What Level 1 covers
Level 1 applies the 15 safeguarding requirements in FAR 52.204-21 to the covered information systems in scope. These address access, identification and authentication, media disposal, physical protection, boundary protection, and system integrity. You may encounter older descriptions using 17 practices; the current rule defines 15 Level 1 requirements. Use the current rule and assessment guide to organize your review.
Assess implementation, not the appearance of a packet
A completed template does not establish that a safeguard operates. Review how accounts are approved, how visitors are escorted, how anti-malware is maintained, and how information is restricted to approved people and systems. Collect artifacts that demonstrate each applicable objective. An explanation should identify the real system, responsible person, operating process, and supporting evidence.
Annual assessment and affirmation
The organization conducts its Level 1 self-assessment annually and enters results in SPRS. Its affirming official submits the required affirmation of continuing compliance. All Level 1 requirements must be met; a Plan of Action and Milestones is not permitted for achieving Level 1 status. Fix a missing safeguard before representing the environment as meeting the level.
A useful preparation sequence
Confirm the FCI boundary, review all 15 requirements, document what is met, close gaps, and have an accountable leader review the results. Keep a recurring calendar for account reviews, patches, physical access records, reassessment, and affirmation. Preparation support can organize this work, while the contractor remains responsible for its systems and its representations.