CMMC and NIST SP 800-171
CMMC Level 1 Overview
The 15 basic safeguards for federal contract information and how the annual self-assessment works
Awareness · 1.5 hours · Certificate does not expire
CMMC Level 1 is the entry point to the Cybersecurity Maturity Model Certification programme. It applies to defense suppliers whose contracts call for it and who hold federal contract information: purchase orders, schedules, quality clauses, invoices and the emails that carry them. The requirement reaches small companies through DFARS 252.204-7021, which has been phasing into new solicitations since 10 November 2025, and a current status in SPRS is a condition of award. DoD's July 2026 suspension of the next phase concerns third-party Level 2 assessments; Level 1 self-assessments continue.
This awareness course explains what CMMC is, how the three levels differ and who needs Level 1. It then takes the 15 requirements of FAR 52.204-21, grouped into the 6 CMMC domains, and explains each in plain language with what it looks like in a small machine shop, distributor or service provider. You learn how to scope the annual self-assessment, how the senior official's affirmation in SPRS works, why no plan of action is allowed at Level 1 and what evidence to keep for 6 years. The last module covers the gaps found most often and what every employee is responsible for.
The course is awareness level. It is anchored on 32 CFR Part 170, FAR 52.204-21 and the CMMC Level 1 Assessment and Scoping Guides published by the DoD CIO. It does not give legal advice, does not make anyone an assessor and does not replace your company's procedures.
The course closes with a 10-question examination drawn from a bank of 20. On passing you receive a PlanetISO Certificate of Completion with lifetime access to the course content and your certificate. The certificate does not expire.
What people learn
- Explain what the CMMC programme is, how 32 CFR Part 170 and DFARS 252.204-7021 bring it into contracts, and how the three levels differ.
- Define federal contract information and decide whether a given document or system is in scope for Level 1.
- Describe each of the 15 FAR 52.204-21 requirements in plain language and recognize what MET looks like in a small company.
- Outline the annual self-assessment: scoping, the examine, interview and test methods, the SPRS entry and the senior official's affirmation.
- State why Level 1 permits no plan of action and what evidence must be retained for 6 years.
- Identify the common gaps that stop a small supplier reaching Level 1 and the daily habits every employee must keep.