CMMC Level 1 · FAR 52.204-21 · FCI

CMMC Level 1 Self-Assessment Service from Scan Ninja

Scan Ninja runs your annual CMMC Level 1 self-assessment with you: we scope your Federal Contract Information, check all 15 FAR 52.204-21 requirements, close the gaps, and prepare the results your senior official affirms in SPRS. Built for defense, aerospace, and space suppliers that don't have a security team of their own.

Book Security ConsultationSee the 15 requirements

✓ All 15 requirements  ✓ Gaps closed before you affirm  ✓ SPRS-ready results  ✓ Annual reassessment

FAR 52.204-21
32 CFR Part 170
SPRS affirmation
Veteran-owned, U.S.-based

What Is a CMMC Level 1 Self-Assessment Service?

CMMC Level 1 is the Department of Defense requirement for contractors that handle Federal Contract Information (FCI): information not intended for public release that is provided by or generated for the government under a contract, including nonpublic deliverables you create for the government. Level 1 asks you to meet the 15 basic safeguarding requirements in FAR 52.204-21, assess yourself against them every year, and have a senior official affirm the result in the Supplier Performance Risk System (SPRS).

A CMMC Level 1 self-assessment service does that work alongside you. Scan Ninja scopes where FCI lives, gathers evidence for each requirement, scans the technical controls, fixes what is missing, and hands your affirming official a complete picture. You stay the one who affirms; we make sure the affirmation is accurate.

The 15 CMMC Level 1 Requirements We Assess

Access Control (4)

  • Limit system access to authorized users, processes, and devices
  • Limit users to the transactions and functions they are allowed to run
  • Verify and control connections to external systems
  • Control FCI posted on publicly accessible systems

Identification & Authentication (2)

  • Identify users, processes, and devices
  • Authenticate them before allowing access

Media Protection (1)

  • Sanitize or destroy media containing FCI before disposal or reuse

Physical Protection (2)

  • Limit physical access to systems and operating areas
  • Escort visitors, keep physical access logs, and manage access devices

System & Communications Protection (2)

  • Monitor and control communications at system boundaries
  • Separate publicly accessible components onto their own subnetworks

System & Information Integrity (4)

  • Identify, report, and correct system flaws in a timely manner
  • Provide protection from malicious code
  • Keep malicious-code protection updated
  • Run periodic and real-time scans of systems and files

Summarized from FAR 52.204-21(b)(1). For the full wording and the evidence an assessor expects for each one, see the CMMC Level 1 requirements and self-assessment checklist.

What Scan Ninja Delivers

  • FCI scope: where Federal Contract Information is processed, stored, and sent
  • Asset inventory of in-scope users, devices, and systems
  • Assessment of all 15 FAR 52.204-21 requirements with evidence for each
  • Gap list with fixes, closed before you affirm (no POA&Ms at Level 1)
  • Vulnerability and malware-protection scanning of in-scope systems
  • Assessment results and evidence package ready for your SPRS entry
  • Affirmation brief for the senior official who signs off
  • Annual reassessment, with evidence kept current between years

How the Level 1 Self-Assessment Works

1

Scope Your FCI

Find where Federal Contract Information lives and which people, devices, and systems touch it

2

Assess the 15 Requirements

Check each FAR 52.204-21 requirement against real evidence, with scans for the technical ones

3

Close Every Gap

Fix what is missing before you affirm, because Level 1 does not allow POA&Ms

4

Affirm in SPRS

Hand your affirming official the results and evidence to enter in SPRS, then repeat yearly

Level 1 or Level 2?

CMMC Level 1

For FCI only. 15 FAR 52.204-21 requirements, assessed by your own company every year and affirmed in SPRS. No POA&Ms. This page.

CMMC Level 2

For Controlled Unclassified Information (CUI). All 110 NIST SP 800-171 requirements, an SPRS score, SSP and POA&M, and for most contracts a C3PAO assessment. See CMMC 2.0 readiness.

Your required level is set by your contract. If any CUI is in scope, Level 1 is not enough.

Who This Service Is For

  • DoD prime contractors and subcontractors whose contracts call for CMMC Level 1
  • Small and mid-sized suppliers that handle FCI but not CUI
  • Aerospace, space, and manufacturing firms without an in-house security team
  • Companies that affirmed once and need the annual reassessment kept current
Not a fit if… You handle CUI and need CMMC Level 2 or a C3PAO assessment. Start with our CMMC 2.0 readiness service instead.
← CMMC 2.0 ReadinessLevel 1 Checklist →How SPRS Scores Work →Defense & Government →Capability Statement →

Request a CMMC Level 1 Readiness Review

Tell us about your contracts and where FCI lives, and a Scan Ninja expert will walk you through what your Level 1 self-assessment needs.

What happens next: We'll review your requirements and schedule a brief scoping call within 24 hours to confirm deliverables and timeline.

By submitting, you agree to be contacted about CMMC Level 1. See our privacy policy.

CMMC Level 1 FAQ

It is outside help to complete the annual CMMC Level 1 self-assessment that DoD contractors handling Federal Contract Information (FCI) must perform. A provider such as Scan Ninja scopes where FCI lives, checks each of the 15 FAR 52.204-21 requirements, collects evidence, helps close gaps, and prepares the results so your affirming official can enter them in SPRS.
Any DoD contractor or subcontractor whose contract requires CMMC Level 1 because it processes, stores, or transmits Federal Contract Information but not Controlled Unclassified Information (CUI). If you handle CUI, you need CMMC Level 2, which covers all 110 NIST SP 800-171 requirements.
Both counts appear. The CMMC rule (32 CFR Part 170) lists the 15 safeguarding requirements of FAR 52.204-21. Older CMMC guidance split one physical-protection requirement into three, which is why some sources say 17 practices. The work is the same either way.
No. Plans of Action and Milestones are not allowed at Level 1. Every requirement must be fully met before you affirm, which is why Scan Ninja closes gaps before the SPRS entry rather than documenting them for later.
Your organization does. The results go into the Supplier Performance Risk System (SPRS), and a senior official of your company affirms compliance. The self-assessment and the affirmation are repeated every year. Scan Ninja prepares the results and evidence; it does not affirm on your behalf.
No one certifies Level 1. It is a self-assessment that your company affirms. Scan Ninja does the assessment work with you and keeps evidence current so the affirmation is accurate and defensible.
Level 1 must be reassessed and reaffirmed annually. Scan Ninja keeps scanning in-scope systems for flaws and malware-protection status between assessments, so the next annual self-assessment starts from current evidence instead of from scratch.

Get Your CMMC Level 1 Affirmation Right

Talk to a Scan Ninja compliance expert about your FCI scope and the 15 requirements. No commitment required to start the conversation.

✓ All 15 requirements ✓ Gaps closed before you affirm ✓ SPRS-ready results