CMMC Level 1 Checklist: 15 Practices for Federal Contract Information (Excel and PDF)
CMMC Level 1 applies to contractors that handle Federal Contract Information but not controlled unclassified information. It has 15 practices drawn from FAR 52.204-21. Use this worksheet to record what you have, who owns it and what proof you can show, then export it for your self-assessment file.
| Practice | Domain | What it means | Example evidence | Owner | Status | Target date | |
|---|---|---|---|---|---|---|---|
Level 1 covers the 15 basic safeguarding requirements of FAR 52.204-21 for Federal Contract Information. You assess yourself annually and an authorized official affirms the result. Edit status and evidence for your own environment; the examples are common, not required.
Keep AI inside your CMMC boundary
Optional review of on-prem AI that does not expand your compliance scope.
Optional. The tool and every export work without this. No spam.
How to use the worksheet
Start by confirming that your contracts involve FCI and that you do not handle CUI, which would require Level 2. Review each practice, change the status to match reality, name an owner and attach a target date for gaps. In the evidence column record the specific document, screenshot or configuration that proves the practice. Keep the evidence together in one folder with the exported worksheet, because the affirmation is signed by a company official who is responsible for its accuracy.
What the 15 practices cover
The practices fall into six domains and are basic cyber hygiene: control who can use your systems, identify and authenticate users, sanitize media, limit physical access, protect the boundary, and keep software patched and free of malware. Most small companies already meet several of them through standard IT tools. The gaps are usually documentation, such as media disposal logs, visitor records, and proof that patches and scans are happening.
- Access control: four practices.
- Identification and authentication: two practices.
- Media protection: one practice.
- Physical protection: two practices.
- System and communications protection: two practices.
- System and information integrity: four practices.
Common mistakes and scope
The first mistake is to assume the whole company is in scope when only the assets that process, store or transmit FCI are. Define that boundary and write it down. The second is to mark a practice as implemented without evidence. The third is to treat Level 1 as one-off: the assessment is annual and the affirmation must be renewed. Companies that also handle CUI need Level 2 and should use a separate, more detailed assessment of the 110 NIST SP 800-171 requirements.
Frequently Asked Questions
How many practices are in CMMC Level 1?
Fifteen. They correspond to the basic safeguarding requirements in FAR clause 52.204-21 and protect Federal Contract Information. They are grouped under access control, identification and authentication, media protection, physical protection, system and communications protection, and system and information integrity.
Does Level 1 need a third-party assessment?
No. Level 1 is an annual self-assessment, followed by an affirmation from an affirming official, with the result entered in the government's reporting system. Level 2 may require a third-party assessment depending on the contract.
What is FCI?
Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release. It excludes simple transactional information such as payment data. If you also handle CUI you need Level 2.
Can I use this worksheet as my assessment record?
Yes, as a working record of status and evidence, provided you keep the underlying proof and follow the official assessment guide. It is a planning aid and does not replace the official CMMC assessment guide or legal advice.
Netray works with defense suppliers on private AI that runs inside their own boundary, so adopting AI does not widen your CMMC scope.
Related Tools
CMMC 2.0 Level 2 Readiness Assessment
Answer 10 questions mapped to NIST SP 800-171 control families and get an instant CMMC Level 2 readiness score with prioritized next steps.
Compliance & ContractsCMMC Practice Evidence Tracker Worksheet
One row per practice: objectives, objectives met, evidence items, owner and weight. The sheet computes percent complete, points at risk and an estimated score.
Compliance & ContractsCMMC Asset Scoping and Categorization Worksheet
Build your in scope asset inventory by CMMC category, with quantities, documentation effort and annual tool cost so you can see what scope reduction would save.
Aerospace & DefenseCUI Enclave vs Enterprise Scope Cost Calculator
Model whether a dedicated CUI enclave is cheaper than bringing every user into scope, with a break-even CUI headcount and a what-if chart.
More Compliance & Contracts tools
See all- SPRS Score Recovery Timeline Calculator
- CMMC Shared Responsibility Matrix Worksheet for MSPs and Cloud Providers
- CUI Banner and Dissemination Control Marking Reference
- ITAR Technical Data Handling Procedure Template
- CMMC C3PAO Assessment Day Prep Checklist
- CMMC Level 2 Checklist Worksheet
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
Keep exploring
Free tools
- CMMC Level 1 Checklist and Level 2 Control Tracker (Excel)A CMMC Level 2 control tracker by family with evidence examples, plus the 17 Level 1 practices and how scoring works.
- CMMC Level 2 Checklist WorksheetAn editable CMMC Level 2 tracking sheet with real NIST SP 800-171 practice IDs, status, evidence, owner and due date, exportable to Excel.
- CMMC Level 1 ChecklistTick through every CMMC Level 1 practice for Federal Contract Information, see example evidence for each, and finish with the annual affirmation steps.
Guides
- CMMC 2.0 for Small ManufacturersCMMC 2.0 for small manufacturers explained: Level 1 vs Level 2, the 110 NIST SP 800-171 practices, scoping your shop floor, and where ERP and CAD data fit.
- CMMC Level 2 for a Small CNC Machine Shop: What Applies and Where to StartCMMC Level 2 for small CNC machine shops: when it applies, what CUI in drawings means, the scope decisions that control cost, and how AI tools fit the boundary.
AI on your ERP
- CMMC Level 2 AI for ERP Without Blowing Up Your ScopeHow to deploy AI inside your CMMC 2.0 Level 2 assessment boundary without expanding CUI scope. Enclave architecture a CISO can defend to a C3PAO.
- On-prem AI for Costpoint inside a CMMC Level 2 enclaveDeploy AI beside Deltek Costpoint inside a CMMC Level 2 enclave: what to check before adding any AI tool, and how on-prem inference avoids new CUI flows.