CMMC Level 1: The 12 Questions Every DoD Contractor Is Asking

Over 60% of the Defense Industrial Base is subject to CMMC Level 1 — yet most contractors still have unanswered questions about what it actually requires. At KyberStorm, these are the 12 questions we hear most from defense contractors across the DMV region. Here are the straight answers.

1. What Is CMMC Level 1?

CMMC Level 1 is the foundational tier of the Cybersecurity Maturity Model Certification (CMMC) framework, established under the 32 CFR final rule. It represents the baseline standard for “basic cyber hygiene” — the minimum security practices every DoD contractor must have in place to protect Federal Contract Information (FCI).

FCI is data provided by or generated for the government under a DoD contract that is not intended for public release. While it isn’t classified, losing control of it can expose supply chain vulnerabilities and damage national interests — which is why CMMC Level 1 compliance is mandatory, not optional.

2. Who Needs CMMC Level 1?

Any company that receives or generates FCI under a DoD contract must comply with CMMC Level 1. This includes both prime contractors and subcontractors. If FCI flows to your organization as part of a DoD contract — at any tier of the supply chain — Level 1 applies to you.

The DoD estimates that over 63% of the Defense Industrial Base falls under Level 1. That includes small businesses, manufacturers, IT service providers, and professional services firms that may not think of themselves as “defense contractors” in the traditional sense.

3. What Are the 15 Practices in CMMC Level 1?

CMMC Level 1 is based on the 15 security requirements in FAR clause 52.204-21, organized across six domains:

• Access Control (AC) — 4 practices: Limit system access to authorized users and devices. Control what each user can access. Manage external connections.
• Identification & Authentication (IA) — 2 practices: Verify identity before granting access. Manage passwords and credentials properly.
• Media Protection (MP) — 1 practice: Sanitize or destroy media containing FCI before disposal or reuse.
• Physical Protection (PE) — 2 practices: Limit physical access to authorized individuals. Escort visitors and secure FCI-processing locations.
• System & Communications Protection (SC) — 2 practices: Monitor and control communications at system boundaries. Separate publicly accessible components from internal FCI systems.
• System & Information Integrity (SI) — 4 practices: Patch systems in a timely manner. Protect against malware. Monitor security alerts and act on them.

4. What Is the Difference Between CMMC Level 1 and Level 2?

The key difference is the type of information being protected and the depth of requirements.

Level 1 protects Federal Contract Information (FCI) and requires 15 practices from FAR 52.204-21. It is always a self-assessment — no third-party assessor is required.

Level 2 protects Controlled Unclassified Information (CUI) and requires 110 practices from NIST SP 800-171. Depending on your program, it may require a formal assessment by a Certified Third-Party Assessor Organization (C3PAO), and scoring uses a 110-point scale.

To determine which level applies: review your contract for FAR 52.204-21 (Level 1) or DFARS 252.204-7012 and CUI references (Level 2). When in doubt, ask your contracting officer or prime contractor directly.

5. Is CMMC Level 1 Mandatory Right Now?

Yes. As of November 2025, CMMC Level 1 compliance is mandatory for all DoD contractors subject to FAR 52.204-21. This means you must complete an annual self-assessment, submit your results to the SPRS database, and maintain documentation to support that submission.

Non-compliance doesn’t just affect future contract awards. Prime contractors are now routinely checking SPRS scores before issuing subcontracts. An empty or expired SPRS record can cost you work today — not just in future bid cycles.

6. What Is an SPRS Score and How Does It Work for CMMC Level 1?

SPRS — the Supplier Performance Risk System — is the DoD’s centralized database where contractors submit their CMMC self-assessment results. Contracting officers and prime contractors use SPRS to verify cybersecurity posture before awarding contracts.

For CMMC Level 1, your submission reflects whether you fully implement all 15 FAR 52.204-21 practices. Full compliance achieves a “Final Level 1 Self-Assessment” status — the only status visible to government personnel. This status expires automatically after one year, requiring annual resubmission.

Unlike Level 2, CMMC Level 1 does not use a numeric 110-point scoring scale. The assessment is binary — each practice is either implemented or it is not.

7. What Documentation Do You Actually Need?

Your SPRS submission is only legally defensible if you have documentation to support it. At minimum you need:

• System Security Plan (SSP) — describes your system boundary, the people and assets in scope, and how you implement each of the 15  Level 1 practices. This is the most important document in your compliance package.
• Plan of Action & Milestones (POA&M) — documents any practices not yet fully implemented, with remediation steps and target dates. Having gaps is acceptable. Having undocumented gaps is not.
• Policy documents — written policies for each of the six practice domains. These must reflect your actual environment, not a generic template filed and forgotten.

Submitting an SPRS score without supporting documentation puts you at risk under the False Claims Act, which allows for treble damages — three times the value of affected contracts — against contractors who knowingly certify compliance they cannot support.

8. What Happens If My SPRS Submission Is Expired?

A CMMC Level 1 SPRS submission automatically becomes “No CMMC Status (Expired Assessment)” after one year. At that point you are in the same position as a contractor who never submitted at all — ineligible for new contract awards and at risk on existing subcontract relationships.

Annual reassessment is not optional. Set a calendar reminder well in advance of your submission anniversary, and update your documentation to reflect any system or environment changes before you resubmit.

9. Do I Need a Consultant to Get CMMC Level 1 Compliant?

Not necessarily. Level 1 is a self-assessment — no third-party assessor or C3PAO is required. If you have an IT or security professional who understands the 15 practices and your system environment, you can complete your assessment and documentation in-house.

Where a consultant adds real value: scoping your system boundary correctly, ensuring your SPRS submission is accurate and defensible, and making sure your documentation meets the standard prime contractors and DoD contracting officers expect to see.

A professional documentation kit designed for CMMC Level 1 is often all most organizations need to get compliant without paying for a full consultant engagement.

10. What Are the Most Common Mistakes DoD Contractors Make with CMMC Level 1?

Based on our work with defense contractors across the Greater DMV area, these are the mistakes we see most often:

• Submitting an SPRS score with no documentation. A number in SPRS with no SSP, policies, or POA&M behind it has no legal foundation. If anyone asks to see the documentation, there’s nothing to show.
• Using generic templates without customizing them. A policy that describes controls you don’t actually have in place doesn’t protect you — it documents a gap between what you claim and what you do.
• Scoping too broadly or too narrowly. Over-scoping wastes resources by including systems that don’t touch FCI. Under-scoping creates  Level 1 compliance gaps by excluding systems that do.
• Treating it as a one-time task. Level 1 requires annual reassessment, resubmission, and ongoing documentation maintenance. It’s a program, not a project.
• Forgetting subcontractors. If you pass FCI to subcontractors, they must also be Level 1 compliant. Flowing down the requirement is your responsibility as a prime or upper-tier sub.

11. How Long Does Compliance Actually Take?

For most organizations starting from scratch:

• Gap analysis: 2–4 hours
• System Security Plan (SSP): 8–15 hours of professional time from scratch
• Each policy document: 3–6 hours from scratch
• POA&M: 1–3 hours depending on number of gaps
• SPRS submission: 30–60 minutes once documentation is complete

That’s why a full CMMC Level 1 consultant engagement runs $4,000–$6,000. The work is real — but it doesn’t have to cost that much. Using a professional documentation kit built specifically for CMMC Level 1, most organizations complete their full compliance package in a weekend.

12. Where Do I Start?

Start with a gap analysis. Before you write a single policy or touch PIEE, you need to know which of the 15 Level 1 practices you already have covered and which still need documentation. That gap analysis determines your workload, your POA&M, and ultimately your SPRS submission.

Our free CMMC Level 1 Readiness Checklist walks you through all 15 practices and every required document in about 15 minutes — so you know exactly where you stand before you commit to anything.

Ready to Get Your CMMC Level 1 Documentation in Place?

If your gap analysis reveals missing documentation, KyberStorm has everything you need to get CMMC Level 1 compliant fast.

CMMC Level 1 Documentation Kit — $897
All 12 documents you need to support your Level 1 SPRS submission — System Security Plan, POA&M template, Control Tracker, and all required policy documents — in editable Word format. Built by a CISSP-certified GRC professional with hands-on DoD compliance experience. One-time purchase, instant download.
Get the Kit →

CMMC Advisory Services
Need expert guidance on scoping, documentation review, SPRS submission support, or Level 2 preparation? KyberStorm works with defense contractors across the Greater DMV area at both CMMC Level 1 and Level 2.
Contact us at info@kyberstorm.com →

Penetration Testing & Red Teaming
Validate your security controls before your assessment with penetration testing and red team exercises built for defense contractors.
Contact us at info@kyberstorm.com →

KyberStorm is a CISSP-certified cybersecurity advisory firm based in the Greater DMV area, specializing in CMMC, FedRAMP, and DoD compliance. Questions? info@kyberstorm.com.