CMMC Level 1 Self-Assessment and SPRS: The 15 Requirements, Step by Step
Updated: 17 hours ago
A prime contractor just sent you a subcontract with FAR 52.204-21 in it. Or a contracting officer asked for your CMMC status before award. Either way, the question lands on someone who already has a full-time job: the owner, the office manager, or whoever "does the computers."
If your company holds Federal Contract Information, you need a CMMC Level 1 self-assessment every year, entered in the Supplier Performance Risk System (SPRS) and affirmed by a senior official. This post walks through what the 15 requirements mean in a small office, how to check yourself, exactly what goes into SPRS, and what you're actually signing.
THE SHORT VERSION
CMMC Level 1 means meeting all 15 FAR 52.204-21 safeguarding requirements for systems that hold Federal Contract Information. You self-assess every year, enter the result (level, date, scope, CAGE codes and result) in SPRS, and your Affirming Official affirms it. No POA&Ms, no partial credit, no numeric score.
Does CMMC Level 1 apply to you?
Level 1 is about Federal Contract Information (FCI). The FAR defines it as information "not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government." In a small shop, that usually means drawings, specifications, schedules, part lists or pricing a defense customer gave you, or that you created for them, that aren't public.
It doesn't include information the government has already made public, or "simple transactional information, such as necessary to process payments."
Subcontractors aren't off the hook. FAR 52.204-21 tells contractors to flow the clause down to subcontracts where FCI may sit on the subcontractor's systems. That's why the clause so often shows up in a prime's paperwork rather than a government contract.
One scope note: this post covers Level 1 only. If your contract or your prime asks for anything beyond Level 1, ask them exactly what's required before you start.
Step 1: Decide what's in scope
The rule puts in scope the systems that "process, store, or transmit FCI" (32 CFR 170.19). Think beyond computers. Scope covers the people who handle FCI, the technology they use, the facilities where they work, and outside providers who touch it, such as your IT provider and Microsoft 365.
For most 10-75 person firms, scope is simple to write down: the Microsoft 365 tenant, the laptops and desktops that sign in to it, any file server, and the office itself. Write that list down. You'll enter a description of it in SPRS, and it decides where every piece of evidence has to come from.
Step 2: Check yourself against the 15 requirements
Each requirement comes from FAR 52.204-21(b)(1)(i)-(xv). The wording below is shortened; the full text is on acquisition.gov.
# | Requirement (shortened) | What it means in a small office | Evidence to keep |
|---|---|---|---|
1 | Limit system access to authorized users, processes and devices | Named accounts only, no shared logins, and a list of company devices | User list export, device list |
2 | Limit access to the transactions and functions users are permitted to do | Staff aren't administrators; roles fit jobs | Admin role list |
3 | Verify and control connections to external systems | Written rules for personal devices and outside cloud apps, enforced where you can | Written policy, sign-in policy screenshot |
4 | Control information posted on publicly accessible systems | Named people post to the website and social media, with a review first | Posting procedure |
5 | Identify users, processes and devices | Every user and device has a unique name | Directory export |
6 | Authenticate users, processes and devices before allowing access | Passwords plus multi-factor authentication (MFA). The requirement is to authenticate; MFA is how we recommend doing it | MFA enforcement report |
7 | Sanitize or destroy media containing FCI before disposal or reuse | Wipe or shred old drives, laptops and USB sticks | Disposal log or destruction certificate |
8 | Limit physical access to systems, equipment and work areas | Locked office and a locked server or network closet | Key or badge list |
9 | Escort visitors, monitor visitor activity, keep physical access logs, and control physical access devices | Visitors sign in and are escorted; keys and badges are tracked | Visitor log, key and badge list |
10 | Monitor, control and protect communications at external and key internal boundaries | A managed firewall at the edge of your network | Firewall configuration and review record |
11 | Put publicly accessible systems on subnetworks separated from internal networks | Website hosted elsewhere; guest Wi-Fi kept apart from the office network | Simple network diagram |
12 | Identify, report and correct flaws in a timely manner | Operating systems and apps patched on a schedule | Patch report |
13 | Provide protection from malicious code at appropriate locations | Endpoint detection and response (EDR) on every computer | EDR console export |
14 | Update malicious code protection when new releases are available | Protection updates itself automatically | Console showing current versions |
15 | Run periodic scans, plus real-time scans of files from external sources as they're downloaded, opened or run | Scheduled and real-time scanning turned on | Scan policy screenshot |
How to mark each one: every requirement is MET, NOT MET or not applicable (N/A). N/A counts the same as MET. Evidence has to be real: the rule says "All evidence must be in final form and not draft" (32 CFR 170.24). To pass Level 1, every requirement must be MET.
Keep the evidence. The artifacts you used must be retained for six years from the CMMC Status Date (32 CFR 170.15).
Not sure how your office would mark these? Book a CMMC Level 1 readiness call or email sales@24unet.com.
Step 3: Enter your result in SPRS
The SPRS CMMC Level 1 Quick Entry Guide lays out the clicks. In order:
Get access. Request the "SPRS Cyber Vendor User" role through the Procurement Integrated Enterprise Environment (PIEE).
Open Cyber Reports in SPRS and pick your company's CAGE hierarchy. That hierarchy comes from SAM, so if it's wrong in SPRS, fix SAM first.
Go to CMMC Assessments and choose "Add New Level 1 CMMC Self-Assessment."
Enter the details: the CMMC level, the CMMC Status Date, a description of your assessment scope, every CAGE code in scope, and whether you meet the FAR 52.204-21 requirements.
Select "Continue to Affirmation."
Hand off if needed. If the person entering the data isn't the Affirming Official, use "Transfer to AO."
SPRS's own guide has the screenshots. Answering "No" on the FAR 52.204-21 question gives you "No CMMC Status," so don't enter anything until every requirement is MET.
24uNet prepares the evidence with you and can walk your team through the SPRS entry; your Affirming Official still affirms. Book a CMMC Level 1 readiness call or email sales@24unet.com.
Step 4: The affirmation (what you're actually signing)
The CMMC rule (32 CFR Part 170) defines the Affirming Official as "the senior level representative" responsible for the company's CMMC requirements with the authority to affirm for it. In a small firm, that's usually an owner or president.
What they sign says the company "has implemented and will maintain implementation of all applicable CMMC security requirements." Note the second half. It isn't a statement about one good day. It's a promise that the controls keep working.
When: after each self-assessment, and every year. SPRS treats a "Final Level 1 Self-Assessment" as expired after one year and changes it to "No CMMC Status (Expired Assessment)," so put the renewal date on the calendar the day you affirm.
Treat it like signing a tax return. Read what you're signing, know where the evidence is, and don't let anyone else click "Affirm" for you.
Is there an SPRS score for CMMC Level 1?
No. Level 1 is pass or fail. The rule says Level 1 results "are scored as MET or NOT MET in their entirety" (32 CFR 170.24). There are no points and no partial credit.
The numeric SPRS score people talk about comes from a different DoD assessment that isn't part of Level 1. If your prime asks for "your SPRS score," ask which assessment they mean. For Level 1, the answer is your status in SPRS and the date you affirmed it.
What managed security covers, and what stays with you
A good managed IT and security setup lines up with a large share of the 15 requirements. It doesn't do the whole job, and it can't sign for you.
Usually handled by your IT and security provider:
Named accounts, roles and a device list in Microsoft 365 (requirements 1, 2 and 5)
Authentication with MFA (6)
A managed firewall and a separate guest network (10 and 11). See our managed firewall and network security page.
Patching (12)
EDR with automatic updates and real-time scanning (13, 14 and 15)
Stays with your firm:
Physical access, locked doors and the visitor log (8 and 9)
Wiping or shredding old media, with a record (7)
Who posts what on public sites (4)
Rules for outside connections, which your provider can enforce but you have to decide (3)
The affirmation itself
Common Level 1 mistakes
Shared logins, such as one "shop" account on the floor PC.
No visitor log, or a log nobody fills in.
Old laptops given away or recycled with no wipe record.
A CAGE code in SPRS that doesn't match SAM.
Forgetting the annual renewal until a contract is on the line.
Treating help from a consultant as a "certification." DoD's Level 1 assessment guide says third-party help "is still considered a self-assessment and does not result in a certification."
Assuming MFA alone covers you. MFA is one of 15 requirements, and attackers have ways around weak MFA.
Frequently asked questions
How do I do a CMMC Level 1 self-assessment?
Scope the systems that hold FCI, check each of the 15 FAR 52.204-21 requirements against evidence, enter the result in SPRS, and have your Affirming Official affirm it. Repeat every year.
What is an SPRS score for CMMC Level 1?
There isn't one. Level 1 is scored MET or NOT MET in its entirety. The numeric SPRS score comes from a different DoD assessment.
How many requirements are in CMMC Level 1?
15, from FAR 52.204-21(b)(1)(i)-(xv).
Can I submit CMMC Level 1 with open items?
No. All requirements must be MET; POA&Ms aren't permitted for Level 1.
How long is a CMMC Level 1 self-assessment valid?
One year. SPRS changes an expired Final Level 1 Self-Assessment to "No CMMC Status."
Who can be the Affirming Official?
A senior representative responsible for the company's CMMC requirements with authority to affirm for the company.
How long do I keep Level 1 evidence?
Six years from the CMMC Status Date.
Does hiring a consultant make it a CMMC certification?
No. DoD says third-party help is still a self-assessment and doesn't result in a certification.
Want a second set of eyes before you affirm?
24uNet helps small defense suppliers get ready for CMMC Level 1: we go through the 15 requirements with you, point out what's missing, prepare the evidence with you, and can walk your team through the SPRS entry. Your Affirming Official still makes the call. Learn more about 24uNet's CMMC Level 1 readiness help.
No obligation. Written findings are yours to keep.
General information, not legal advice. Your contract and contracting officer determine which requirements apply.
Related reading: Why Every DoD Contractor Needs CMMC Level 1 Readiness.
ABOUT THE AUTHOR
Dane Gray, Cofounder, 24uNet. Certified Ethical Hacker (CEH), CompTIA Security+, Texas A&M University, 25+ years in IT. Dane leads CMMC Level 1 readiness, SEC exam prep for RIAs and broker-dealers, and independent security reviews for firms in Commerce City, CO 80022 and College Station, TX 77845. Connect with Dane on LinkedIn.
Last reviewed: October 2, 2026
Comments