation.

   Deep dive →
8. Step 8
   Maintain continuously and re-affirm annually

   Patch, monitor, train staff, and update evidence as systems change. Re-affirm in SPRS every 12 months. Custodia handles continuous monitoring and the annual re-affirmation for paid members.

Regulatory timeline

• 2016 — FAR 52.204-21 published. The 15 basic safeguarding requirements become federal acquisition law for all contractors handling FCI.
• 2020 — DFARS Interim Rule (252.204-7019/7020) requires NIST 800-171 self-assessment scores in SPRS for DoD contractors handling CUI.
• Oct 15, 2024 — CMMC Final Rule (32 CFR Part 170) published. Effective December 16, 2024.
• Nov 10, 2025 — 48 CFR rule (the contract-clause side, DFARS 252.204-7021 amendment) begins phased rollout in DoD solicitations. Phase 1 of 4.
• Through Nov 2028 — Phases 2–4 expand the clause to most DoD solicitations. By the end of the rollout, substantially all DoD contracts handling FCI or CUI carry the CMMC requirement.

CMMC Level 1: Frequently Asked Questions

Plain-English CMMC Level 1 explainers

Every post on the Custodia blog is written for the founder who never asked to become a cybersecurity expert. Each one cites primary sources (32 CFR Part 170, FAR 52.204-21, DFARS, NIST 800-171A) so you can verify every claim.

• CMMC Level 1: The Complete 2026 Guide for Small DoD Contractors

  The single page to read first. What CMMC Level 1 is, who it applies to, what's actually required, what it costs, and the fastest honest path through it in 2026.

• DoD Cybersecurity Requirements: A Plain-English Guide for Non-Technical Business Owners

  You're not an IT person. You won a contract. The prime is asking weird questions. Here's exactly what they need, in English, without the acronym soup.

• CMMC vs NIST 800-171: The Difference Most Small Contractors Get Wrong (2026)

  CMMC and NIST 800-171 are not the same thing. The difference decides whether your weekend is 5 days of paperwork or a $50K assessment.

• The CMMC False Claims Act Risk: What's Real, What's Hype (2026)

  FCA exposure on CMMC is real — but not in the way most vendors describe it. Here's what actually triggers it at Level 1, and what doesn't.

• The 48 CFR CMMC Acquisition Rule: What Changes in Your DoD Contracts (2026)

  32 CFR 170 created CMMC. 48 CFR is the rule that puts it into your contract. Here's what to look for in the next solicitation that lands in your inbox.

• 32 CFR Part 170 Explained: The CMMC Program Rule in Plain English (2026)

  32 CFR Part 170 is the rule that made CMMC real. Here's exactly what it requires of a Level 1 contractor — without the legalese.

• How to Do CMMC Level 1 Yourself (Free, Complete Guide) — 2026

  CMMC Level 1 is self-assessed. You don't need a consultant. Here is the entire DIY path, with every template you'll need, written for the small defense contractors actually doing the work.

• The Free CMMC Level 1 SSP Template (Fill-in-the-Blank) — 2026

  Your SSP is the one document a prime will actually ask for. Here is the free template that gets you a defensible one in 60 minutes.

• CMMC Level 1 Scoping — How to Draw the Boundary (Free Worksheet) — 2026

  Treating the whole company as in-scope doubles your work for no compliance benefit. Here's the right way to scope CMMC Level 1.

• The 8 CMMC Level 1 Policies You Need (Free Templates) — 2026

  Eight one-page policies cover every CMMC Level 1 control. Here's the list, with free templates — no 40-page manual required.

• How to Post Your CMMC Affirmation to SPRS (Step by Step) — 2026

  Posting your SPRS affirmation is the action that makes you bid-ready. Here's the exact 8-step walkthrough.

• The CMMC Annual Affirmation: The One Thing That Breaks DIY Compliance — 2026

  Year-one DIY CMMC is easy. Year two is where most contractors quietly lose compliance. Here's how to not be one of them.

• The CMMC Level 1 Self-Assessment Checklist (Free, Printable PDF) — 2026

  Every CMMC Level 1 requirement, in plain English, on a printable page. No email gate. No upsell. Just the checklist.

• CUI vs FCI: What's the Difference? (With 12 Real Examples) — 2026

  FCI triggers CMMC Level 1. CUI triggers CMMC Level 2. Mix them up and you'll either over-spend by $20k or under-comply on a federal contract.

• DFARS 252.204-7012 vs CMMC: Which One Applies to Me? (2026 Guide)

  DFARS 7012 says 'protect CUI to NIST 800-171.' CMMC says 'prove it.' One is the rule. The other is the audit. Here's how they fit together.

• Do I Even Need CMMC? A 4-Question Decision Tree for 2026

  Half the small businesses asking about CMMC don't actually need it — and the other half need it more urgently than they realize. Four questions and you'll know where you stand.

• Just Won an SBIR Phase I? Here's Your CMMC Timeline (2026 Edition)

  Congrats on the Phase I award. Now the question that ambushes most founders: do you need CMMC to start work, or only at Phase II? The honest answer depends on what kind of data the agency hands you on day one.

• CMMC Level 1 Is Binary. There Is No Score. Here's What That Means.

  Level 1 isn't graded on a curve. Every one of the 15 requirements has to be MET — or the whole assessment fails. Here's how the rule actually works, and why that's good news for small contractors.

• What to Tell Your Prime When They Ask for Your SPRS Score (And You're Level 1)

  If your prime is asking for a 0–110 SPRS score and you're a Level 1 contractor, the answer is not zero. It's that you're a different tier of the regulation. Here's how to say that without losing the contract.

• What Is FCI? The 90-Second Definition That Decides Your CMMC Level (2026)

  FCI is the routine non-public information you handle under a federal contract. It's what triggers CMMC Level 1 — and it's almost certainly already in your inbox.

• CMMC Level 1 vs Level 2: Which One Do You Actually Need? (2026 Plain-English Guide)

  Most small defense contractors are Level 1, not Level 2 — but the wrong answer here costs you a year and tens of thousands of dollars. Here's the single question that decides it.

• CMMC Level 1: All 15 FAR Safeguarding Requirements Explained in Plain English (2026 Guide)

  Every CMMC Level 1 safeguarding requirement, in language a non-cybersecurity founder can act on — what each control means, what evidence satisfies it, and where teams trip up.

• How to Read Your SPRS Score (And What to Send When Your Prime Asks)

  Your prime just asked for your SPRS score. Here's what to send by Monday — including the exact email template and the math behind the number.

• FAR 52.204-21 vs NIST 800-171 vs CMMC Level 1 vs Level 2: A Plain-English Comparison

  Four overlapping frameworks, one decision: which one do you actually have to comply with? A side-by-side comparison for small DoD contractors.

• CMMC Level 1 Cost in 2026: DIY vs Consultant vs SaaS (Real Numbers)

  DIY says it's free. The consultant quote was $18,000. The SaaS bill is $249/mo. Here's the real math on each path through CMMC Level 1.