Start with the current FAR-based model
The current CMMC rule defines Level 1 using the 15 safeguarding requirements in FAR 52.204-21(b)(1)(i) through (xv). Older material often describes 17 practices because the physical-protection clause contains several actions that were presented separately. The current count does not remove those actions. Use the actual FAR language and the mapping in 32 CFR 170.15 to understand what must be assessed. A checklist should preserve the full content of each requirement rather than deleting obligations to force an older template into a newer count.
Use the mapped objectives for FCI
The Level 1 self-assessment rule maps the FAR requirements to objectives in the June 2018 NIST SP 800-171A procedures and instructs the organization to substitute FCI where an objective addresses CUI. Read those mapped objectives with the actual Level 1 requirement. The mapping provides assessment detail; it does not make Level 1 equivalent to all 110 Level 2 requirements. Establish the FCI assessment scope first, including the people, technology, facilities, and relevant external services, then identify the processes and evidence that apply to that environment.
Review access and identification as operating processes
For access-related objectives, identify authorized users, devices, and processes, permitted functions, and how access is restricted. Review how identities are established and authenticated, how external connections are controlled, and how public information is reviewed. Use records and demonstrations suited to the implementation rather than a generic assertion that the office has passwords. A staff change offers a useful preparation walkthrough: follow approval, provisioning, role changes, and removal to see whether the documented approach works across the actual systems that handle FCI.
Break the physical and media actions into visible evidence
The physical-protection requirement includes limiting authorized physical access and the visitor, physical-access log, and access-device actions within the FAR clauses. Make each action identifiable in the working review. Consider how visitors are managed, which areas contain relevant equipment, and who maintains keys or badges. For media, review sanitization or destruction before release for reuse or disposal. Evidence should reflect the organization’s actual circumstances, including remote work where relevant. A policy can explain expectations while a record or demonstration helps establish that the expected process operates.
Check system protection and integrity in the actual environment
Review the applicable communications boundaries and any publicly accessible system components. Examine how flaws are identified and corrected, how malicious-code protection is provided and updated, and how required scans occur. Ask the responsible administrator to explain coverage and exceptions rather than presenting a single screenshot from one convenient device. CMMC Pulsar can be evaluated for organizing Level 1 readiness records and connecting controls with evidence. Federal Bid Partners may assist with preparation under a defined scope, while the contractor remains responsible for implementation and assessment accuracy.
Complete the self-assessment and maintain the result
All Level 1 requirements must be MET; the rule does not permit a POA&M for Level 1 status. Resolve unsupported objectives before representing the environment as meeting the level. Complete the required self-assessment, official SPRS result submission, and affirmation through authorized people and current government procedures. Level 1 follows an annual self-assessment cycle with the associated affirmation obligation. Software or advisory assistance does not issue certification. Keep the mapped review useful after submission by connecting staff onboarding, system changes, and recurring safeguards to their accountable owners.