# CMMC Level 1 in plain words

> What defense buyers mean by CMMC Level 1, the 15 basic safeguards, the yearly self-assessment, and other security terms you will see in notices.

Last verified October 2026. Page: https://victavio.com/learn/cmmc-level-1

If you want to sell to the Department of Defense, you will see "CMMC" in notices. CMMC stands for Cybersecurity Maturity Model Certification. It is the department's program for checking that contractors protect certain information. The department also uses the name Department of War.

This lesson covers Level 1, the level most small businesses meet first.

## What Level 1 protects

Level 1 protects Federal Contract Information. That is information that is not public and that the government gives you, or that you create for the government, under a contract. Emails about the work, drawings, schedules and reports can all count.

## The 15 basic safeguards

Level 1 uses the 15 basic safeguards in FAR 52.204-21. In plain words:

1. Only authorized people, and their approved devices, can use your systems.
2. Each person can do only what their job needs.
3. You control connections to outside systems, such as personal devices and cloud tools.
4. You control what gets posted on public websites.
5. You can tell who each user and device is.
6. Users prove who they are, for example with a password and a second sign-in step, before they get in.
7. You wipe or destroy devices and media that held contract information before you throw them out or reuse them.
8. Only authorized people can reach your equipment and work areas.
9. You escort visitors, keep a record of physical access, and control keys, badges and door codes.
10. You watch and protect the edges of your network, for example with a firewall.
11. Systems the public can reach sit apart from your internal network.
12. You find and fix flaws on time, for example by installing updates.
13. You use protection against malicious code.
14. You keep that protection updated.
15. You scan your systems regularly, and scan files when they are downloaded or opened.

## The yearly self-assessment

At Level 1, your business assesses itself:

- **All 15 must be met.** There is no partial credit and no plan to fix things later at this level.
- **You enter the result in SPRS,** the department's Supplier Performance Risk System.
- **A senior official of your business affirms it,** and you repeat the self-assessment and the affirmation every year.

Write down the date of your affirmation and set a reminder for next year. A "yes" with no date is not enough.

A false affirmation can expose your business to serious liability, including under the False Claims Act. Affirm only what is true.

## Where the program stands

CMMC requirements began appearing in defense contracts in November 2025, starting with self-assessments. In July 2026 the department suspended the next phase, which would have required third-party assessments for many Level 2 contracts, while it reviews the program. Level 1 and Level 2 self-assessments continue. Check the official CMMC page for the current status before you bid.

## Other security terms in notices

- **CMMC Level 2** protects Controlled Unclassified Information (CUI) and has 110 requirements. Do not upload CUI to Victavio or to any tool that is not approved for it.
- **A security clearance** is a government decision about a person. A company cannot sponsor its own facility clearance.
- **Public Trust and PIV cards** involve background checks and government ID cards. They are not clearances.
- **U.S. citizen or U.S. person rules, CJIS** (criminal justice information) and **ITAR** (export-controlled technical data) mean you must confirm each person who will work on the job.
- **FedRAMP** applies to cloud services. Hosting on a FedRAMP-authorized provider does not, by itself, make your own app or team compliant.

## Get help

Many APEX Accelerators offer free cybersecurity guidance to small businesses. Start with a simple written list of your systems, users and devices. It makes the self-assessment much easier.

## Official sources
- [FAR 52.204-21: Basic safeguarding of covered contractor information systems](https://www.acquisition.gov/far/52.204-21)
- [32 CFR Part 170: CMMC program](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170)
- [DoD CIO: CMMC](https://dodcio.defense.gov/CMMC/)
- [Supplier Performance Risk System (SPRS)](https://www.sprs.csd.disa.mil/)

This lesson is general information, not legal advice. Rules change. Check the official source before you act.
Victavio is a Kilobytez LLC product.
Not a government agency. SAM.gov registration is free.