CMMC Level 1 Compliance: What Small Contractors Must Do in 2026

What CMMC Level 1 Actually Requires (No Jargon)

The Cybersecurity Maturity Model Certification (CMMC) program has officially taken effect. As of 2025, any DoD contract that involves Federal Contract Information (FCI) requires the contractor to demonstrate CMMC Level 1 compliance: and that requirement is showing up in solicitations across the Defense Industrial Base (DIB) right now.

If you're a small contractor who handles FCI: which includes most defense-related procurement information, contract data, and deliverable information that isn't publicly available: this applies to you. Full stop.

Here's the plain-English version of what CMMC Level 1 requires:

• 17 security practices derived from Federal Acquisition Regulation (FAR) clause 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems)
• Annual self-attestation: At CMMC Level 1, you do not need a third-party assessor. You self-assess and submit an affirmation through the Supplier Performance Risk System (SPRS)
• CEO-level accountability: A senior official (typically the CEO or equivalent) must affirm the accuracy of your self-assessment: which creates personal legal liability under the False Claims Act

Who must comply: any contractor or subcontractor that processes, stores, or transmits FCI on DoD systems. If your company touches a DoD contract: even as a subcontractor two tiers down from the prime: you likely need to be CMMC Level 1 compliant.

The 6 CMMC Level 1 Domains You Need to Nail

The 17 Level 1 practices span six security domains. Think of these as the six areas of your business that CMMC touches. We'll break down each domain, what the practices actually require, and what "compliant" looks like in a real small business environment.

Domain 1: Access Control (AC): 4 Practices

Access Control is about ensuring that only authorized users can access your systems and FCI. The four Level 1 AC practices require you to:

• AC.1.001: Limit system access to authorized users, processes acting on behalf of authorized users, and devices: including other systems. In practice: every user who accesses your systems should have a named, individual account. No shared logins. No "team password" on the server.
• AC.1.002: Limit system access to the types of transactions and functions that authorized users are permitted to execute. In practice: apply the principle of least privilege. A data entry clerk shouldn't have admin access. A finance person shouldn't be able to access engineering servers. Role-based access controls (RBAC) are the standard mechanism.
• AC.1.003: Verify and control/limit connections to external systems. In practice: document which external systems connect to your network (cloud services, partner systems, vendor tools) and ensure those connections are authorized and controlled.
• AC.1.004: Control information posted or processed on publicly accessible information systems. In practice: if you have a public website or social media, implement controls to ensure FCI doesn't end up there accidentally.

What you need to document: User access lists, role definitions, access authorization records, and a process for revoking access when employees leave (critical for onboarding/offboarding).

Domain 2: Identification and Authentication (IA): 2 Practices

IA is about confirming that users are who they say they are before granting system access.

• IA.1.076: Identify information system users, processes acting on behalf of users, and devices. In practice: every user, service account, and device that accesses your system must have a unique identifier. No generic accounts.
• IA.1.077: Authenticate (or verify) the identities of those users, processes, or devices as a prerequisite to allowing access. In practice: passwords at a minimum. Multi-factor authentication (MFA) is strongly recommended and increasingly expected by contracting officers, even though Level 1 doesn't explicitly mandate it.

What you need to document: Account inventory, password policy, authentication requirements, and MFA implementation status.

Domain 3: Media Protection (MP): 1 Practice

MP addresses how you handle, transmit, and destroy media that contains FCI.

• MP.1.118: Sanitize or destroy information system media containing FCI before disposal or reuse. In practice: before you throw away or repurpose a hard drive, laptop, USB drive, or other storage device that contained FCI, you must securely wipe or destroy it. "Delete" is not sufficient: use DoD-grade wiping tools or physical destruction.

What you need to document: Media disposal/destruction log, sanitization methods used, chain of custody records for destroyed media.

Domain 4: Physical Protection (PE): 2 Practices

PE ensures that unauthorized individuals can't walk into your facility and access systems containing FCI.

• PE.1.131: Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals. In practice: your server room, your workstations containing FCI, and the areas where FCI is processed should have controlled physical access. This can be as simple as a locked office for small businesses.
• PE.1.132: Escort visitors and monitor visitor activity; maintain audit logs of physical access. In practice: visitors to areas where FCI is accessed should be escorted. Maintain a sign-in log. This doesn't require biometric systems: a paper log and escort policy suffices at Level 1.

What you need to document: Physical access control policy, visitor logs, authorized access lists for sensitive areas.

Domain 5: System and Communications Protection (SC): 2 Practices

SC addresses how information flows within your systems and across network boundaries.

• SC.1.175: Monitor, control, and protect organizational communications at the external boundaries and key internal boundaries of the information system. In practice: you need a firewall at your network perimeter. Internal network segmentation (separating FCI systems from guest networks, for example) is expected. This is basic network hygiene, but it must be documented.
• SC.1.176: Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. In practice: your public-facing web servers or cloud services should be on a separate network segment from the systems where you process FCI. A simple DMZ configuration satisfies this for most small businesses.

What you need to document: Network architecture diagram, firewall rules, segmentation documentation.

Domain 6: System and Information Integrity (SI): 6 Practices

SI is about identifying and protecting against threats to system integrity: malware, software vulnerabilities, and system anomalies.

• SI.1.210: Identify, report, and correct information and information system flaws in a timely manner. In practice: have a patch management process. Track vulnerabilities in your systems and apply patches according to a defined schedule (critical patches within 30 days is a common baseline).
• SI.1.211: Provide protection from malicious code at appropriate locations within organizational information systems. In practice: antivirus/endpoint detection software on all systems that access FCI. Keep definitions current.
• SI.1.212: Update malicious code protection mechanisms when new releases are available. In practice: enable automatic updates for your antivirus software. Document that you do this.
• SI.1.213: Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed. In practice: scheduled weekly scans plus real-time scanning enabled. Document your scan configuration and results.
• SI.1.214 / SI.1.215: Monitor information systems to detect attacks and identify unauthorized use; identify unauthorized use of organizational information systems. In practice: system logging enabled. Review logs periodically. This doesn't require a Security Operations Center (SOC) at Level 1: basic Windows Event logging and network logging reviewed weekly suffices.

What you need to document: Patch management policy and records, AV software inventory and update logs, scan results, system log review records.

The CMMC Level 1 Self-Attestation Process

Unlike CMMC Level 2 and Level 3, which require third-party Certified Third-Party Assessment Organizations (C3PAOs), Level 1 is self-attested. Here's exactly how the process works:

Step 1: Conduct Your Self-Assessment

Assess your implementation status for all 17 practices. For each practice, determine:

• Implemented: The practice is fully implemented with documented evidence
• Not Implemented: The practice is not implemented (cannot submit attestation until remediated)
• Not Applicable: The practice doesn't apply to your environment (rare at Level 1, must be justified)

All 17 practices must be marked "Implemented" before you can affirmatively attest to compliance. There is no partial credit at Level 1: the affirmation states that you meet all applicable requirements.

Step 2: Remediate Any Gaps

If your assessment identifies gaps: practices that aren't implemented: remediate them before attesting. Common Level 1 gaps that small businesses find during first assessments:

• Shared user accounts on systems (violates AC.1.001)
• No formal media disposal procedure (violates MP.1.118)
• Patch management done ad hoc with no documentation (violates SI.1.210)
• Antivirus not enabled on all endpoints (violates SI.1.211)
• No physical access controls on server areas (violates PE.1.131)

Most of these gaps are fixable in days to weeks for a small business. The technical barriers are low: the documentation discipline is the harder part.

Step 3: Submit Your SPRS Score

The Supplier Performance Risk System (SPRS) is where your self-assessment results are recorded. To submit:

1. Log in to PIEE (Procurement Integrated Enterprise Environment) at piee.eb.mil
2. Navigate to SPRS → Cyber Assessments
3. Submit your Basic Assessment (CMMC Level 1 self-attestation) with your score
4. Your score is a simple calculation: you start at 110 points (for NIST SP 800-171 assessments) or simply affirm "all 17 practices implemented" for the basic FAR-level attestation

Step 4: Senior Official Affirmation

The affirmation requirement is where the stakes get real. Under the DoD's CMMC program, a senior company official: typically the CEO or equivalent: must annually affirm that the company meets the CMMC Level 1 requirements. This affirmation is legally binding. False affirmations can constitute violations of the False Claims Act, with penalties including treble damages and debarment.

This is not a bureaucratic checkbox. It is personal legal liability for the company's leadership. Take it seriously.

Step 5: Maintain Annual Reassessment

Level 1 compliance is not a one-time event. The annual reassessment requirement means you must:

• Re-evaluate all 17 practices each year
• Update your SPRS submission with any changes
• Reaffirm compliance by your senior official
• Maintain documentation of the current assessment cycle

CMMC and Employee Onboarding: The Overlooked Connection

Here's where most small contractors miss a critical compliance gap: CMMC Level 1 compliance isn't just about your IT infrastructure. It's about your people processes: particularly how you onboard new employees and offboard departing ones.

Access Provisioning: The Most Common Level 1 Failure Point

Access Control practices (AC.1.001 and AC.1.002) require that system access is tied to specific, authorized users with defined roles. This means every new employee who touches your systems must have their access formally authorized, provisioned, and documented before they begin work: not a week later when IT gets around to it.

In practice, small contractors routinely fail this during audit for two reasons:

1. New employees are given temporary access to the previous employee's credentials while their own account is being set up
2. Departing employees' accounts are not deactivated promptly (sometimes never)

Both scenarios violate AC.1.001. Both are completely preventable with a documented onboarding and offboarding process that includes specific IT access steps.

Training Requirements CMMC Bakes Into Onboarding

While CMMC Level 1 doesn't have a standalone "awareness training" practice (that's Level 2), the system integrity practices implicitly require that employees who use your systems understand how to use them securely. Practically, this means:

• New hire orientation that covers your password policy, acceptable use policy, and FCI handling procedures
• Documentation that each new hire received and acknowledged these policies
• Training on your incident reporting procedure (SI.1.214): employees need to know how to report suspected security incidents

These aren't theoretical requirements: auditors and contracting officers specifically look for signed acknowledgments and training completion records. A compliant onboarding workflow generates this documentation automatically.

How to Tie Onboarding Workflows to Your CMMC Control Documentation

The most audit-ready small contractors have connected their onboarding process directly to their CMMC documentation. Here's the structure that works:

• System Access Request form: Generated for every new hire, documents which systems they need access to, what role/permissions are appropriate, and who authorized the access: maps to AC.1.001 and AC.1.002
• Acceptable Use Policy acknowledgment: Signed by every new hire on Day 1: maps to SI documentation requirements
• Security briefing completion: Documented training on FCI handling, media protection, and incident reporting: maps to MP.1.118 and SI.1.214 evidence
• IT setup checklist: Documents endpoint configuration, AV installation, and access provisioning: maps to SI.1.211 and AC controls

When these are part of your onboarding workflow: not separate ad hoc processes: your CMMC documentation builds itself with every hire. Platforms like Winrove automate this documentation, ensuring every new contractor hire generates the audit-ready records that prove Level 1 compliance.

CMMC Level 1 Compliance Checklist (Printable)

Use this checklist to assess your current Level 1 status. Each item maps to the relevant practice.

Access Control

• ☐ Every system user has a unique, individual account (no shared credentials): AC.1.001
• ☐ User access is role-based and limited to what each role requires (least privilege): AC.1.002
• ☐ External system connections are documented and authorized: AC.1.003
• ☐ Controls exist to prevent FCI from appearing on public-facing systems: AC.1.004

Identification and Authentication

• ☐ Every user, device, and service account has a unique identifier: IA.1.076
• ☐ Authentication is required before system access (password or stronger): IA.1.077
• ☐ MFA is implemented for remote access and privileged accounts (strongly recommended): best practice beyond Level 1

Media Protection

• ☐ Written media disposal procedure exists: MP.1.118
• ☐ All disposal/destruction events are logged with method, date, and responsible party: MP.1.118
• ☐ Disposal procedure covers all media types: hard drives, SSDs, USB drives, printed documents: MP.1.118

Physical Protection

• ☐ Areas where FCI systems are located have controlled physical access: PE.1.131
• ☐ Visitor escort policy exists and is followed: PE.1.132
• ☐ Visitor access log is maintained: PE.1.132

System and Communications Protection

• ☐ Firewall is in place at network perimeter: SC.1.175
• ☐ FCI systems are on a separate network segment from public-facing systems: SC.1.176
• ☐ Network architecture is documented: SC evidence

System and Information Integrity

• ☐ Patch management policy exists with defined timelines: SI.1.210
• ☐ Patches are applied on schedule and records are maintained: SI.1.210
• ☐ Antivirus/EDR is installed on all FCI-processing endpoints: SI.1.211
• ☐ AV definitions are automatically updated: SI.1.212
• ☐ Scheduled system scans are configured and run: SI.1.213
• ☐ Real-time scanning is enabled for downloads and external files: SI.1.213
• ☐ System logging is enabled on FCI systems: SI.1.214
• ☐ Logs are reviewed periodically and reviewed results are documented: SI.1.215

Attestation Readiness

• ☐ All 17 practices above are fully implemented: prerequisite to attest
• ☐ Documentation exists for each practice (policies, records, configurations): evidence requirement
• ☐ SPRS submission is current: annual requirement
• ☐ Senior official (CEO or equivalent) has signed the annual affirmation: personal accountability requirement
• ☐ Next annual reassessment date is calendared: ongoing compliance

What Happens If You're Not Compliant

CMMC Level 1 non-compliance is no longer a paperwork problem. As of 2025, the consequences are concrete and escalating:

False Claims Act Exposure

The most serious risk is not technical failure: it's legal. When a senior official affirmatively signs a CMMC self-attestation claiming compliance, and the company is not actually compliant, that affirmation potentially constitutes a false claim under the False Claims Act. The FCA allows the government to seek treble damages (three times the contract value) plus civil penalties. DOJ has actively pursued cybersecurity False Claims Act cases since 2021 under the Civil Cyber-Fraud Initiative.

This isn't hypothetical. In 2023 and 2024, DOJ settled multiple FCA cases related to cybersecurity misrepresentations on government contracts. The settlements ranged from hundreds of thousands to millions of dollars: often for companies far smaller than those typically associated with FCA enforcement.

How Contracting Officers Verify Compliance in 2026

Contracting officers now have several mechanisms to verify CMMC compliance:

• SPRS check: Your self-assessment score is visible to contracting officers via SPRS. A missing or outdated score is an immediate red flag.
• Solicitation clauses: Many DoD solicitations now include DFARS clause 252.204-7021, which requires contractors to maintain CMMC compliance and grants DoD the right to verify compliance through assessments.
• Post-award audits: DCAA and DCSA are conducting more post-award cybersecurity reviews. If you win a contract with a compliant attestation and a subsequent audit reveals non-compliance, you're in FCA territory.

Cure Notices, Terminations, and Debarment Risk

Contract-level consequences for CMMC non-compliance include:

• Cure notice: The contracting officer notifies you that you have X days to remediate compliance gaps or the contract will be terminated for default
• Termination for default: Contract terminated, damages potentially assessed, CPARS performance rating damaged
• Debarment: In serious cases of intentional misrepresentation, debarment proceedings can bar a company (and its principals) from federal contracting for years

The cost of becoming compliant before you attest is always lower than the cost of becoming compliant after a false claim is discovered.

Getting from Level 1 to Level 2: What to Plan For

CMMC Level 2 is a significant step up from Level 1. Where Level 1 has 17 practices, Level 2 has 110 practices: all drawn from NIST SP 800-171. And Level 2 typically requires a third-party assessment by a Certified Third-Party Assessment Organization (C3PAO), not just self-attestation.

The good news: the 17 Level 1 practices are a subset of the 110 Level 2 practices. Everything you implement for Level 1 counts toward Level 2. If you're going to pursue larger DoD contracts that require Level 2 in the next 2–3 years, starting your Level 2 preparation now: while you're doing your Level 1 work: is the most efficient path.

Key Delta Between Level 1 and Level 2

Additional domains Level 2 adds beyond Level 1:

• Audit and Accountability: Comprehensive audit log management, log retention, and review
• Configuration Management: System baselines, change control, unauthorized software prevention
• Incident Response: Formal IR plan, testing, reporting to government
• Maintenance: Controlled maintenance procedures for systems processing CUI
• Personnel Security: Screening procedures, access termination on departure
• Risk Assessment: Periodic risk assessments, vulnerability scanning
• Security Assessment: Periodic review of security controls, action plans

Level 2 also introduces the Controlled Unclassified Information (CUI) framework: which goes beyond FCI to cover sensitive unclassified government data that requires specific handling, marking, and protection.

How Winrove Maps to CMMC Level 2 Requirements

If your onboarding process is already generating the documentation that proves Level 1 compliance, you're further along on the Level 2 journey than you might think. Specific Level 2 practices that a compliant onboarding workflow directly addresses:

• AC.2.006: Use non-privileged accounts for non-privileged activities: documented in your access provisioning records
• AT.2.056: Ensure that personnel are aware of security risks: documented in your security briefing and awareness training records
• AT.2.057: Ensure that personnel are trained to carry out assigned security responsibilities: mapped directly to role-specific training requirements in your onboarding plan
• PS.2.127: Screen individuals prior to authorizing access to systems containing CUI: background check documentation in onboarding records
• PS.2.128: Ensure that CUI is protected during and after personnel actions: exit procedures and access termination documentation

The practical lesson: invest in a compliant onboarding process now, while the requirements are simpler, and it compounds into Level 2 compliance readiness as your contracts grow.

---

CMMC compliance starts on Day 1 of employment. Winrove automates your government contractor onboarding workflow: assigning required security training, generating signed acknowledgment records, documenting access provisioning, and producing the audit-ready documentation that proves your CMMC Level 1 controls are in place from the moment a new employee starts. See the CMMC onboarding demo →

Related reading: Government Contractor Employee Onboarding Checklist: The Complete 2026 Guide. Also check out how Winrove helps you verify IT skills and certifications for your team's DoD 8570 compliance requirements.