Common Cyber
CMMC Level 1 Assessment
Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21 for organizations that handle Federal Contract Information but not Controlled Unclassified Information. It is a smaller scope than Level 2 and a shorter path, and it is priced to your environment.
What decides whether Level 1 applies to you?
Your contract and the information you handle decide it. Level 1 applies when your contract carries the FAR 52.204-21 safeguarding clause and you handle Federal Contract Information but not Controlled Unclassified Information.
If you receive CUI, Level 2 applies instead and the scope changes. Which level applies is set by your contract and the information you handle, not by preference, and it is subject to discovery and validation.
What does Level 1 require?
The 15 basic safeguarding requirements in FAR 52.204-21, assessed annually and affirmed in SPRS.
Level 1 is a self-assessment. All 15 requirements must be assessed as met or not applicable. There is no POA&M at Level 1, so a requirement that is not met cannot be carried forward. No third-party assessor is involved.
What does the engagement include?
We scope the boundary, assess the 15 requirements, close gaps, and prepare the self-assessment record so your affirmation rests on evidence.
- Boundary and scope review for Federal Contract Information
- Assessment against the 15 FAR 52.204-21 requirements
- Gap closure and control implementation support
- Evidence and documentation for the self-assessment record
- Preparation for the annual SPRS affirmation
Is it still a self-assessment if we bring in help?
Yes. The CMMC Assessment Guide for Level 1 states that an organization may perform the annual self-assessment internally or engage a third party to assist, and that using a third party is still considered a self-assessment.
Your organization performs the self-assessment and your Affirming Official submits the affirmation in SPRS. That accountability stays with you. Common Cyber provides the execution capacity to get the work done and evidenced.
Who performs the work?
A CMMC Registered Practitioner (RP) on the Common Cyber team supports Level 1 engagements, alongside our federal authorization and security engineering experience.
Common Cyber is not a C3PAO and does not perform certification assessments. Level 1 does not involve a third-party assessor.
Why call for a quote?
Level 1 scope depends on your environment — how many people and systems touch Federal Contract Information, and how your work is organized. We price the engagement to what the work actually requires rather than publishing a single figure.
Call +1 786-607-2913 or request a quote below, and we will scope a Level 1 engagement to your organization.
Scoped to your environment.
Level 1 scope depends on how many people and systems touch Federal Contract Information. We scope the work and give you a quote — no single published figure.
CMMC Level 1 Self-Assessment
A scoped Level 1 self-assessment engagement against the 15 FAR 52.204-21 safeguarding requirements, priced to your environment.
Frequently asked questions
How many controls are in CMMC Level 1?
Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21. All 15 must be assessed as met or not applicable, and there is no POA&M at Level 1. The assessment is self-performed annually and affirmed in SPRS.
How much does a Level 1 engagement cost?
Level 1 scope depends on your environment, so the engagement is priced to your organization rather than published as a single figure. Call +1 786-607-2913 or request a quote and we will scope it with you.
Do we need a C3PAO for Level 1?
No. Level 1 is a self-assessment and involves no third-party assessor. It is performed annually and affirmed in SPRS by your Affirming Official.
How is Level 1 different from Level 2?
Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21 and applies when you handle Federal Contract Information but not Controlled Unclassified Information. Level 2 covers all 110 requirements in NIST SP 800-171 Revision 2 and applies when you handle CUI. Which one applies is set by your contract and the information you handle.
Is outside help still a self-assessment?
Yes. The CMMC Assessment Guide for Level 1 states that an organization may perform the annual self-assessment internally or engage a third party to assist, and that using a third party is still considered a self-assessment. Your Affirming Official submits the affirmation.
Request a Level 1 Quote
A clear next step
Start your Level 1 self-assessment.
We scope a Level 1 engagement to your environment and give you a quote. Call or request one below.
Request a Quote