How to Conduct a CMMC Level 1 Self-Assessment, Step by Step

Editor's note: CMMC has been updated several times since this post was first published, most recently when the Department of War suspended Phase 2 in July 2026. We have also rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 to reflect the current state of the program. For the latest information, see our CMMC Overview and our CMMC Calendar.

Last updated: October 2026

A CMMC Level 1 self-assessment has five steps: scope where your Federal Contract Information (FCI) lives, evaluate each of the 15 Level 1 requirements, collect evidence that each one is met, fix anything that is not, and enter the result and an affirmation in SPRS. For CMMC Level 1 contractors in Hawaii, the rule that matters most is simple. Every requirement must be met. There is no partial credit and no Plan of Action and Milestones (POA&M) at Level 1. You repeat the self-assessment and affirmation every year. This guide walks through each step.

Step 1: Confirm You Need CMMC Level 1 and Get SPRS Access

Start by confirming the requirement and your access to the system where you will record the result.

• Check your contracts and solicitations for DFARS 252.204-7021 and 252.204-7025, and for FAR 52.204-21 (renumbered FAR 52.240-93 under the FAR overhaul).
• Confirm you handle FCI: information provided by or generated for the government under a contract that is not intended for public release.
• Confirm you do not also handle Controlled Unclassified Information (CUI). If you do, you are likely looking at Level 2, and this guide is only the start.
• Make sure someone at your company has PIEE and SPRS access with the right roles. In my experience, many contractors do not, and getting access can take days to weeks.
• Name your affirming official, the senior person who will sign off on the result.

For the contract side of Level 1, see our post on DFARS 7021 and 7025 for Level 1 contractors.

Step 2: Scope Where FCI Lives

Scoping defines what you are assessing. Your Level 1 assessment covers the people, systems, devices, and facilities that process, store, or transmit FCI.

• List the users who handle contract information.
• List the devices they use: laptops, desktops, phones, servers.
• List the applications and cloud services that hold FCI: email, file sharing, accounting, project tools.
• List the physical locations where FCI is handled or stored.
• Draw a simple diagram showing where FCI enters, where it is stored, and where it leaves.

Keep this list. It becomes the basis for your CMMC Unique Identifier (UID) in SPRS and for next year's assessment.

Step 3: Evaluate the 15 CMMC Level 1 Requirements

CMMC Level 1 is the 15 requirements in FAR 52.204-21. In plain language, they are:

1. Only authorized users, processes, and devices can access your systems.
2. Users can only do what their role requires (for example, standard users are not administrators).
3. Connections to external systems, such as personal devices or outside networks, are verified and controlled.
4. Information posted on public systems like your website is controlled so FCI is not posted.
5. Every user, process, and device is identified (no shared accounts).
6. Identities are verified, for example with passwords or MFA, before access is granted.
7. Media containing FCI, paper or digital, is sanitized or destroyed before disposal or reuse.
8. Physical access to systems and work areas is limited to authorized people.
9. Visitors are escorted and monitored, physical access is logged, and keys, badges, and locks are controlled.
10. Communications at your network boundary are monitored, controlled, and protected, typically with a firewall.
11. Publicly accessible systems are separated from your internal network.
12. System flaws are identified, reported, and corrected promptly (patching).
13. Systems are protected from malicious code (antivirus or endpoint protection).
14. Malicious code protection is updated when new releases are available.
15. Systems are scanned periodically, and files from outside sources are scanned in real time when downloaded, opened, or run.

You may see older guidance that lists 17 Level 1 practices. Earlier CMMC guides split some of these into separate practices. The CMMC program rule, 32 CFR Part 170, counts 15.

Score each requirement as MET or NOT MET. A requirement is only met if every part of it is met across your whole scope. The original version of this post used a "Partially Compliant" rating. That category does not exist in CMMC. Partial is NOT MET.

Step 4: Collect Evidence for Each Requirement

Evidence is what supports your answer. CMMC assessments use three methods: examine, interview, and test. Use the same methods on yourself.

• Examine: policies, procedures, screenshots of settings, user lists, visitor logs, patch reports, antivirus dashboards.
• Interview: ask the people who do the work to explain how it is done. If their answer does not match the policy, one of them is wrong.
• Test: try it. Attempt to log in with a disabled account. Confirm a standard user cannot install software. Check that the firewall blocks what it should.

Store the evidence in one place, organized by requirement. Level 1 still requires documentation. In more than 100 gap assessments, documentation is the gap I find most often, at every level.

Step 5: Fix Every Gap Before You Affirm

All 15 requirements must be MET before you submit. Level 1 does not allow a POA&M, so you cannot submit with an open item and a plan to close it later.

Some Level 1 requirements are harder than they look. Boundary protection, separating public-facing systems, and managing physical access often take real work in small offices. Plan time for them. When CMMC Hawaii clients come to us for Level 1 help, these three are usually where we start.

When you fix something, update your evidence to show the fix. Then re-test.

Step 6: Enter the Result in SPRS and Affirm

Once all 15 requirements are met, record the self-assessment in SPRS. You will enter the assessment date, the scope covered, and the result. Your affirming official then affirms that the company meets the requirements.

Treat the affirmation as a legal statement, because it is one. The DOJ uses the False Claims Act against contractors that misrepresent their cybersecurity, and the penalties can reach treble damages plus per-claim civil penalties. My advice is to assess conservatively. Self-assessments are usually too generous.

Step 7: Repeat Every Year

Level 1 requires a self-assessment and affirmation every year for as long as the contract requires it. Put the date on the calendar. Re-check your scope, re-test your requirements, and refresh your evidence. If you add or replace a system that handles FCI, check whether your UID changes and report it to the contracting officer.

Does the 2026 Pause Change CMMC Level 1 in Hawaii?

No. On July 13, 2026, the Department of War suspended CMMC Phase 2 and future milestones, which mainly affected Level 2 C3PAO assessments. Level 1 was always a self-assessment, and Level 1 requirements in solicitations and contracts remain in effect. At the time of this update, the CMMC Reform Task Force report has not been published.

Talk to Intech Pacific About Your CMMC Level 1 Self-Assessment

Intech Pacific is the only CMMC Level 2 certified MSP in Hawaii and Guam, with CMMC Certified Professionals and Certified Assessors on staff.

To see how we help contractors in Hawaii and Guam, from a free readiness session to fully managed compliance, visit our CMMC Solutions page.