CMMC Level 1 Guide Now Available: Interactive Self-Assessment Checklist for Small GovCon Contractors

Update (May 2026): The CMMC Level 1 Self-Assessment Guide is now officially available for purchase! If you're a small or mid-size government contractor handling Federal Contract Information (FCI), this is the practical tool you've been waiting for.

With Phase 1 of CMMC well underway, more DoD contracts are requiring Level 1 self-assessments and annual SPRS affirmations. Many small contractors are discovering that while Level 1 is achievable, figuring out exactly what to do, and how to document it properly, can be time-consuming and confusing. That’s why I created this interactive guide.

What Is CMMC Level 1?

CMMC Level 1 is the Foundational level designed for contractors who handle Federal Contract Information (FCI). It consists of 15 basic safeguarding practices taken directly from FAR 52.204-21. Unlike Level 2 (which involves 110 controls and potential third-party assessments), Level 1 is a self-assessment with these key requirements:

• All 15 practices must be fully implemented (MET)

• No POA&Ms are allowed

• Annual self-assessment + senior official affirmation in SPRS

Introducing the CMMC Level 1 Self-Assessment Guide

I built this as a practical, fillable workbook specifically for busy small GovCon owners and managers, not for large compliance teams.

What’s Included:

• Complete fillable checklists for all 15 Level 1 practices

• Every assessment objective clearly listed with plain-English explanations

• Dropdown status fields (Compliant / Not Compliant / In Progress)

• Evidence/Notes sections with real-world “e.g.” examples

• Assessment method tracking (Examine, Interview, Test)

• Responsible Party and Last Reviewed date fields

• Auto-calculated MET / NOT MET summary for each practice

• Summary notes section for scoping and evidence tracking

• Resources appendix with direct links to official DoD documents and SPRS

• Full instructions, acronyms guide, and legal notices

Perfect For:

• Small primes and subcontractors handling FCI

• Companies preparing for their first CMMC Level 1 assessment

• GovCon consultants supporting multiple clients

Why This Guide Helps You Succeed

Instead of struggling with the dense official DoD Assessment Guide, you get a clean, interactive tool that walks you through the process step-by-step. Save time, reduce overwhelm, and build strong documentation for your SPRS affirmation.

Ready to Get Compliant?

Buy the CMMC Level 1 Self-Assessment Guide Now: CMMC Level 1 Self-Assessment Guide & Interactive Checklist

Still Have Questions?

Feel free to reach out! I’m happy to answer questions about whether Level 1 applies to your business or how to get started. The clock is ticking on CMMC compliance in 2026. The contractors who get prepared now will have a major advantage when opportunities arise.Stay compliant and keep winning contracts.

_______________________________________________________________________________________

If you're a small or mid-size government contractor, even if you're just handling basic Federal Contract Information (FCI) like contract numbers, delivery schedules, or invoices, the Cybersecurity Maturity Model Certification (CMMC) program is no longer "coming soon." It's here, and non-compliance could quietly knock you out of the running for DoD contracts.

Phase 1 of the CMMC rollout kicked off on November 10, 2025, and as we move through 2026 (with Phase 1 active until November 9, 2026), more and more new DoD solicitations and contracts are including CMMC Level 1 self-assessment requirements. Contracting Officers are checking SPRS (Supplier Performance Risk System) status before awarding work. If your status isn't current or compliant, bids can be disqualified, payments delayed, or contracts lost to competitors who are ready.

The good news? For most small businesses handling only FCI (not CUI), Level 1 is straightforward. It requires just 15 basic safeguarding practices from FAR 52.204-21, an annual self-assessment, and a senior official affirmation in SPRS. There are no third-party auditors and no massive overhauls. But you still need to do it right, document it properly, and stay current.

Let's break it down so you can assess where you stand and why getting compliant now positions you ahead of the curve.

What Is CMMC, and Where Does Level 1 Fit?

CMMC 2.0 is the DoD's program to ensure contractors protect sensitive information in the Defense Industrial Base. It replaced the old DFARS 7012 self-attestation with structured levels:

• Level 1 (Foundational): For contractors handling Federal Contract Information (FCI) only. Requires annual self-assessment and affirmation of 15 basic practices. No POA&Ms allowed; everything must be fully implemented (MET).

• Level 2: For Controlled Unclassified Information (CUI). Involves 110 controls from NIST SP 800-171 Rev 2, with either self-assessment or third-party C3PAO certification (phasing in more heavily in Phase 2 starting November 2026).

• Level 3: Rare, high-priority programs only, builds on Level 2 with extra NIST 800-172 requirements.

  
  

If your work involves only FCI (common for many small primes and subs), Level 1 is your requirement in Phase 1. The DoD's phased approach gives breathing room. Phase 1 focuses on self-assessments, with full enforcement ramping up over three years (ending Phase 4 in late 2028). But waiting means risking eligibility when clauses appear in solicitations.

Why Level 1 Compliance Matters for Small GovCon Contractors in 2026

• Contract Eligibility: SPRS status is now a gatekeeper. Contracting Officers verify it during source selection. No current affirmation? You could be ineligible, even if technically capable.

• Bid Competitiveness: Competitors who complete self-assessments early are submitting affirmations and showing "Compliant" in SPRS, giving them the edge.

• Risk of Delays or Loss: Non-compliance can lead to payment holds, contract modifications requiring fixes, or outright exclusion. For small businesses, losing even one prime or subcontract can hurt cash flow.

• Future-Proofing: Level 1 builds good habits. If you ever handle CUI (or team with someone who does), you're already partway to Level 2 readiness.

• Low Barrier, High Reward: Level 1 is achievable with basic tools many small businesses already use: Active Directory for access control, Windows Defender for malware protection, simple policies for media disposal and physical access, firewall rules, and logs/screenshots for evidence.

  
  

What Level 1 Actually Requires

Level 1 maps directly to the 15 security requirements in FAR 52.204-21. They're grouped into six domains:

• Access Control (4 practices)

• Identification and Authentication (2)

• Media Protection (1)

• Physical Protection (2)

• System and Communications Protection (2)

• System and Information Integrity (4)

  
  

Examples include limiting system access to authorized users/devices, authenticating identities, sanitizing media before disposal, monitoring network boundaries, and protecting against malicious code.

The Process

1. Scope your systems handling FCI.

2. Implement the 15 practices (all must be MET, no partials).

3. Conduct an annual self-assessment using the official DoD CMMC Level 1 Assessment Guide (v2.13, September 2024).

4. Document evidence (policies, screenshots, logs, inventories).

5. Have a senior official affirm compliance annually in SPRS.

   
   

It's binary: compliant or not. But getting the evidence and documentation right is where many small teams stumble.

Common Challenges Small Contractors Face, and Quick Wins

• Scoping confusion: "Which systems count?" Start with anything that processes, stores, or transmits FCI.

• Evidence collection: "What does 'good' look like?" Screenshots of user lists, firewall rules, antivirus dashboards, disposal logs, etc.

• Time and know-how: Small teams often lack dedicated IT/security staff.

  
  

Quick Wins to Get Moving

• Inventory users/devices and enforce unique accounts plus strong passwords/MFA.

• Enable real-time antivirus and schedule scans.

• Document physical access (locks, visitor logs) and media disposal.

• Review firewall/proxy rules for boundary protection.

  
  

Get Ahead with Practical Help

To make Level 1 compliance easier for small GovCon businesses like yours, I'm finalizing an interactive CMMC Level 1 Self-Assessment Guide, a fillable PDF workbook with:

• Step-by-step checklists for all 15 practices and their assessment objectives

• Evidence examples and notes fields

• Status tracking (Compliant/Not Compliant/In Progress)

• Auto-calculated overall MET/NOT MET summaries

• Aligned to the official DoD guide and FAR

  
  

It’s designed for busy owners and managers: save progress, document everything for SPRS, and reduce the guesswork.

Stay Tuned & Take Action!

The guide will launch soon on this site! Complete the Service Inquiry form for first access, launch updates, and a special early-bird discount.

In the meantime:

• Download the official DoD CMMC Level 1 Assessment Guide here: https://dodcio.defense.gov/Portals/0/Documents/CMMC/AssessmentGuideL1v2.pdf

• Check SPRS for your current status: https://www.sprs.csd.disa.mil/

• Review DoD's CMMC homepage for the latest: https://dodcio.defense.gov/CMMC/

  
  

Questions about Level 1 or your specific setup? Drop a comment below or email me at allensolutionsllc746@gmail.com. Let's get your business compliant and contract-ready in 2026!

Thanks for reading, stay secure and keep winning those contracts!