CMMC Level 1
The 17 foundational safeguarding practices for Federal Contract Information, mapped to FAR 52.204-21, with an annual self-assessment tracker.
What CMMC Level 1 is
CMMC Level 1 is the entry tier of the Department of Defense's certification programme, and it applies far more broadly than Level 2: any contractor whose systems touch Federal Contract Information, not just Controlled Unclassified Information, is in scope. Its practice set maps directly to the fifteen basic safeguarding requirements in FAR clause 52.204-21, which DoD's CMMC programme breaks out into seventeen discrete practices across six security domains.
The requirements are the fundamentals — who can access a system, whether accounts are authenticated, whether visitors are escorted, whether malicious code protection is current. Nothing here requires a formal security programme; it is the baseline every organisation handling government information is expected to already do.
CMMC requirements are appearing as clauses in some DoD solicitations following the 48 CFR rule that took effect on November 10, 2025, which established a three-year phased structure for later requirements. As of 2026-09-15, DoD had paused the later CMMC phase-in milestones (since 2026-07-13) with no resumption date announced. The CMMC acquisition rule (48 CFR) took effect on 10 November 2025, establishing a three-year phased structure for when CMMC requirements can appear in DoD solicitations. Rollout timing for later phases is not fixed and can change — check current DoD CIO guidance before relying on a specific date.
Level 1 is always a self-assessment — there is no third-party or government-led option at this tier, but there is also no partial credit: every practice has to be in place before the annual self-assessment is affirmed in SPRS.
Who it applies to
- Any contractor or subcontractor whose information systems process, store or transmit Federal Contract Information, regardless of contract size.
- Small and mid-size suppliers in the defence industrial base who do not handle CUI and so are not obligated to Level 2.
- Organisations using Level 1 as the on-ramp before a later contract requires Level 2.
How it is structured in CMDash
CMDash seeds all seventeen Level 1 practices across the six FAR 52.204-21 domains, tracked with the same control-assessment workflow as every other seeded framework — no separate scoring engine, because Level 1 has none: DoD's methodology treats it as a flat pass/fail self-assessment.
| Access Control | 4 |
| Identification & Authentication | 2 |
| Media Protection | 1 |
| Physical Protection | 4 |
| System & Communications Protection | 2 |
| System & Information Integrity | 4 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
The control text
Controls carry their identifier, title, and CMDash’s own evidence-requirement guidance. No verbatim source text is bundled for this framework. If you hold the official document, you can load its text through the framework CSV import.
What CMDash does for CMMC Level 1
- Per-practice tracking (met / partial / not met) using the same assessment workflow every other framework in CMDash uses, with the generic per-framework progress and gap counts available immediately once the framework is enabled.
- A tenant-level setting for which CMMC level the program is pursuing, so a Level 1 contractor sees Level 1 tracking by default instead of being shown Level 2's much larger practice set.
- The regulatory radar tracks the CMMC 2.0 programme as a dated entry, including its phase-in under the 48 CFR rule, so programme milestones and your Level 1 control state sit in the same view.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to CMMC Level 1’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Depth: how controls are evidenced
Control counts
17 controls in 6 groups, read from the same public control catalog that powers the CMMC Level 1 control library. Identifiers and titles only; the text is licensed. 17 have at least one seeded crosswalk to another framework.
How controls are mapped to evidence
CMDash ships mapping suggestions, each a connector and a data type for one control, with the condition it is meant to check. A suggestion appears once a matching connector is connected and applies only when you accept it.
Once accepted, CMDash files a dated evidence record for that control each day while the connector stays connected, recording when it last synced. Only continuous-monitoring rules (a rule pack, or one you write) evaluate a condition and change a control’s status. You can map a connector to any control yourself.
Some suggestions are derived: a pre-built check for a control in another framework is reused here when a direct crosswalk edge between the two controls has confidence of at least 0.85. Derived suggestions are counted separately below and never added to the directly mapped ones.
Connector rules versus attested
Of 17 controls, 4 have a pre-built connector check, mapped by CMDash and not independently reviewed, that contributes evidence, and 0 more have a crosswalk-derived one. The other 13 have no shipped rule and are attested unless you add one. An attested control has an owner, a status, uploaded, dated evidence, and reviewer notes.
- Amazon Web Services: AC.L1-3.1.22
- CrowdStrike Falcon: SI.L1-3.14.1, SI.L1-3.14.2
- Okta: AC.L1-3.1.1
- Qualys VMDR: SI.L1-3.14.1
- Rapid7 InsightVM: SI.L1-3.14.1
- Tenable / Nessus: SI.L1-3.14.1
Evidence sources
3 integrations carry data relevant to 3 of the 6 control groups, listed under “Where the evidence comes from” above. You choose which control each signal evidences. Where a control has a shipped rule, its connector is named above.
What CMDash does not do
- CMDash does not certify anyone and issues no certificate. Level 1 is a self-assessment that a senior official affirms.
- CMDash does not file your affirmation or score with DoD. Entry happens in DoD’s own portal; CMDash prepares what you enter.
- CMDash does not tell you which CMMC level your contract requires. That is in the solicitation.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- CMDash is not a source of legal advice on which level your contract requires. Read the solicitation, or ask your contracting officer — CMDash tracks whichever level you tell it applies.
- Level 1 practice descriptions in CMDash are original summaries, not the verbatim FAR clause or DoD assessment-objective text.
- No SPRS numeric score applies to Level 1 — DoD's own methodology does not define one for this tier, so CMDash does not invent one either.
Common questions
Is Level 1 easier than Level 2?
Narrower, not necessarily easier — there are 17 practices instead of 110, but none of them can be worked via a POA&M. Every practice has to be fully in place before you self-assess, where Level 2 allows a limited set of open items with a 180-day deadline.
Do we need a C3PAO for Level 1?
No. Level 1 is always a self-assessment performed annually by the organisation itself, affirmed in SPRS by a senior official. Third-party and government-led assessment only start at Level 2 and Level 3.
Is CMMC mandatory on our contract right now?
It depends on the contract. The 48 CFR rule took effect November 10, 2025, establishing a three-year phased structure for later requirements, so CMMC clauses are appearing in new and modified DoD solicitations rather than all at once. As of 2026-09-15, DoD had paused the later CMMC phase-in milestones (since 2026-07-13) with no resumption date announced. The CMMC acquisition rule (48 CFR) took effect on 10 November 2025, establishing a three-year phased structure for when CMMC requirements can appear in DoD solicitations. Rollout timing for later phases is not fixed and can change — check current DoD CIO guidance before relying on a specific date. Check your specific contract for whether a CMMC level applies yet.
Also in Government & Defense
Paid plans cap how many frameworks you run at once, never which ones — CMMC Level 1 is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.