CMMC Level 1 is the foundational tier of the Cybersecurity Maturity Model Certification, the Department of Defense program that verifies contractors protect government data. Level 1 covers the 15 basic safeguarding requirements in FAR clause 52.204-21 and protects Federal Contract Information (FCI), not Controlled Unclassified Information. Contractors confirm compliance through an annual self-assessment and an affirmation entered in the Supplier Performance Risk System (SPRS).
What controls does CMMC Level 1 require?
Level 1 maps to the 15 requirements of FAR 52.204-21, the basic safeguarding clause every DoD contract already carries. They group into a handful of practical obligations:
- Access control: limit system access to authorized users, processes, and devices, and control who connects from outside.
- Identification and authentication: identify users and devices before granting access.
- Media protection: sanitize or destroy media holding FCI before disposal or reuse.
- Physical protection: limit physical access to systems and keep visitor activity logged.
- System and communications protection: monitor and control communications at the network boundary, and separate public-facing systems from internal ones.
- System and information integrity: patch flaws, run malware protection, and act on threat alerts.
Unlike CMMC Level 2, Level 1 does not require a third-party assessment or a Plan of Action and Milestones. Every requirement must be fully met at self-assessment time.
Who needs CMMC Level 1?
Any organization in the Defense Industrial Base that handles FCI but no CUI. That includes a large share of small suppliers, machine shops, and service vendors whose contracts involve non-public information generated for the government but nothing controlled. If your contract only ever touches FCI, Level 1 is your bar. The moment CUI enters the environment, you move to Level 2.
How is CMMC Level 1 different from Level 2?
The dividing line is the data. Level 1 protects FCI with 15 self-assessed requirements. Level 2 protects CUI against all 110 NIST SP 800-171 Rev 2 controls and, for most contracts, requires a C3PAO assessment every three years. Level 1 is a floor of basic hygiene. Level 2 is a graded, audited security program.
Why does CMMC Level 1 matter for OT and industrial environments?
Most defense manufacturers run FCI and OT on the same site: shop-floor PCs, machine controllers, and shared file servers next to the office network. Even at Level 1, the boundary controls and access limits push you toward segmenting that plant network so authorized users and devices are the only ones reaching FCI systems. Doing that early makes the jump to Level 2 and a zero-trust architecture far less painful, because the segmentation work is already done.
Related terms
- CMMC
- CMMC Level 2
- NIST SP 800-171
- Controlled Unclassified Information (CUI)
- Defense Industrial Base (DIB)
How Access Gate helps
Access Gate segments FCI and OT systems on the existing plant network with an identity-enforced overlay, so authorized users and devices are the only ones that reach them, no recabling required. See CMMC compliance.
