What Is CMMC Level 1 Compliance?
Protect Federal Contract Information. Maintain DoD contract eligibility. palmiq delivers the FCI scoping, gap analysis, control implementation, and self-assessment preparation you need to meet all 15 FAR 52.204-21 practices and submit to SPRS with confidence.
CMMC Level 1 (Foundational) is the first tier of the Department of Defense's Cybersecurity Maturity Model Certification program. It requires defense contractors and subcontractors to implement 15 basic cybersecurity practices derived from FAR Clause 52.204-21 to protect Federal Contract Information (FCI) — any non-public information provided by or generated for the government under a contract, from contract numbers and delivery schedules to proposals and invoices. If your organization handles FCI but not Controlled Unclassified Information (CUI), Level 1 is your compliance target. Unlike Level 2, Level 1 uses a self-assessment model with no third-party audit — but compliance is all-or-nothing: every practice must be fully implemented before you can submit to the Supplier Performance Risk System (SPRS), and Plans of Action & Milestones are not permitted.
CMMC Level 1 at a Glance
- 15
- Required practices from FAR 52.204-21 — every one must be MET, pass or fail
- 6
- Security domains, from Access Control through System & Information Integrity
- 0
- POA&Ms allowed — unlike Level 2, there is no conditional pass at Level 1
- 63%
- Of the Defense Industrial Base is estimated by the DoD to need Level 1
Enforcement Is Live
CMMC Level 1 requirements began appearing in DoD solicitations and contracts on November 10, 2025. Contractors without a current CMMC status in SPRS risk losing eligibility for existing and new DoD contracts.
Sound Familiar?
These are the problems defense contractors bring to palmiq when preparing for CMMC Level 1.
“We Don’t Know What Counts as FCI or What’s in Scope.”
palmiq maps your FCI data flows, identifies every system, person, facility, and service provider that processes, stores, or transmits FCI, and defines the precise assessment boundary — minimizing scope without missing assets.
“It’s Pass/Fail and We Can’t Afford to Get It Wrong.”
No POA&Ms are allowed at Level 1. Every practice must be MET before you can submit to SPRS. palmiq conducts a thorough gap analysis and closes every gap before your self-assessment so there are no surprises.
“We Don’t Have Documentation or Evidence.”
Even though Level 1 doesn’t require a System Security Plan, you need verifiable evidence for every practice. palmiq creates your information security policy, gathers evidence (screenshots, configs, logs, access lists), and builds an audit-ready package.
“We Don’t Have IT Staff to Implement the Controls.”
As a full-service MSP, palmiq doesn’t just assess — we implement. Access controls, MFA, antivirus, firewalls, media sanitization, visitor management: we handle all 15 practices and manage them ongoing.
Six Domains of CMMC Level 1
All 15 practices are organized across six security domains derived from FAR 52.204-21. Every practice must be fully MET — no exceptions.
Access Control
Limit system access to authorized users
Limit access to authorized transaction types and functions
Verify and control connections to external systems
Control information on publicly accessible systems
Identification & Authentication
Identify system users, processes, and devices
Authenticate identities before granting system access
Media Protection
- Sanitize or destroy media containing FCI before disposal or reuse
Physical Protection
Limit physical access to authorized individuals
Escort visitors and monitor visitor activity
Maintain audit logs of physical access
Control and manage physical access devices
System & Communications Protection
Monitor, control, and protect communications at system boundaries
Implement subnetworks for publicly accessible system components
System & Information Integrity
Identify, report, and correct system flaws in a timely manner
Provide protection from malicious code at designated locations
What palmiq’s CMMC Level 1 Services Include
-
FCI Scoping & Asset Inventory
- Map FCI data flows across people, systems, and facilities
- Identify all in-scope assets that process, store, or transmit FCI
- Determine enclave vs. enterprise scope strategy
- Identify specialized assets excluded from assessment
- Document assessment boundary and scope rationale
-
Gap Analysis & Remediation
- Evaluate all 15 practices against assessment objectives
- Document MET/NOT MET status for each practice
- Identify every gap blocking a passing self-assessment
- Deliver prioritized remediation plan with timelines
- Close all gaps before self-assessment (no POA&Ms allowed)
-
Control Implementation
- Access control: user account management, least privilege, MFA
- Boundary protection: firewalls, DMZ, network segmentation
- Endpoint protection: antivirus, anti-malware, patch management
- Physical security: visitor logs, badge access, media destruction
- Identity management: user identification, authentication enforcement
-
Self-Assessment & SPRS Submission
- Conduct formal self-assessment per NIST 800-171A objectives
- Compile evidence package for all 15 practices
- Prepare senior official affirmation documentation
- Guide SPRS submission and reporting
- Establish annual reassessment and affirmation process
Where Level 1 Fits in the CMMC Framework
CMMC 2.0 has three tiers. Level 1 is the foundational baseline required for any DoD contractor handling FCI.
| Aspect | Level 1 — Foundational | Level 2 — Advanced | Level 3 — Expert |
|---|---|---|---|
| Practices | 15, from FAR 52.204-21 | 110, from NIST 800-171 Rev. 2 | 110 + a subset of NIST 800-172 |
| Assessment | Annual self-assessment | Self-assessment or C3PAO audit | Government-led (DIBCAC) |
| Scoring | Pass/fail, all practices MET | SPRS score, maximum 110 | Highest assurance tier |
| POA&Ms | Not permitted | Allowed with conditions | Level 2 certification required first |
| Applies to | Contractors handling FCI | Contractors handling CUI | The most restrictive DoD programs |
-
From Gap Analysis to SPRS Submission
A proven process that takes defense contractors from initial assessment to a current CMMC Level 1 status — typically in 3 to 6 months.
-
FCI Identification & Scoping
We trace where FCI lives in your environment and define the assessment boundary — the decision that determines how much of your network the 15 practices must cover.
-
Gap Analysis Against 15 Practices
Each practice is evaluated to a documented MET or NOT MET, so you know exactly what stands between you and a submittable self-assessment.
-
Remediation & Control Implementation
palmiq's engineers close every gap — access controls, MFA, boundary protection, endpoint security, physical safeguards — because pass/fail leaves no room for "mostly done."
-
Policy & Evidence Documentation
We write the information security policy and assemble verifiable evidence for every practice: configurations, logs, access lists, and screenshots an assessor would accept.
-
Self-Assessment & SPRS Submission
The formal self-assessment is conducted against NIST 800-171A objectives, the senior-official affirmation is prepared, and the result is submitted to SPRS.
-
Ongoing Compliance & Annual Reassessment
Level 1 status must be reaffirmed annually. palmiq keeps the controls operating and repeats the cycle so your SPRS status never lapses.
Your CMMC Level 1 Partner from Assessment to Compliance
-
Assess + Implement + Manage
We don’t just identify gaps — we close them. palmiq implements and operates the controls your organization needs as part of your ongoing managed services.
-
Government & DIB Focus
Years of experience serving defense contractors, government agencies, and regulated industries. We understand FCI, CUI, DFARS, and the CMMC assessment methodology inside and out.
-
Entra ID, Defender, Intune
Expert deployment of the Microsoft security stack for identity management, endpoint protection, and access control practices required at Level 1.
-
Endpoint & Backup
Enterprise-grade antivirus, anti-malware, and backup solutions that directly satisfy System & Information Integrity practices at Level 1.
-
Ashburn, Virginia
Certified women-owned small business in the heart of the defense corridor. No long-term contracts required. Built for the DIB.
-
English & Spanish
Full service delivery in English and Spanish, supporting defense contractors and subcontractors across the Americas.
-
Related Compliance Frameworks
If your contracts grow into CUI, the path continues through the same practice:
CMMC Level 2
The next tier — all 110 NIST 800-171 controls, SPRS scoring, and C3PAO assessment for CUI.
NIST 800-171 Gap Assessment
The control set behind Level 2, assessed and scored before certification is on the table.
Microsoft GCC High
Where CUI and ITAR data usually ends up — the compliant Microsoft 365 environment for the DIB.