Who needs Level 1
If your contract includes FAR 52.204-21 and you receive or create information that isn't public, such as pricing, schedules, statements of work or delivery details, you handle Federal Contract Information (FCI). If none of it is CUI, Level 1 applies. Many small suppliers, distributors and service firms in the defense supply chain fall here.
The 15 requirements, in plain terms
- Access control: only authorized people and devices get in, each person has only the access they need, outside connections are controlled, and nothing non-public is posted publicly.
- Identification and authentication: every user and device is identified, and logins are verified.
- Media protection: drives and paper that held FCI are sanitized or destroyed before disposal.
- Physical protection: facility access is limited, visitors are escorted and logged, and physical access devices are managed.
- System and communications protection: traffic at the network boundary is monitored and controlled, and public-facing systems are separated from internal ones.
- System and information integrity: flaws are patched on time, malware protection is in place and kept updated, and files are scanned.
What makes Level 1 go wrong
The requirements are basic, but the details trip people up. Common gaps include shared logins on shop-floor PCs, no record of who visited the building, old laptops thrown away without wiping, guest Wi-Fi on the same network as the office, and patching that depends on someone remembering. Each one means an affirmation that isn't accurate.
How we handle it
- Confirm that Level 1 is the right level, and that no CUI is hiding in your email or file shares.
- Check all 15 requirements and fix the gaps: user accounts, MFA, patching, endpoint protection, firewall rules and network separation.
- Write short, readable policies and a basic System Security Plan, so your affirmation rests on documents that match reality.
- Walk your senior official through the annual self-assessment and SPRS affirmation.
- Optionally, keep it current with managed IT and an annual re-check before each affirmation.
Questions about cmmc level 1
How long does Level 1 take?
For most small contractors, four to eight weeks from assessment to affirmation, depending on how many fixes are needed.
Is Level 1 a one-time thing?
No. The self-assessment and senior-official affirmation are repeated every year, and controls have to stay in place between affirmations.
