CMMC Level 1 Requirements and Real Costs in 2026

CMMC Level 1 requirements are 15 security controls that a defense contractor self-assesses every year and affirms in the Supplier Performance Risk System. All 15 come from FAR clause 52.204-21, which has been in Department of Defense contracts since 2016. Meanwhile, the Department puts the yearly cost at $5,977 for a small entity, and that figure assumes you already put all 15 controls in place.

On July 13, 2026, the Department of War suspended CMMC Phase II. However, Phase 1 did not move. I watched half the trade press that week tell small contractors that CMMC was dead. In fact, the Department’s own program page says the opposite in one sentence: all Phase I self-assessment requirements remain firmly in place.

That distinction decides whether you can take an award. A contracting officer checks your status in SPRS before award, and an empty record is a bar, not a paperwork problem. For that reason, this guide covers what the CMMC Level 1 requirements are, what the self-assessment actually costs, and what the suspension did and did not change.

What are the 15 CMMC Level 1 requirements?

They are the basic safeguarding controls at FAR 52.204-21(b)(1), a clause dated November 2021 that protects Federal Contract Information. CMMC Level 1 requirements add no new control on top of that clause. Instead, what CMMC adds is proof: an annual self-assessment scored against a published method, and an affirmation signed by a named person.

How is each control scored?

32 CFR 170.15 scores the 15 controls against the objectives in NIST SP 800-171A. Table 2 in that section maps the 15 onto 17 NIST SP 800-171 Revision 2 requirements, because one control breaks into three phrases. Each of the 17 then carries its own list of assessment objectives. As a result, the job is larger than a 15-item list makes it look.

Which CMMC Level 1 requirements take the most work?

Three of those rows carry more work than one line suggests. PE.L1-b.1.ix is three separate jobs, which is why NIST scores it against three objectives. Similarly, boundary protection at SC.L1-b.1.x is where a firm running a flat office network with one consumer router has real work to do.

Is CMMC still required after the July 2026 suspension?

Yes, at Level 1 and Level 2 self-assessment. Specifically, the Department suspended the move to Phase II, which was set for November 10, 2026, and it suspended the implementation milestones after that. It also stood up a CMMC Reform Task Force and started a 60-day study of the program.

What survived is the part that reaches the smallest firms. Indeed, the program page states that CMMC is paused in Phase 1 and can require self-assessments at two levels. In other words, third-party certification by a C3PAO is the thing that stopped, and Level 1 never used a C3PAO.

Which cybersecurity obligations did not pause?

Two obligations sit outside CMMC and did not pause at all. DFARS clause 252.204-7012 still requires you to safeguard covered defense information and to report cyber incidents. Meanwhile, during the review the Department says it will enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments.

One thing the announcement did not address is the contract you already signed. Neither the release nor the program page says anything about awards that already carry clause 252.204-7021. So until the Department issues a deviation, read your own contract rather than the press release.

Do you need Level 1 or Level 2?

The answer follows the information, not the size of your company. First, Level 1 covers Federal Contract Information. FAR 4.1901 defines it as information that is not for public release and that comes from a contract to deliver a product or service. In practice, the Government either hands it to you or you generate it for the Government. By contrast, Level 2 covers Controlled Unclassified Information, defined at 32 CFR 2002.4(h).

Almost every unclassified Department contract creates Federal Contract Information. For example, a delivery schedule, a statement of work, and an unpriced drawing package all qualify. However, payment data and anything the Government already publishes do not. If a solicitation hands you a technical data package marked CUI, you are looking at Level 2 and a much larger bill.

Moreover, the two levels differ in rhythm as well as in cost. A Level 1 self-assessment runs every year, and 32 CFR 170.15 permits no plan of action and milestones at all. In other words, every one of the 15 controls must be MET on the day you submit. By contrast, Level 2 self-assessment runs every three years, allows a plan of action under 32 CFR 170.21, and gives you 180 days to close it.

How much do CMMC Level 1 requirements cost?

The Department published its own estimate of what CMMC Level 1 requirements cost, and the number that matters for a small firm is $5,977 a year. That covers planning the assessment, running it, entering results in SPRS, and the affirmation. However, it does not cover buying or fixing a single control, because the rule assumes you already met FAR 52.204-21.

That comparison runs backwards from what you expect. In fact, a small entity pays about 48 percent more than a large one for the same annual self-assessment. The rule explains why in its assumptions: a large firm has salaried security staff. A small firm, by contrast, hires an external service provider at $260.28 an hour.

Treat that total as a floor rather than a budget. After all, it is labor for the assessment alone. Suppose your network has no boundary controls, no media sanitization process, and no antivirus management. The engineering work to reach MET on all 15 controls then sits on top of that number. Yet the rule estimates none of it.

Can you self-certify against CMMC Level 1 requirements?

Under CMMC Level 1 requirements, you assess yourself, and the regulation calls the result Final Level 1 (Self). There is no Conditional Level 1, because no plan of action is permitted. Of course, you can pay a consultant to help you run it, and 32 CFR 170.15 still treats that as a self-assessment.

Who signs the Level 1 affirmation?

The affirmation is the part firms get wrong. Specifically, 32 CFR 170.22 requires an Affirming Official. That is the senior representative inside your company who is responsible for CMMC compliance and has authority to affirm it. That person then signs in SPRS after the assessment and every year after that. Therefore, an outside consultant cannot sign for you.

• First, scope the systems that process, store, or transmit Federal Contract Information, under 32 CFR 170.19.
• Next, assess all 15 controls against the NIST SP 800-171A objectives, substituting Federal Contract Information wherever an objective names CUI.
• Then enter the CMMC level, status date, assessment scope, every associated CAGE code, and the compliance result in SPRS.
• After that, have the Affirming Official submit the affirmation in SPRS for each CMMC UID.
• Also, keep the evidence for six years from the CMMC Status Date, under 32 CFR 170.15(c)(2).
• Finally, repeat the whole cycle every year, because a Final Level 1 status older than one year is no longer current.

The six-year retention line is the quiet one. A self-assessment with no artifacts behind it is an assertion, and the affirmation carries a signature. For example, firms that keep screenshots in a shared drive folder named by date have an easier conversation later than firms that keep nothing.

What happens at award if you miss CMMC Level 1 requirements?

If you have not met CMMC Level 1 requirements in SPRS, the contracting officer cannot award to you. That is because DFARS 204.7503(b) directs the officer to check SPRS before award. An offeror without a current status at the necessary level for every CMMC UID cannot take that award. Likewise, the same check at 204.7503(c) blocks an option exercise and a period-of-performance extension.

Clause 252.204-7021, dated November 2025, then carries three duties through performance. First, you hold the status for the life of the contract. Second, you process Federal Contract Information only on systems at that level or higher. Finally, you affirm compliance annually in SPRS.

Primes have a fourth duty that reaches down the supply chain. Paragraph (f)(1) flows the substance of the clause into subcontracts, including commercial ones, and excludes only commercially available off-the-shelf items. Paragraph (d)(4) goes even further: the prime must make sure each subcontractor completes its affirmation before the subcontract is awarded, not after. So if you sell to primes, expect that question in a request for quote long before a contracting officer asks it.

How many contractors do CMMC Level 1 requirements reach?

CMMC Level 1 requirements reach the largest tier of the program by a wide margin. Additionally, the Department projected the phase-in in the final rule, and at full scale it expects 30,184 entities at Level 1, of which 22,336 are small. However, those counts assume the original four-phase schedule, so the July 2026 suspension pushes the later years out.

Now set that against the money on the table. In fiscal 2025 the Department of Defense obligated $491.8 billion on prime contracts, and $102.6 billion of it went to small business recipients, per USASpending.gov. So, judged as an entry fee to a market that size, a five-figure assessment would still pay for itself on one award.

Small manufacturers and distributors feel this first, because they bid the highest-volume solicitations in the Department. For example, anyone quoting through DLA DIBBS is already handling Federal Contract Information on every request for quote. Similarly, firms selling through a GSA Schedule hit the same clause the moment a Department order lands on the contract.

Compliant is the cheap part

Every founder I talk to expects the certification to be the wall. It is not, however. Instead, the wall arrives afterward. Even so, a registered, assessed and affirmed firm still faces a solicitation list. Yet nothing in that list says which items are worth a week of work.

Cybersecurity clauses are a good example of the problem, because they almost never appear in the notice. Instead, the necessary CMMC level lives in provision 252.204-7025 inside the solicitation package. Typically, it sits next to the wage determination, the packaging specification, and the qualification requirement that rules you out on page 40 of an attachment. As a result, reading that stack by hand is how small teams lose their week.

Procura Federal was built for that stack. It opens every attachment behind a notice and scores the requirement against your capability statement. It also surfaces the clauses that gate eligibility before you spend a day on the response. That matters because a quote you can win and a quote that demands a Level 2 status you do not hold read the same in a notice title. In addition, a seat costs $399/month, a fraction of what the incumbent platforms charge, and our price-by-price comparison of contract search platforms shows the gap.

Frequently asked questions about CMMC Level 1

How long is a CMMC Level 1 self-assessment good for?

One year. Specifically, clause 252.204-7021 defines a current Final Level 1 (Self) status as one not older than one year, with an affirmation of the same age.

Do I need a third-party assessor for Level 1?

No. Instead, a C3PAO assessment applies only at Level 2 when a contract calls for it. In any case, the Department suspended that phase on July 13, 2026.

Does CMMC apply to commercial off-the-shelf sales?

No, because DFARS 204.7504(a) excludes awards solely for commercially available off-the-shelf items, and the clause excludes them from flowdown as well.

What is a CMMC UID?

It is the 10-character identifier SPRS assigns to each assessment of each contractor information system. You then give the identifiers to the contracting officer, and every status and affirmation attaches to one.

Do civilian agency contracts require CMMC?

Not through this clause. CMMC lives in the DFARS, so it reaches Department contracts. However, FAR 52.204-21 itself applies government-wide, which means the 15 controls are already a term of most federal work.