CMMC Level 1 sample

Know the scope.
Keep the evidence.

A sample L1 Starter file: scope assessment, essential policies, evidence guidance and an SPRS overview. Statuses are fictional working notes.

Read the sample scorecard

Sample FCI scope excerpt. Included and excluded areas from the scope register below.
Area	Sample boundary decision
Included	Work email, managed office computers, contract folder, office network, printer and paper storage.
Excluded by design	Public marketing site and guest Wi-Fi. Validate that no FCI crosses into either.

Where FCI sits.

Sample scope. Email, computers, the contract folder and printed work documents hold Federal Contract Information. Public website and guest Wi-Fi are outside this sample boundary; no FCI is permitted there.

Sample scope register. A real assessment confirms every asset that processes, stores or transmits FCI.
Area	Sample boundary decision
Included	Work email, managed office computers, contract folder, office network, printer and paper storage.
Excluded by design	Public marketing site and guest Wi-Fi. Validate that no FCI crosses into either.
Assumption to confirm	This sample handles FCI. Any CUI requires a separate scope and requirement review.

All 15 safeguarding requirements.

Sample scorecard summary. These are readiness notes, not an official SPRS result.
Sample status	Requirements
Met	8
Partly met	5
Not met	2

The requirement text below is from FAR 52.204-21(b)(1). Practice IDs follow the DoD CMMC Assessment Guide, Level 1, Version 2.13. Both were fetched 2026-10-18.

Sample labels "Partly met" and "Not met" identify work remaining. Official Level 1 requires every applicable requirement to be MET and permits no POA&M. A readiness action list does not create a conditional Level 1 status. 32 CFR 170.15(a)(1).

AC.L1-b.1.i

Sample: Met

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

AC.L1-b.1.ii

Sample: Partly met

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

AC.L1-b.1.iii

Sample: Not met

Verify and control/limit connections to and use of external information systems.

AC.L1-b.1.iv

Sample: Met

Control information posted or processed on publicly accessible information systems.

IA.L1-b.1.v

Sample: Met

Identify information system users, processes acting on behalf of users, or devices.

IA.L1-b.1.vi

Sample: Met

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

MP.L1-b.1.vii

Sample: Partly met

Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

PE.L1-b.1.viii

Sample: Met

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

PE.L1-b.1.ix

Sample: Partly met

Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

SC.L1-b.1.x

Sample: Met

Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

SC.L1-b.1.xi

Sample: Met

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

SI.L1-b.1.xii

Sample: Partly met

Identify, report, and correct information and information system flaws in a timely manner.

SI.L1-b.1.xiii

Sample: Met

Provide protection from malicious code at appropriate locations within organizational information systems.

SI.L1-b.1.xiv

Sample: Partly met

Update malicious code protection mechanisms when new releases are available.

SI.L1-b.1.xv

Sample: Not met

Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

Evidence with a clear owner.

Sample evidence checklist. Collect records that show each practice in use, such as visitor logs and a sign-in walkthrough.

Sample evidence checklist. The business supplies and maintains these records.
Evidence	Sample owner and review
Authorized accounts and permissions	Office lead: compare the user list to current staff and approved roles.
External connections and public content	Technical lead: list approved connections, data restrictions and publication reviews.
Authentication and managed devices	Technical lead: retain settings evidence and an observed sign-in walkthrough.
Media disposal and physical access	Office lead: retain disposal records, visitor logs and key access records.
Network boundaries and public systems	Technical lead: retain the network diagram and boundary configuration evidence.
Updates, malware protection and scans	Technical lead: retain update records, protection status and scan schedules with results.

Essential policies and procedures.

Sample policy excerpt and operating procedure.

Access and FCI handling

Only approved staff may use the contract folder. The office lead records approval before access is granted. Staff keep contract files in the designated work system. Visitors stay with an authorized escort. Paper contract material stays in controlled storage and goes through approved disposal.

Sample procedure: approve the account and role, verify the configured access, record the review, and remove access when the role ends. The evidence owner retains the record and checks the FCI boundary when systems change.

CMMC program dates.

These are public program dates, separate from the fictional company statuses. A contract determines the requirement that applies.

Public CMMC program dates. The note below marks which dates are calculated.
Date	Rule and milestone
October 15, 2024	CMMC program final rule published. Rule source
December 16, 2024	CMMC program rule effective. Rule source
September 10, 2025	DFARS acquisition rule published. Rule source
November 10, 2025	DFARS rule effective. Phase 1 begins with Level 1 and Level 2 self-assessment requirements in applicable awards. Rule source
November 10, 2026	Phase 2 begins one calendar year later; Level 2 third-party assessment requirements expand. Rule source
November 10, 2027	Phase 3 begins; further Level 2 and Level 3 requirements apply. Rule source
November 10, 2028	Phase 4 begins: full implementation for applicable contracts and option periods. Rule source

Phase 2 through Phase 4 dates are calculated from the one-calendar-year intervals in 32 CFR 170.3(e), anchored to the DFARS effective date. Sources fetched 2026-10-18.

The SPRS overview.

Level 1 uses an annual self-assessment with results entered in SPRS. A senior affirming official submits the affirmation after assessment and annually thereafter. The organization retains its assessment evidence for six years from the CMMC status date. Assessment and retention: 32 CFR 170.15; annual affirmation: 32 CFR 170.22. Sources fetched 2026-10-18.

Sample coaching agenda: confirm the FCI boundary, review each readiness note against evidence, assign unresolved work and explain the SPRS fields. ThinkCodec provides readiness guidance. The company implements safeguards, verifies the evidence and submits its own assessment and affirmation.

Scope your Level 1 work.

Bring the contract request and the evidence you already have. Agree the consulting scope and the company's implementation tasks before work starts.

Book a free CMMC gap call

Read the L1 Starter offer