{"data":{"id":"us/32-cfr-170.15","jurisdiction":"us","citation":"32 CFR 170.15","heading":"CMMC Level 1 self-assessment and affirmation requirements.","body":"(a) Level 1 self-assessment. To comply with CMMC Level 1 self-assessment requirements, the OSA must meet the requirements detailed in paragraphs (a)(1) and (2) of this section. An OSA conducts a Level 1 self-assessment as detailed in paragraph (c) of this section to achieve a CMMC Status of Final Level 1 (Self).\n(1) Level 1 self-assessment requirements. The OSA must complete and achieve a MET result for all security requirements specified in § 170.14(c)(2) to achieve the CMMC Status of Final Level 1 (Self). No POA\u0026Ms are permitted for CMMC Level 1. The OSA must conduct a self-assessment in accordance with the procedures set forth in § 170.15(c)(1) and submit assessment results in SPRS. To maintain compliance with the requirements for the CMMC Status of Final Level 1 (Self), the OSA must conduct a Level 1 self-assessment on an annual basis and submit the results in SPRS, or its successor capability.\n(i) Inputs to SPRS. The Level 1 self-assessment results in the Supplier Performance Risk System (SPRS) shall include, at minimum, the following items:\n(A) CMMC Level.\n(B) CMMC Status Date.\n(C) CMMC Assessment Scope.\n(D) All industry CAGE code(s) associated with the information system(s) addressed by the CMMC Assessment Scope.\n(E) Compliance result.\n(ii) [Reserved]\n(2) Affirmation. Affirmation of the Level 1 (Self) CMMC Status is required for all Level 1 self-assessments. Affirmation procedures are set forth in § 170.22.\n(b) Contract eligibility. Prior to award of any contract or subcontract with a requirement for the CMMC Status of Level 1 (Self), OSAs must both achieve a CMMC Status of Level 1 (Self) and have submitted an affirmation of compliance into SPRS for all information systems within the CMMC Assessment Scope.\n(c) Procedures—(1) Level 1 self-assessment. The OSA must conduct a Level 1 self-assessment scored in accordance with the CMMC Scoring Methodology described in § 170.24. The Level 1 self-assessment must be performed in accordance with the CMMC Level 1 scope requirements set forth in § 170.19(a) and (b) and the following:\n(i) The Level 1 self-assessment must be performed using the objectives defined in NIST SP 800-171A Jun2018 (incorporated by reference, see § 170.2) for the security requirement that maps to the CMMC Level 1 security requirement as specified in table 1 to paragraph (c)(1)(ii) of this section. In any case where an objective addresses CUI, FCI should be substituted for CUI in the objective.\n(ii) Mapping table for CMMC Level 1 security requirements to the NIST SP 800-171A Jun2018 objectives.\nTable 2 to § 170.15(c)(1)(ii)—CMMC Level 1 Security Requirements Mapped to NIST SP 800-171A Jun2018\nCMMC Level 1 security requirements as set forth in § 170.14(c)(2) NIST SP 800-171A Jun2018\nAC.L1-b.1.i 3.1.1\nAC.L1-b.1.ii 3.1.2\nAC.L1-b.1.iii 3.1.20\nAC.L1-b.1.iv 3.1.22\nIA.L1-b.1.v 3.5.1\nIA.L1-b.1.vi 3.5.2\nMP.L1-b.1.vii 3.8.3\nPE.L1-b.1.viii 3.10.1\nFirst phrase of PE.L1-b.1.ix (FAR b.1.ix *) 3.10.3\nSecond phrase of PE.L1-b.1.ix (FAR b.1.ix *) 3.10.4\nThird phrase of PE.L1-b.1.ix (FAR b.1.ix *) 3.10.5\nSC.L1-b.1.x 3.13.1\nSC.L1-b.1.xi 3.13.5\nSI.L1-b.1.xii 3.14.1\nSI.L1-b.1.xiii 3.14.2\nSI.L1-b.1.xiv 3.14.4\nSI.L1-b.1.xv 3.14.5\n* Three of the 48 CFR 52.204-21 requirements were broken apart by “phrase” when NIST SP 800-171 R2 was developed.\n(iii) Additional guidance can be found in the guidance document listed in paragraph (b) of appendix A to this part.\n(2) Artifact retention. The artifacts used as evidence for the assessment must be retained by the OSA for six (6) years from the CMMC Status Date.","path":["Title 32—National Defense","Subtitle A—Department of Defense","CHAPTER I—OFFICE OF THE SECRETARY OF DEFENSE","SUBCHAPTER G—DEFENSE CONTRACTING","PART 170—CYBERSECURITY MATURITY MODEL CERTIFICATION (CMMC) PROGRAM","Subpart D—Key Elements of the CMMC Program"],"source_url":"https://www.ecfr.gov/api/versioner/v1/full/2026-08-25/title-32.xml","current_through":"2026-08-25","vintage":"","retrieved_at":"2026-08-27T02:25:30Z","sha256":"217f1d57beac6724564246cee356a983447face786346687261aa1765b3acf68","source_id":"us-cfr","stale":true,"prev":"us/32-cfr-170.14","next":"us/32-cfr-170.16"},"notice":"GroundRules: Original legal text. Not legal advice."}