Can you fail a CMMC Level 1 self-assessment?

In practice, yes: Level 1 is pass or fail. All 15 practices must be met before you affirm, because Level 1 has no partial credit, no POA&M, and no conditional status. A practice marked Not Met is a gap to close first; affirming with known gaps creates real legal risk.

How much does CMMC Level 1 compliance cost?

Level 1 is the cheapest CMMC level because no third-party assessor is involved. You self-assess the 15 practices, and most of the cost is time: writing basic policies, tightening account and access hygiene, and documenting evidence. Many small contractors already meet most practices and mainly need to document them.

Does CMMC Level 1 require multi-factor authentication?

No. Level 1 requires identifying users and authenticating them before granting access, and a password meets that baseline. Multi-factor authentication becomes an explicit requirement at Level 2 (3.5.3). MFA is still strongly recommended at Level 1 because it is inexpensive and materially reduces account compromise risk.

Where do I submit my CMMC Level 1 self-assessment?

You submit the results to the Supplier Performance Risk System (SPRS) through the PIEE portal, and a senior company official affirms continuous compliance. Both the self-assessment and the affirmation must be renewed annually to keep Final Level 1 status current for contract awards.

Which domains do the 15 Level 1 practices cover?

The 15 practices span six domains: Access Control (4 practices), Identification and Authentication (2), Media Protection (1), Physical Protection (2), System and Communications Protection (2), and System and Information Integrity (4). Together they cover basic hygiene: who can access systems, how users are verified, and how equipment, media, and networks are protected.

CMMC Level 1: 15 Practices and Self-Assessment

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}CMMC Level 1: 15 Practices and Self-AssessmentUnderstand all 15 CMMC Level 1 practices across 6 domains with plain-language descriptions and step-by-step guidance on what each requires you to do.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.