The answer in 50 words
There is no third-party CMMC Level 1 certificate. Level 1 is satisfied by an annual self-assessment of the 15 FAR 52.204-21 requirements and a senior-official affirmation posted in SPRS. That affirmation — not a paper certificate — is your proof. Formal C3PAO certificates apply only to most CMMC Level 2 work.
Why people search for “CMMC Level 1 certification”
It is a reasonable thing to search — primes and contracting officers often ask contractors to “be CMMC certified.” But at Level 1 the word certification is misleading. There is no exam, no assessor visit, and no certificate issued by an outside body. Level 1 is self-assessed and self-affirmed. Your authoritative record of compliance is the senior-official affirmation posted in the Supplier Performance Risk System (SPRS).
That distinction matters: it means you can achieve Level 1 status on your own timeline, without paying a C3PAO assessment fee — the cost and gatekeeping that come with Level 2.
How to get “certified” at Level 1
- Step 1Confirm Level 1 applies to you
Verify your contract includes FAR 52.204-21 and that you handle Federal Contract Information (FCI) but not CUI. If you handle CUI, you need Level 2, which does involve a third-party certificate.
Deep dive → - Step 2Implement the 15 safeguarding requirements
Meet all 15 FAR 52.204-21 requirements. Most are configuration of tools you already use — MFA, anti-malware, access control, patching, media disposal, physical access.
Deep dive → - Step 3Complete the annual self-assessment
Assess each requirement MET or NOT MET against the NIST 800-171A objectives, collect evidence, and document a System Security Plan. All 15 must be MET — no POA&M is allowed at Level 1.
Deep dive → - Step 4Have a senior official affirm and post in SPRS
A senior official signs the affirmation, accepting personal responsibility under 32 CFR § 170.22, and posts it in SPRS through PIEE. That posted affirmation is your proof of Level 1 status — the closest thing to a 'certificate.'
Deep dive → - Step 5Renew every 12 months
Re-assess and re-affirm annually. There is no certificate that sits on the wall for three years — Level 1 status is the current affirmation in SPRS, kept up to date each year.
Deep dive →
CMMC Level 1 Certification: FAQ
Is there a CMMC Level 1 certificate?
No. CMMC Level 1 does not produce a third-party certificate. Level 1 is satisfied by an annual self-assessment and a senior-official affirmation posted in the Supplier Performance Risk System (SPRS). The posted affirmation — not a paper certificate — is your proof of compliance. A formal certificate from a C3PAO applies only to most CMMC Level 2 assessments.
How do I get CMMC Level 1 certified?
Implement the 15 FAR 52.204-21 safeguarding requirements, complete an annual self-assessment marking each requirement MET, document a System Security Plan, have a senior official affirm the result, and post that affirmation in SPRS. There is no exam and no outside assessor at Level 1 — you certify yourself.
Who issues CMMC Level 1 certification?
No one issues it — you self-affirm. Unlike Level 2, where a CMMC Third-Party Assessment Organization (C3PAO) conducts the assessment, Level 1 is entirely self-assessed. Your senior official's affirmation in SPRS is the authoritative record that you meet the requirements.
How much does CMMC Level 1 certification cost?
There is no government fee to post the affirmation. Real costs are time and tooling: doing it yourself is $0 cash plus 20–40 hours; a consultant runs $6,000–$18,000; guided software like Custodia is $249/month with a 7-day free trial. Because Level 1 is self-assessed, you do not pay a C3PAO assessment fee.
How long is CMMC Level 1 certification valid?
The self-assessment and affirmation must be renewed every 12 months. There is no multi-year certificate at Level 1 — your status is the current annual affirmation in SPRS, which you refresh each year.
What's the difference between Level 1 and Level 2 certification?
Level 1 is self-assessed and self-affirmed annually for Federal Contract Information (FCI) — no certificate, no outside assessor. Level 2 covers Controlled Unclassified Information (CUI), requires meeting 110 NIST SP 800-171 controls, and for most contracts requires a C3PAO assessment that produces a formal certification valid for three years.
Get to a posted SPRS affirmation in a week
Custodia walks you through the 15 requirements, drafts your SSP and affirmation, and gets you ready to post in SPRS — the real proof of CMMC Level 1 status. 7-day free trial, no credit card.