Skip to main content

🔔 Notifications Hub: See compliance updates in one place

CMMC Level 1 Compliance Checklist

CMMC Level 1 self-assessment verifies that you've implemented 15 basic safeguarding requirements from FAR 52.204-21, using 59 assessment objectives derived from NIST 800-171A. A requirement is MET only when every objective is MET. There is no partial credit and no POA&M at this level. This checklist lists each requirement and associated objective(s) as written in the Department's official CMMC Level 1 Assessment Guide along with a plain-language statement of what you have to prove and examples of the evidence that proves it. This helps contractors handling Federal Contract Information (FCI) know what they are actually being asked to prove is in place before submitting their annual self-assessment and affirmation.

What you'll get:

  • All 15 Level 1 requirements and 59 assessment objectives, grouped into the six CMMC domains that can be tracked as MET, NOT MET, or NOT APPLICABLE
  • A plain-language statement of what you have to do and prove for every requirement
  • Examples of evidence that would support a MET finding, such as account lists, access reviews, firewall exports, and patch reports