CMMC Level 1 self-assessment walkthrough
CMMC Level 1 covers 15 basic safeguarding practices from FAR 52.204-21. Work through each one below, mark it in place or a gap, and finish with a gap list you can act on.
This free walkthrough covers all 15 CMMC Level 1 practices from FAR 52.204-21 in plain English, with what each one means for a one-person shop and what counts as evidence, plus the CUI tripwire that moves a shop from Level 1 to a Level 2 assessment.
What CMMC Level 1 actually requires
Under the CMMC rule (32 CFR Part 170), Level 1 applies when a contract handles Federal Contract Information (FCI) but not Controlled Unclassified Information (CUI). It has 15 practices, aligned to the basic safeguarding requirements in FAR 52.204-21. A Level 1 assessment is a self-assessment: your company works through the 15 practices, records what is in place, and affirms the assessment in SPRS, the system contracting officers check before award. No outside auditor is involved at Level 1. The assessment is annual, and it must be current when the contract is awarded.
The hinge question is CUI. If your work touches CUI, for example controlled technical data in defense drawings, Level 1 does not satisfy the requirement. That path is Level 2, which needs a third-party (C3PAO) assessment on a three-year cycle. See the CUI tripwire before you start.
Educational guide, not legal or compliance advice. Practice text is quoted from FAR 52.204-21. Confirm current requirements against the CMMC rule and your contract before you bid.
Your progress
0 of 15 reviewed. 0 in place, 0 gaps.
The 15 practices
(i) Only authorized people, programs, and devices get access
FAR 52.204-21(b)(1)(i): "Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems)."
What it means for a one-person shop: your computer requires a login. There are no guest or shared accounts that anyone can use.
What counts as evidence: a list of the user accounts on each work machine, every account named, logins required at startup.
(ii) Accounts can only do what they need to do
FAR 52.204-21(b)(1)(ii): "Limit information system access to the types of transactions and functions that authorized users are permitted to execute."
What it means for a one-person shop: you are the administrator on your own machine, and there are no extra administrator accounts sitting unused.
What counts as evidence: the account list with roles shown; unused privileged accounts removed or disabled.
(iii) Know and control your connections to outside systems
FAR 52.204-21(b)(1)(iii): "Verify and control/limit connections to and use of external information systems."
What it means for a one-person shop: write down every outside service that touches contract information: your email provider, cloud storage, the prime's portal. Use only those.
What counts as evidence: a simple list of the external systems and services used for contract work.
(iv) Keep contract information off public systems
FAR 52.204-21(b)(1)(iv): "Control information posted or processed on publicly accessible information systems."
What it means for a one-person shop: no FCI on your public website, in public file-share links, or on social media.
What counts as evidence: a short written rule for yourself, plus a check of your public postings.
(v) Every user, program, and device is identified
FAR 52.204-21(b)(1)(v): "Identify information system users, processes acting on behalf of users, or devices."
What it means for a one-person shop: your devices are inventoried: laptop, phone, printer, external drives. Each one has an owner, and that owner is you.
What counts as evidence: a device inventory list.
(vi) Prove who you are before you get in
FAR 52.204-21(b)(1)(vi): "Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems."
What it means for a one-person shop: strong passwords everywhere, screen locks on, and multi-factor authentication turned on wherever it is offered.
What counts as evidence: your password practice written down; MFA enabled on email and cloud accounts.
(vii) Wipe storage media before it leaves your hands
FAR 52.204-21(b)(1)(vii): "Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse."
What it means for a one-person shop: old hard drives, USB sticks, and memory cards get fully wiped before disposal, resale, or recycling.
What counts as evidence: a note of what was wiped, when, and how.
(viii) Lock the physical space
FAR 52.204-21(b)(1)(viii): "Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals."
What it means for a one-person shop: doors lock. Paper contract files go in a locking cabinet. Your PC cannot be used by visitors.
What counts as evidence: a description of the physical controls at your work location.
(ix) Visitors are escorted and logged
FAR 52.204-21(b)(1)(ix): "Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices."
What it means for a one-person shop: you walk visitors through your space. You keep a simple log of who visited and when. Keys and door codes are tracked, and codes change when someone should no longer have them.
What counts as evidence: a visitor log (a notebook counts) and a list of who holds keys or codes.
(x) Guard your network boundaries
FAR 52.204-21(b)(1)(x): "Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems."
What it means for a one-person shop: the firewall on your router and your computer is on. Remote access you did not set up is off. The router admin password is not the factory default.
What counts as evidence: firewall-on settings noted; router admin password changed from the default.
(xi) Keep public-facing systems off your work network
FAR 52.204-21(b)(1)(xi): "Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks."
What it means for a one-person shop: if you host anything public, like a website, it does not sit on the same network as your work PC. Guest WiFi is separate from work WiFi.
What counts as evidence: a short description of your network separation.
(xii) Find flaws, report them, fix them promptly
FAR 52.204-21(b)(1)(xii): "Identify, report, and correct information and information system flaws in a timely manner."
What it means for a one-person shop: your operating system and applications update automatically, and you do not ignore update prompts for weeks.
What counts as evidence: automatic updates enabled; your practice of applying updates promptly, written down.
(xiii) Run protection against malicious code
FAR 52.204-21(b)(1)(xiii): "Provide protection from malicious code at appropriate locations within organizational information systems."
What it means for a one-person shop: reputable antivirus or anti-malware software is installed and running on your work machines.
What counts as evidence: the product name, installed and active, on each work machine.
(xiv) Keep that protection up to date
FAR 52.204-21(b)(1)(xiv): "Update malicious code protection mechanisms when new releases are available."
What it means for a one-person shop: virus definitions and the antivirus program itself update automatically. You do not run a copy that expired last year.
What counts as evidence: automatic updates enabled for the protection software; subscription or license current.
(xv) Scan on a schedule, and scan everything from outside
FAR 52.204-21(b)(1)(xv): "Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed."
What it means for a one-person shop: scheduled full scans are turned on, and real-time scanning checks downloads, email attachments, and USB drives as they arrive.
What counts as evidence: the scan schedule plus real-time protection enabled.
Your gap list
Everything you marked as a gap appears here. Work it top to bottom, then come back and flip each one to in place.
- No gaps marked yet. Work through the checklist above.
What drives cost and timeline
Three things set the shape of a first Level 1 self-assessment for a small shop. First, your starting point: a shop that already runs passwords, antivirus, backups, and a locked space is mostly documenting. A shop starting from zero is implementing first. Second, whether you do it yourself or get guidance: the practices are plain enough to self-assess, and many one-person shops do, while a guided pass trades money for speed and confidence. Third, how many gaps the walkthrough finds: the assessment is the quick part, closing the gaps is the work. The assessment is annual, and it must be current in SPRS when the contract is awarded, so treat the evidence notes above as living documents, not a one-time exercise.
Want a guided pass?
AI Tech Pros runs private SPRS Readiness Sprints for defense contractors: a working session that maps your systems, assesses the 15 practices against your actual setup, and leaves you with a prioritized gap list. The walkthrough above is the free version of the first half.