‍CMMC Level 1 consists of 17 cybersecurity practices, often called controls, organized across 6 domains to protect Federal Contract Information (FCI). The six domains are Access Control (4 practices), Identification and Authentication (2), Media Protection (1), Physical Protection (4), System and Communications Protection (2), and System and Information Integrity (4). Those 17 practices come from the 15 basic safeguarding requirements in Federal Acquisition Regulation (FAR) clause 52.204-21, which is why some sources say Level 1 has 15 controls and others say 17.

The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense (DoD) program, which now also uses the name Department of War, that verifies how well defense contractors protect government information. In this article, we break down every CMMC Level 1 control, explain the 15 versus 17 question, cover who needs Level 1 and how the self-assessment works, compare Level 1 with Levels 2 and 3, and explain where CMMC stands after the July 2026 program changes.

How Many Controls Are in CMMC Level 1?

CMMC Level 1 has 17 controls, formally called security practices, spread across 6 of the 14 CMMC domains. Each Level 1 practice maps to a FAR 52.204-21 requirement and to a matching requirement in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, which is how DoD assessment guides number them.

The full set of CMMC Level 1 practices, what each one requires, and the kind of proof that shows it is in place, appears below.

The table shows that CMMC Level 1 is a mix of technical settings, written rules, and physical security. Several practices, like visitor logs and shredding, need no software at all. These 17 practices form the base of the larger CMMC program, and their count is the source of a common point of confusion.

Is CMMC Level 1 15 or 17 Controls?

CMMC Level 1 is both 15 and 17 controls, depending on how they are counted. The CMMC Program rule at 32 CFR 170.14 lists the 15 basic safeguarding requirements from FAR 52.204-21 word for word, and the CMMC Level 1 assessment checks those 15 requirements as 17 practices.

The difference comes from one FAR requirement. FAR 52.204-21(b)(1)(ix) asks contractors to escort visitors and monitor visitor activity, maintain audit logs of physical access, and control and manage physical access devices, all in one sentence. CMMC splits that single sentence into three separate practices, PE.L1-3.10.3, PE.L1-3.10.4, and PE.L1-3.10.5, which turns 15 requirements into 17 practices.

Law firm McDermott Will & Schulte notes that the original 2021 CMMC 2.0 model described the FAR requirements as 17 separate controls, while the final rule incorporates the 15 FAR requirements verbatim. The security work is identical either way. A contractor that meets all 17 practices meets all 15 FAR requirements, and the 17 practices sit inside a small set of domains.

How Many Domains Are in CMMC Level 1?

CMMC Level 1 has 6 domains: Access Control (AC), Identification and Authentication (IA), Media Protection (MP), Physical Protection (PE), System and Communications Protection (SC), and System and Information Integrity (SI). The full CMMC model has 14 domains, and the other 8 only come into play at Level 2.

Access Control, Physical Protection, and System and Information Integrity carry 4 practices each, which makes them the heaviest Level 1 domains. Every one of those domains exists to protect the same type of information.

What Is Federal Contract Information?

Federal Contract Information is information that is not intended for public release and that is provided by or generated for the government under a contract to develop or deliver a product or service. FAR 4.1901 defines FCI and excludes information the government releases to the public and simple transactional information, such as data needed to process payments.

FCI shows up in ordinary business files. Contract statements of work, delivery schedules, proposal details shared with a contracting officer, meeting notes with DoD staff, and emails about contract performance can all qualify as FCI. Because FCI is so broad, almost every company that holds a DoD contract handles some of it.

FCI protection is not new. Contractors have been subject to FAR 52.204-21 since 2016, and CMMC Level 1 adds a formal way to verify those same cybersecurity rules. The breadth of FCI also explains why Level 1 reaches so many companies.

Who Needs CMMC Level 1?

CMMC Level 1 is needed by every DoD contractor and subcontractor that processes, stores, or transmits Federal Contract Information but does not handle Controlled Unclassified Information (CUI). Contractors that handle CUI need CMMC Level 2, which already includes all 17 Level 1 practices.

Level 1 covers the largest group of defense suppliers. DoD estimates that 63% of the contractors affected by the CMMC rule will only be subject to CMMC Level 1, according to McDermott Will & Schulte's analysis of the final rule. Machine shops, parts suppliers, construction firms, janitorial and facilities contractors, and small service providers commonly fall into Level 1.

Level 1 flows down through the supply chain. A prime contractor must pass the CMMC requirement to any subcontractor that will handle FCI, so a small supplier can need Level 1 without ever signing a contract with DoD directly. Each Level 1 contractor then has to meet the same 17 practices, starting with Access Control.

What Are the CMMC 2.0 Level 1 Controls?

The CMMC 2.0 Level 1 controls are 17 basic safeguarding practices that limit who can access company systems, verify every user, destroy old media, lock down physical spaces, protect network boundaries, and keep systems patched and free of malware. Each domain below explains what its practices require in plain terms.

Access Control (AC): 4 Practices

Access Control practices decide who can get into company systems and what they can do once inside. AC.L1-3.1.1 limits system access to authorized users, processes, and devices, and AC.L1-3.1.2 limits each user to the functions their job requires, so a shop floor employee does not have administrator rights.

Access Control also covers connections and public content. AC.L1-3.1.20 requires contractors to verify and control connections to external systems, such as personal phones, home computers, and outside cloud services. AC.L1-3.1.22 requires a review process so FCI never appears on a public website or social media page.

Access control applies to doors as well as data, and a sound access control system supports both the AC and PE domains. Limiting access only works when the company knows exactly who each user is, which leads to the next domain.

Identification and Authentication (IA): 2 Practices

Identification and Authentication practices make sure every person and device is known and verified before gaining access. IA.L1-3.5.1 requires a unique identity for every user, process, and device, which rules out shared logins like a single "office" account. IA.L1-3.5.2 requires the company to authenticate those identities, usually with a password, before granting access.

Stolen credentials make this domain critical. Stolen credentials were the top initial attack vector in the Verizon Data Breach Investigations Report, accounting for 22% of breaches, and Microsoft research found that multi-factor authentication blocks 99.9% of account compromise attacks.

CMMC Level 1 does not strictly require multi-factor authentication, but it remains one of the strongest ways to meet IA.L1-3.5.2. Digital identity is only part of the job, because FCI also lives on physical media.

Media Protection (MP): 1 Practice

Media Protection has one Level 1 practice: MP.L1-3.8.3 requires contractors to sanitize or destroy any media containing FCI before disposal or reuse. Media includes paper printouts, hard drives, USB drives, laptops, phones, and copier hard drives.

Media Protection is often the easiest Level 1 practice to meet. A cross-cut shredder for paper, a documented wipe process for drives being reused, and destruction certificates from a disposal vendor cover most needs. Protecting media also connects to protecting the rooms where that media sits.

Physical Protection (PE): 4 Practices

Physical Protection practices keep unauthorized people away from systems and equipment that hold FCI. PE.L1-3.10.1 limits physical access to authorized individuals, which usually means locked server closets, locked offices, and controlled building entry.

The other three Physical Protection practices come from the single FAR requirement that CMMC splits apart. PE.L1-3.10.3 requires escorting visitors and monitoring their activity, PE.L1-3.10.4 requires audit logs of physical access, such as a visitor sign-in sheet, and PE.L1-3.10.5 requires control of keys, badges, and lock codes, including collecting them when employees leave.

Physical Protection shows why CMMC Level 1 reaches beyond the IT department. Office managers and facilities staff often own these four practices, while the next domain belongs firmly to the network.

System and Communications Protection (SC): 2 Practices

System and Communications Protection practices guard the edges of the company network. SC.L1-3.13.1 requires monitoring, controlling, and protecting communications at external boundaries and key internal boundaries, which a properly configured firewall handles for most small businesses.

SC.L1-3.13.5 requires separating publicly accessible systems, such as a company web server, from internal networks. Many small contractors meet this practice by hosting their website with an outside provider, so the public site never touches the internal network. Protected boundaries keep threats out, and the final domain deals with threats that still get in.

System and Information Integrity (SI): 4 Practices

System and Information Integrity practices keep systems patched and free of malicious code. SI.L1-3.14.1 requires identifying, reporting, and correcting system flaws in a timely manner, which means applying security updates on a regular schedule through disciplined patch management.

The other three SI practices focus on malware. SI.L1-3.14.2 requires protection from malicious code, SI.L1-3.14.4 requires keeping that protection updated when new releases are available, and SI.L1-3.14.5 requires periodic scans of systems plus real-time scans of files as they are downloaded, opened, or run.

Modern endpoint protection tools meet all three malware practices at once when they are installed on every device and set to update automatically. Once all six domains are in place, the contractor still has to prove it.

Can You Self Certify CMMC Level 1?

Yes, you can self certify CMMC Level 1, because Level 1 uses an annual self-assessment instead of a third-party audit. A senior company official must then affirm the result in the Supplier Performance Risk System (SPRS), and that affirmation carries legal weight.

The CMMC Level 1 self-assessment follows these steps:

1. Define the assessment scope by identifying every system, person, facility, and outside service provider that processes, stores, or transmits FCI.
2. Assess each of the 17 practices against the assessment objectives in the DoD CMMC Level 1 Assessment Guide, which uses NIST SP 800-171A methods.
3. Gather evidence for each practice, such as account lists, firewall settings, visitor logs, and patch records.
4. Score each practice as MET, NOT MET, or NOT APPLICABLE, and fix anything NOT MET before finishing.
5. Enter the results in SPRS, including the assessment date, scope, Commercial and Government Entity (CAGE) codes, and the overall MET result.
6. Have the senior official responsible for compliance submit an affirmation in SPRS.
7. Repeat the self-assessment and affirmation every year.

The affirmation is the step that deserves the most care. McDermott Will & Schulte warns that inaccurate affirmations create risk under the False Claims Act, so leadership should confirm the self-assessment reflects reality before signing. Contractors that want an expert check before affirming often bring in CMMC compliance support for the assessment itself. That support matters even more because Level 1 allows no partial credit.

Can You Use a POA&M for CMMC Level 1?

No, you cannot use a POA&M for CMMC Level 1. A Plan of Action and Milestones lets Level 2 contractors close some gaps after an assessment, but Level 1 does not allow one, so all 17 practices must be fully met at the time of the self-assessment.

The no-POA&M rule makes Level 1 a strict pass or fail standard. A single NOT MET practice makes the entire self-assessment NOT MET, and the company cannot affirm compliance until it fixes the gap. Contractors used to tracking open items in a POA&M for other frameworks need to close every Level 1 item first, which is the biggest factor in how long Level 1 takes.

How Long Does CMMC Level 1 Take?

CMMC Level 1 takes anywhere from a few weeks to a few months, depending on how many of the 17 practices a company already meets. DoD does not publish an official timeline, because the time depends on the contractor's starting point.

Three factors drive the Level 1 timeline: the number of gaps to fix, the size of the FCI scope, and how much documentation already exists. In our work with contractors, companies that already use individual user accounts, endpoint protection, and a managed firewall usually spend most of their time documenting evidence, while companies with shared accounts or unpatched systems spend more time on remediation. Level 1 is also the foundation for every higher CMMC level.

What Is the Difference Between CMMC Level 1 and Level 2?

The difference between CMMC Level 1 and Level 2 is that Level 1 protects Federal Contract Information with 17 practices and an annual self-assessment, while Level 2 protects Controlled Unclassified Information with 110 practices and either a self-assessment or a third-party assessment every three years. The main differences include:

• Information protected: Level 1 covers FCI, and Level 2 covers CUI, which is more sensitive information such as technical drawings and export-controlled data.
• Number of practices: Level 1 has 17 practices across 6 domains, and Level 2 has 110 practices across 14 domains.
• Source standard: Level 1 comes from FAR 52.204-21, and Level 2 comes from NIST SP 800-171 Revision 2.
• Assessment: Level 1 always uses an annual self-assessment, and Level 2 uses either a self-assessment or a CMMC Third-Party Assessment Organization (C3PAO) assessment every three years, plus annual affirmations.
• Scoring: Level 1 is pass or fail with no POA&M, and Level 2 uses a scored assessment that allows a POA&M for certain gaps when the score reaches at least 80%.
• Documentation: Level 2 requires a formal System Security Plan, while Level 1 relies on evidence for each practice.

DoD's own cost model reflects that gap in effort. DoD estimated a Level 1 self-assessment and affirmation at $5,977 per year for a small business, compared with $104,670 for a small business's Level 2 certification assessment cycle, figures that assume the security practices are already in place. The jump in practices is the biggest single difference.

How Many Controls Are in CMMC 2.0 Level 2?

CMMC 2.0 Level 2 has 110 controls, matching the 110 security requirements in NIST SP 800-171 Revision 2. Those 110 controls include all 17 Level 1 practices plus 93 more, so a Level 2 contractor automatically covers Level 1.

Level 2 builds directly on the Level 1 domains and adds new ones. The 110 requirements come straight from the same standard behind NIST SP 800-171 compliance, and they spread across all 14 CMMC domains.

What Are the 110 CMMC Controls?

The 110 CMMC controls are the NIST SP 800-171 Revision 2 security requirements, organized into 14 domains: Access Control (22), Awareness and Training (3), Audit and Accountability (9), Configuration Management (9), Identification and Authentication (11), Incident Response (3), Maintenance (6), Media Protection (9), Personnel Security (2), Physical Protection (6), Risk Assessment (3), Security Assessment (4), System and Communications Protection (16), and System and Information Integrity (7).

The six Level 1 domains grow at Level 2. Access Control grows from 4 to 22 practices, System and Communications Protection from 2 to 16, and Identification and Authentication from 2 to 11, with new requirements such as multi-factor authentication for privileged and network access. Eight entirely new domains, including Incident Response and Audit and Accountability, also appear at Level 2, and one more level sits above it.

Is There a CMMC Level 3?

Yes, there is a CMMC Level 3, and it covers contractors that support DoD's most sensitive programs. Level 3 requires all 110 Level 2 controls plus 24 selected requirements from NIST SP 800-172, for a total of 134 requirements.

Level 3 has the strictest assessment path. The Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) conducts Level 3 assessments every three years, and a contractor must hold a final Level 2 certification before a Level 3 assessment can begin. Both Level 3 and Level 2 third-party assessments were directly affected by the 2026 program changes.

Is CMMC Still Required in 2026?

Yes, CMMC is still required in 2026, and CMMC Level 1 self-assessments remain in force in DoD contracts. The Department of War suspended only the next phase of the rollout, which would have required third-party Level 2 certifications.

The CMMC timeline moved quickly. DoD published the CMMC Program rule on October 15, 2024, published the acquisition rule that puts CMMC into contracts on September 10, 2025, and began Phase 1 on November 10, 2025, requiring Level 1 or Level 2 self-assessments as a condition of award. Phase 2, which would have required Level 2 C3PAO certification, was scheduled for November 10, 2026.

On July 13, 2026, the Department of War suspended the Phase 2 transition and all pending implementation milestones, and it created a CMMC Reform Task Force for a 60-day review. The Department's Chief Information Officer pointed to an assessment bottleneck, with more than 100,000 companies needing assessment and roughly 100 C3PAOs to assess them. The task force's request for industry input drew about 1,100 responses totaling more than 11,000 pages.

The suspension did not touch Level 1. Level 1 self-assessments, Level 2 self-assessments, SPRS affirmations, FAR 52.204-21, and DFARS 252.204-7012 all remain in effect, so contractors handling FCI must still meet all 17 practices to win new awards. Contractors following the latest CMMC requirements should expect changes to the higher levels, not to the Level 1 basics.

Here in Huntsville, Alabama, where many small suppliers support Redstone Arsenal programs, we have seen some contractors pause their CMMC work after the July announcement. Level 1 practices are the right work to continue, because they are required today and form the base of whatever framework comes next.

Frequently Asked Questions

How Much Does CMMC Level 1 Cost?

CMMC Level 1 costs an estimated $5,977 per year for a small business and $4,042 per year for a larger business to complete the self-assessment and affirmation, according to DoD's cost analysis in the CMMC Program final rule. Those estimates assume the 17 practices are already in place, so companies that need new firewalls, endpoint protection, or physical security upgrades will spend more on remediation.

Does CMMC Level 2 Require an Audit?

CMMC Level 2 requires an audit by a C3PAO only when the contract calls for Level 2 certification; other Level 2 contracts allow a self-assessment every three years. As of the July 2026 suspension, DoD paused new C3PAO requirements in solicitations while the CMMC Reform Task Force completes its review, and Level 2 self-assessments remain in effect.

How Difficult Is CMMC Certification?

CMMC certification difficulty depends on the level. Level 1 is the most manageable, with 17 basic practices that many small businesses can meet with sound IT hygiene, but its pass or fail rule means every practice must be met. Level 2 is significantly harder, with 110 controls, formal documentation, and a scored assessment.

What Happens If You Fail a CMMC Level 1 Self-Assessment?

If you fail a CMMC Level 1 self-assessment, the result is NOT MET and you cannot affirm compliance in SPRS until every gap is fixed. Without a current MET result and affirmation, a contractor is not eligible for new DoD awards that require Level 1, so the practical step is to remediate the gaps and complete the self-assessment again. Many contractors close those gaps with a government contractor compliance partner.

What Is SPRS?

SPRS is the Supplier Performance Risk System, the DoD database where contractors record their CMMC self-assessment results and annual affirmations. Contracting officers check SPRS to confirm a contractor holds the required CMMC status before awarding a contract.

What It All Comes Down To

CMMC Level 1 has 17 practices across 6 domains, built from the 15 basic safeguarding requirements in FAR 52.204-21, and every one of them must be met to pass. The practices cover account control, individual logins, media destruction, physical security, firewall protection, patching, and malware defense. Contractors prove compliance through an annual self-assessment and a senior official's affirmation in SPRS, and the July 2026 suspension of Phase 2 did not change any of that.

For most DoD suppliers, Level 1 is both the requirement they face today and the foundation for any higher level they may need tomorrow. Our team, led by Certified CMMC Assessors, helps North Alabama contractors scope their FCI, close gaps, gather evidence, and prepare affirmations they can sign with confidence.

At Interweave Technologies, we help defense contractors build CMMC compliance that holds up year after year.

Contractors with questions about CMMC Level 1 or their current SPRS status are welcome to reach out for a conversation.

‍