CMMC Level 1 Self-Assessment Starter
For Small Defense Suppliers
A plain-language guide to the 15 requirements in Federal Acquisition Regulation (FAR) clause 52.204-21, the rules behind a Cybersecurity Maturity Model Certification (CMMC) Level 1 self-assessment. Use it to see where your company stands before your senior official affirms in the Supplier Performance Risk System (SPRS). It costs nothing.
What Is Inside
- The guide (about 11 pages). Who needs Level 1, how to self-assess, and all 15 requirements. Each one shows the FAR text word for word, what it means in plain language, questions to ask yourself, and evidence ideas.
- The Quick Score workbook (Excel). Pick Yes, Partly, or No for each requirement. Level 1 is pass or fail, so the workbook says Ready to affirm only when all 15 are met.
- The Affirmation Readiness Worksheet (two pages). A checklist to complete before the annual affirmation: who signs, what evidence to keep, and what goes into SPRS.
- The Starter Sources file (two pages). Where each rule comes from: FAR 52.204-21 and Title 32 of the Code of Federal Regulations (CFR) sections 170.15 and 170.22, with links to the official text.
This starter is a planning aid. It is not a CMMC assessment, a certification, or legal advice, and it does not guarantee any result. Level 1 is a self-assessment. Your company performs it and your senior official affirms it.
Who it is for
Small companies that handle Federal Contract Information (FCI) under a Department of Defense contract or subcontract that includes Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7021 or 252.204-7025 and names CMMC Level 1 (Self), and that have no full-time information technology staff. The CMMC duty comes from those DFARS clauses, and FAR 52.204-21 supplies the 15 requirements. If your contract involves Controlled Unclassified Information, expect Level 2 or higher. Your contract decides the level.
How this starter is different
- Plain language. Written for an owner or office manager, not for a compliance department.
- Prepared by a credentialed person. Thabiti Adams holds the Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), CMMC Certified Professional (CCP), and CompTIA Security+ credentials and has more than 18 years in information technology and cybersecurity, much of it on the Department of Defense side. A CCP credential does not make this starter an assessment.
- Veteran-owned. Adams Cloud & Cybersecurity is a Service-Disabled Veteran-Owned Small Business (SDVOSB) in Santee, California.
- Prices posted, not hidden. If you want more than the free starter, every paid option has a fixed price published on our CMMC Self-Assessment Kits page.
How to Use It
Download
Enter your name and email. The four files appear on this page right away.
Check your contract and scope
Confirm DFARS 252.204-7021 or 252.204-7025 and Level 1 are in your contract. FAR 52.204-21 supplies the 15 requirements. List the people, systems, and places that handle FCI.
Score the 15
Work through each requirement and record Yes, Partly, or No. Only Yes counts as met. If a requirement truly does not apply, answer Yes and write the reason.
Get ready to affirm
Complete the worksheet and fix any gaps before your senior official affirms in SPRS.
Get the CMMC Level 1 Self-Assessment Starter
Enter your name and email and the download links appear on this page. We also email you a copy of the links.
Your starter is ready.
We also sent the links to your email. If it does not arrive within a few minutes, check your spam folder, or write to thabiti@adamscloudcyber.com.
Save the links on this page. Email delivery did not complete, so write to thabiti@adamscloudcyber.com if you would like a copy by email.
Common Questions
Is this a CMMC certification?
No. Level 1 does not use a certification assessor. It is a self-assessment that your company performs and that your senior official affirms in SPRS, as described in 32 CFR 170.15 and 170.22. This starter helps you prepare. It does not assess or certify anything.
Does Level 1 have a score?
Not a point score. Under 32 CFR 170.24, Level 1 is scored MET or NOT MET in its entirety. All 15 requirements must be met, and no Plan of Action and Milestones is permitted. The point score from minus 203 (calculated from the Department of Defense point values) to 110 belongs to Level 2.
Who signs the affirmation?
A senior representative from within your company who is responsible for compliance and has the authority to affirm. The guide and the worksheet explain this, including the False Claims Act responsibility that comes with it.
Do I have to buy anything?
No. You can run your Level 1 self-assessment with the free starter alone.
If You Want More Than the Free Starter
The free starter is enough to run a Level 1 self-assessment. Some companies want the written policies, the objective-by-objective walkthrough, an evidence tracker, or a review of their finished work. Those options have fixed, one-time prices that are posted here and on the kits page.
| Option | What it is | Price |
|---|---|---|
| CMMC Level 1 Self-Assessment Kit | Walkthrough of each requirement and assessment objective, self-assessment workbook with evidence tracker, policy and procedure set, remediation plan template, and the affirmation and SPRS steps. | $297 |
| CMMC Level 2 Self-Assessment Kit | For companies that handle Controlled Unclassified Information: the 110 requirements in National Institute of Standards and Technology (NIST) Special Publication 800-171 Revision 2 in plain language, scoring workbook, and System Security Plan template. | $497 |
| Kit plus Review Call | Either kit plus one review of your completed workbook with Thabiti Adams, CISSP, CCSP, CCP, and CompTIA Security+. | $697 (Level 1) $997 (Level 2) |
See every option, including Guided packages and the Hands-on Assessment, on the CMMC Self-Assessment Kits page. A kit is a set of working documents. It supports your own self-assessment, is not a certification, and does not guarantee a result.
Sources
- FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (acquisition.gov)
- 32 CFR Part 170, Cybersecurity Maturity Model Certification Program, including sections 170.15, 170.22, and 170.24 (eCFR)
- Department of Defense Chief Information Officer, CMMC Program and Level 1 Assessment Guide
- Supplier Performance Risk System (SPRS)
Want a Second Set of Eyes?
We help small defense suppliers prepare for CMMC self-assessments and turn the gaps into a plan their staff can follow. See our CMMC assessment page.