Editor's note: CMMC has been updated several times since this post was first published, most recently when the Department of War suspended Phase 2 in July 2026. We have also rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 to reflect the current state of the program. For the latest information, see our CMMC Overview and our CMMC Calendar.
Last updated: October 2026
DFARS 252.204-7025 tells you, before award, that a contract requires CMMC Level 1 and that your status must be current in SPRS to be eligible. DFARS 252.204-7021 requires you to keep that status, and affirm it every year, for the life of the contract. For CMMC Level 1 contractors in Guam and Hawaii, that means four things: meet all 15 FAR 52.204-21 requirements, complete an annual self-assessment, enter the results and an affirmation in SPRS, and track the CMMC Unique Identifier (UID) for each system that handles Federal Contract Information (FCI). The July 2026 CMMC pause did not suspend any of this.
What Does DFARS 252.204-7025 Require?
DFARS 252.204-7025 is a solicitation provision. It appears in the request for proposal, not just the final contract. It states the CMMC level the contract will require and tells offerors they must have that status current in SPRS to be considered for award.
For a Level 1 requirement, the offeror must have:
- A current CMMC Level 1 self-assessment result in SPRS for each information system that will process, store, or transmit FCI during performance.
- A current affirmation of compliance from the company's affirming official.
- The CMMC UIDs for those systems, which the offeror provides to the contracting officer.
The practical effect is that you cannot wait until you win to get compliant. If your SPRS record is not current when the solicitation closes, you are not eligible. 7025 took effect with the DFARS CMMC rule on November 10, 2025.
What Does DFARS 252.204-7021 Require After Award?
DFARS 252.204-7021 governs what you must do once you hold the contract. For Level 1 contractors, it requires you to:
- Maintain a current CMMC Level 1 status for every information system that processes, stores, or transmits FCI, for the duration of the contract.
- Complete the Level 1 self-assessment and affirm continued compliance in SPRS every year.
- Report changes to CMMC UIDs to the contracting officer, for example when you add or replace a system that handles FCI.
- Flow the CMMC requirement down to subcontractors that will handle FCI, and make sure they have a current status at the appropriate level before you award the subcontract.
The February 2026 DFARS overhaul moved the cybersecurity rules from DFARS Part 204 to Part 240, but 7021 and 7025 kept their numbers.
What Are CMMC Unique Identifiers (UIDs)?
A CMMC UID is the identifier SPRS assigns to each CMMC assessment record. It ties an assessment to a specific information system and scope.
UIDs matter because 7021 and 7025 apply per system, not per company. If you have two environments that touch FCI, each needs a current status. When something changes, you report the new UID to the contracting officer. Keep a simple record of which UID covers which system, who owns it, and when the next affirmation is due.
What Are the 15 CMMC Level 1 Requirements?
CMMC Level 1 consists of the 15 basic safeguarding requirements in FAR 52.204-21, which the FAR overhaul renumbered as FAR 52.240-93 with the same requirements. They cover six areas:
- Access control: limit system access to authorized users and devices, limit what they can do, control connections to external systems, and control what is posted publicly.
- Identification and authentication: identify users and devices, and verify their identity before granting access.
- Media protection: sanitize or destroy media containing FCI before disposal or reuse.
- Physical protection: limit physical access, and escort visitors, keep physical access logs, and manage keys and badges.
- System and communications protection: monitor and protect network boundaries, and separate public-facing systems from internal networks.
- System and information integrity: fix flaws promptly, protect against malicious code, keep that protection updated, and run scans.
The original version of this post said Level 1 had 17 requirements. That number came from earlier CMMC guides, which split some FAR requirements into separate practices. The CMMC program rule, 32 CFR Part 170, counts the 15 FAR requirements. The security work is the same either way. Our Level 1 self-assessment guide lists each one in plain language.
Annual Self-Assessment and Affirmation
CMMC Level 1 is assessed by the contractor, not a third party. Every year, you assess your FCI environment against all 15 requirements, enter the result in SPRS, and have your affirming official affirm compliance.
Three rules apply:
- All 15 requirements must be met. There is no partial credit.
- No POA&M is allowed. Level 1 does not permit a Plan of Action and Milestones to cover an open gap.
- The affirmation is a legal representation. A senior official is stating to the government that the company complies.
That last point is where I spend time with Level 1 clients. Self-assessments are usually too generous. The DOJ has used the False Claims Act against contractors that misrepresented their cybersecurity. In June 2026, LOGZONE settled for $507,144 after reporting an SPRS score of 110 when a DIBCAC assessment found -170. That case involved Level 2 scoring, but the principle applies to every affirmation.
Level 1 is a subset of Level 2, and it is easy to underestimate. Some of the harder controls, like boundary protection and managing physical access, are in Level 1. Documentation is still required. In more than 100 gap assessments, documentation is the gap I find most often. That is why most of our CMMC Guam Level 1 work starts with policies and procedures, not new tools.
How the 2026 Pause Affects CMMC Level 1
The 2026 pause had very little effect on Level 1. Level 1 self-assessments began appearing in applicable solicitations in Phase 1, starting November 10, 2025, and they still do.
On July 13, 2026, the Department of War suspended Phase 2 and future CMMC milestones. Phase 2 was about Level 2 C3PAO assessments. Class Deviation 2026-O0025 Revision 3, issued September 3, 2026, lets contracting officers accept Level 1 or Level 2 self-assessments in place of C3PAO assessments. Level 1 was always a self-assessment, so nothing about the requirement changed. At the time of this update, the CMMC Reform Task Force report has not been published.
What CMMC Level 1 Contractors in Guam and Hawaii Should Do Now
- Confirm you have SPRS and PIEE access. Getting it can take days to weeks, so do not leave it until a solicitation is open.
- Identify every system that touches FCI and decide your assessment scope.
- Assess all 15 requirements conservatively and fix anything not met before you affirm.
- Keep evidence for each requirement.
- Put your annual affirmation date on the calendar.
- Check your subcontractors' status before you share FCI.
Guam contractors face the same requirements with fewer local resources and longer lead times. Plan further ahead. Our CMMC for Guam Contractors page covers the local picture.
Talk to Intech Pacific About CMMC Level 1
Intech Pacific is the only CMMC Level 2 certified MSP in Hawaii and Guam, and our team includes CMMC Certified Professionals and Certified Assessors.
To see how we help contractors in Hawaii and Guam, from a free readiness session to fully managed compliance, visit our CMMC Solutions page.
