CMMC LEVEL 1
CMMC Level 1 Readiness for Small Defense Contractors
Protect Federal Contract Information, pass your annual self-assessment, and affirm it in SPRS with confidence.
If your company holds Federal Contract Information (FCI) on a DoD contract or subcontract, CMMC Level 1 asks you to meet 15 basic safeguarding requirements, self-assess every year and affirm the result in the Supplier Performance Risk System (SPRS).
24uNet can help small defense contractors and subcontractors in Colorado and Texas get ready for CMMC Level 1 and stay ready, without turning it into a project that swallows the quarter.
THE SHORT VERSION
CMMC Level 1 applies to contractors that handle Federal Contract Information. You must meet all 15 FAR 52.204-21 requirements (no partial credit, no POA&Ms), self-assess every year, enter the result in SPRS and have a senior official affirm it. 24uNet can help you scope, close gaps, gather evidence and prepare the SPRS entry.
What CMMC Level 1 requires
• The 15 requirements in FAR 52.204-21, all of them MET. Results are scored as MET or NOT MET in their entirety, and no POA&Ms are permitted for CMMC Level 1.
• An annual self-assessment, with the result entered in SPRS.
• An annual affirmation by your Affirming Official, the senior person with authority to affirm for the company.
Keep your assessment evidence for six years. Level 1 is a self-assessment. Help from a provider like 24uNet doesn't make it a certification, and we won't call it one.
See the 15 requirements, step by step.
The 15 requirements, in plain English
Access control (4): Only authorized people and devices get in; people only do what their role needs; connections to outside systems are controlled; you control what gets posted publicly.
Identification and authentication (2): Know who every user and device is, and verify them before access.
Media protection (1): Wipe or destroy drives and media with FCI before disposal or reuse.
Physical protection (2): Limit physical access; escort visitors, log physical access, and manage keys and badges.
System and communications protection (2): Monitor and protect your network boundary; keep public-facing systems separated from the internal network.
System and information integrity (4): Find and fix flaws in a timely manner; run malware protection; keep it updated; scan regularly and scan files as they're downloaded or opened.
How 24uNet can help you get Level 1 ready
Step 1: Level 1 gap check and documentation
• Scope where FCI lives: people, systems, facilities and outside providers.
• Check each of the 15 requirements against real evidence.
• Write the policies and procedures your team will actually follow.
• Fix what's missing, with hands-on remediation help.
• Optional: a System Security Plan (SSP). Level 1 doesn't require one, but a short written description of how you meet each requirement makes the yearly self-assessment easier. Contact us for pricing.
Step 2: Your SPRS entry and affirmation
• We can help with your SPRS entry, from a walkthrough to preparing it with you: the level, the assessment scope, your CAGE code(s) and the result.
• We explain exactly what your Affirming Official is attesting to. Your Affirming Official affirms it; we don't affirm for you.
Step 3: Year-round upkeep
• 24/7 security monitoring of your devices and Microsoft 365 accounts.
• Annual self-assessment support against the 15 requirements.
• A reminder before your affirmation is due, so your status doesn't lapse. A Level 1 self-assessment in SPRS expires after one year.
• Quarterly reviews and vCISO-level leadership included.
One place for your Level 1 evidence
Organized evidence and policies
Keep clear, dated records of how you meet each of the 15 Level 1 requirements, ready for your annual self-assessment.
Level 1 templates and questionnaires
Questionnaire-based templates for the 15 Level 1 requirements, so gaps show up early.
Evidence from your existing tools
Connections to your security tools and IT systems gather evidence automatically, so your team spends less time on screenshots.
Framework mapping
Map the work you already do to CMMC Level 1 and to the frameworks your insurer or clients ask about, such as CIS Controls IG1, so you don't do it twice.
Dashboards and reports
Plain-English visibility into where each requirement stands, with owner-level reports long after the first project.
Where the Security Baseline lines up with Level 1
Many of the 15 requirements line up with controls 24uNet can run for you under our Security Baseline: MFA for authentication; managed endpoint protection for malware protection, updates and scanning; patching on an agreed schedule for flaw remediation; and a managed firewall with segmentation for boundary protection and keeping public systems separate. See managed firewall and network security and account takeover detection.
These line up with Level 1. They don't make you meet it on their own: physical controls and media disposal stay your firm's job, and we can give you written guidance for them.
PRICING
Why work with 24uNet on Level 1
Plain English
Owner-level explanations of every requirement, with no acronym soup.
Security first, not paperwork first
We can run the controls and monitor them 24/7, so they aren't just written down.
One team
The same team that can run your IT does the Level 1 work. Led by Dane Gray, CEH, CompTIA Security+.
Who this is for
Small defense contractors and subcontractors, including engineering, manufacturing and professional services firms, in the Denver metro, Colorado Springs and the Front Range, and in Bryan-College Station. See engineering firm IT and security.
24uNet's CMMC service covers Level 1. If your contract asks for more than Level 1, check with your prime or contracting officer first.
CMMC Level 1 questions
What is CMMC Level 1?
The CMMC level for contractors that handle Federal Contract Information. It requires the 15 basic safeguarding requirements in FAR 52.204-21, an annual self-assessment and an annual affirmation in SPRS.
Is CMMC Level 1 a certification?
No. It's a self-assessment. DoD's Level 1 guide says getting help from a third party "is still considered a self-assessment and does not result in a certification."
How often do I have to do a CMMC Level 1 self-assessment?
Every year. A Final Level 1 Self-Assessment in SPRS expires after one year.
Can I use a POA&M for CMMC Level 1?
No. All 15 requirements must be MET. The CMMC rule (32 CFR 170.15) says "No POA&Ms are permitted for CMMC Level 1."
Who signs the SPRS affirmation?
Your Affirming Official: the senior person responsible for CMMC who has authority to affirm for the company (32 CFR 170.22). 24uNet can help you prepare; we don't affirm for you.
Is CMMC still required?
DoD's CMMC page states that self-assessment requirements remain in place. Check the DoD CIO CMMC page for the current status.
Do small businesses need CMMC Level 1?
If your DoD contract or subcontract includes the CMMC Level 1 requirement and you handle FCI, yes, regardless of size.
Get your Level 1 readiness check
Book a CMMC Level 1 readiness call
Or email sales@24unet.com.
No obligation. Written findings are yours to keep.
General information, not legal advice. Your contract and contracting officer determine which CMMC level applies.
About the author
Dane Gray, Cofounder, 24uNet
30+ years in IT and cybersecurity. CEH, CompTIA Security+. Dane leads 24uNet's CMMC Level 1 readiness work and independent security reviews.
Last reviewed: October 2, 2026
