CMMC Level 1 explained
CMMC Level 1: scope and self-assessment basics
CMMC Level 1 addresses basic protection of Federal Contract Information through self-assessment. Your contract determines the required level.
Choose the right scope
Identify the systems handling Federal Contract Information and check the relevant contract clauses. Framework selection in UpCISO records what you are preparing for; it is not an applicability determination.
Work through the requirements
Answer the questions, collect evidence and review the findings. Do not interpret question completion as a compliance percentage. An unfinished requirement remains a gap even when it has an owner and planned completion date.
Official sources
Reviewed 2026-09-22. Check current sources and your contract when making assessment or eligibility decisions.