What is CMMC Level 1?

CMMC Level 1 is the baseline certification tier for organizations that handle Federal Contract Information (FCI) but not Controlled Unclassified Information (CUI). It requires implementation of 15 basic safeguarding requirements from FAR 52.204-21 and is satisfied through an annual self-assessment rather than a third-party audit.

Do I need a C3PAO assessment for CMMC Level 1?

No. CMMC Level 1 only requires an annual self-assessment. The organization’s senior official affirms the results in the Supplier Performance Risk System (SPRS). Third-party C3PAO assessments are required for CMMC Level 2.

What format is the CMMC Level 1 Control Matrix in?

The matrix is a Microsoft Excel (.xlsx) file that is also compatible with Google Sheets. It lists all 15 FAR 52.204-21 requirements with columns for implementation status and notes.

How often do I need to update my Level 1 self-assessment?

CMMC Level 1 self-assessments and the corresponding SPRS affirmation must be completed at least annually, or sooner if your environment or contract requirements change.

Download CMMC Level 1 Controls Spreadsheet

What Is the CMMC Level 1 Control Matrix?

CMMC Level 1 applies to any organization that handles Federal Contract Information (FCI) but not Controlled Unclassified Information (CUI). It consists of 15 basic safeguarding requirements drawn directly from FAR 52.204-21, covering fundamental cyber hygiene practices like access control, authentication, media protection, and system monitoring. The DoD CIO’s CMMC program page is the authoritative source for how Level 1 fits into the broader CMMC 2.0 model.

Unlike Level 2, which requires a third-party assessment by an accredited C3PAO, Level 1 is satisfied through an annual self-assessment that the organization’s senior official affirms in the Supplier Performance Risk System (SPRS). That makes a clear, working record of each control and its implementation status essential — both to guide the work and to support the affirmation.

The CMMC Level 1 Control Matrix is a spreadsheet that lists all 15 requirements in one place so you can track where your organization stands and identify gaps before they become findings.

What’s Included in the Spreadsheet

All 15 FAR 52.204-21 basic safeguarding requirements, organized by control family (Access Control, Identification & Authentication, Media Protection, Physical Protection, System & Communications Protection, and System & Information Integrity)
Plain-language descriptions of what each control requires
An implementation status column to mark each control as implemented, partially implemented, or not implemented
A notes column to record how each control is met, who owns it, and any supporting evidence

Who Should Use This Spreadsheet

This matrix is built for organizations that:

Handle FCI but not CUI, and therefore fall under CMMC Level 1 rather than Level 2
Need to prepare for or document an annual self-assessment
Want a simple way to track control implementation status across the organization before completing their SPRS score submission

Download the CMMC Level 1 Control Matrix

Download Spreadsheet

Using the Matrix to Prepare for Self-Assessment

Work through the spreadsheet control by control:

Mark each control’s current implementation status
Note how the control is met and where supporting evidence lives
Assign an owner for any control that is partially implemented or not yet implemented
Revisit the matrix before your annual affirmation to confirm nothing has drifted since the last review

Because Level 1 status is self-attested, keeping this record current is what stands behind your SPRS score if it is ever questioned by a prime contractor or the DoD.

How Espresso Labs Can Help

Filling out a spreadsheet is the easy part. Actually implementing, evidencing, and maintaining all 15 controls year over year is where most organizations lose time. Espresso Labs delivers CMMC Level 1 (and the path to Level 2) as a managed service — implementing the required safeguards, keeping documentation current, and standing behind your annual self-assessment so it holds up if a prime contractor or the DoD ever asks questions.

Schedule a Demo