CMMC Level 1:
Foundational Cybersecurity
CMMC Level 1 applies to every DoD contractor that handles Federal Contract Information (FCI). Here is everything you need to know about the 17 required practices, the self-assessment process, and how to get compliant.
Who Needs CMMC Level 1?
CMMC Level 1 is required for any company that receives, processes, or stores Federal Contract Information (FCI) under a DoD contract or subcontract.
FCI is defined as information provided by or generated for the government under a contract to develop or deliver a product or service to the government — and that is not intended for public release.
This means even small businesses, sole proprietors, and subcontractors deep in the DoD supply chain may be required to achieve CMMC Level 1.
Key Facts About CMMC Level 1
The Requirements
The 17 CMMC Level 1 Practices
These 17 practices are derived from FAR 52.204-21 and cover six security domains. Every DoD contractor handling FCI must implement all 17.
Access Control
4 practicesOnly allow authorized users, processes, and devices to access your company's information systems and Federal Contract Information.
Ensure users can only perform the specific functions their role requires — no more access than necessary.
Verify and control all connections to external systems, including cloud services and third-party networks.
Regulate what information is posted or processed on publicly accessible systems to prevent unauthorized FCI disclosure.
Identification & Authentication
2 practicesAll users, processes, and devices that access your systems must be identified — no anonymous or generic accounts.
Verify the identity of all users, processes, and devices before granting access — passwords, MFA, or certificates.
Media Protection
1 practiceSecurely wipe or destroy hard drives, USB drives, and other media containing FCI before disposal or reuse.
Physical Protection
4 practicesRestrict physical access to computers, servers, and network equipment to authorized personnel only.
Escort visitors in sensitive areas and maintain logs of visitor access to your facilities.
Keep records of who physically accesses areas containing information systems that process FCI.
Control and track physical access devices such as keys, key cards, and access badges.
System & Communications Protection
2 practicesMonitor and control your network at external boundaries and key internal boundaries — firewalls are typically required.
Separate publicly accessible system components (like web servers) into isolated subnetworks from internal systems.
System & Information Integrity
4 practicesApply security patches and fix known vulnerabilities in your operating systems and software in a timely manner.
Deploy antivirus and anti-malware software on all systems that process or store FCI.
Keep antivirus and anti-malware definitions current — enable automatic updates where possible.
Run regular scheduled scans of your systems and enable real-time scanning of all files.
The Process
The CMMC Level 1 Self-Assessment Process
Unlike Level 2 and Level 3, CMMC Level 1 does not require a third-party auditor. You self-assess, affirm, and submit your score to the DoD's SPRS system.
Conduct Internal Review
Assess your organization against all 17 practices. Galaxy's RPs guide you through each one.
Calculate Your SPRS Score
Document your compliance status. Each unmet practice reduces your score from the maximum of 110.
Create a Plan of Action
For any gaps, document a corrective action plan with target completion dates.
Affirm and Submit to SPRS
A senior company official affirms the assessment results and submits your score to the DoD's Supplier Performance Risk System (SPRS).
Annual Renewal
CMMC Level 1 self-assessments must be renewed annually and affirmed by a senior official each year.
How Galaxy Consulting Helps
As your CMMC RPO, Galaxy Consulting guides you through every step of this process. Our Registered Practitioners conduct the gap assessment, help remediate deficiencies, draft your SSP and documentation, and prepare your team for the self-assessment and SPRS submission — so you can focus on running your business.
See Our CMMC ServicesNot Sure Where to Start?
Galaxy Consulting offers a free initial consultation to help you understand your current CMMC Level 1 posture and what it will take to get certified.