Reference Center
CMMC, in Plain English
The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense program, set out in 32 CFR Part 170, for safeguarding federal information across the defense supply chain. This reference center covers Level 1.
Where Level 1 Fits
CMMC has tiers. Level 1 applies to companies that handle Federal Contract Information (FCI) and is met by an annual self-assessment. The higher levels apply to Controlled Unclassified Information (CUI) and involve more requirements and, above Level 1, third-party assessment. This reference center is built for the Level 1 world: 15 requirements and 59 assessment objectives across 6 domains.
Start Here
What Level 1 covers, the numbers behind it, the six domains, and how the self-assessment and annual affirmation work.
RequirementsAll 15 Level 1 security requirements from FAR 52.204-21(b)(1), each with its official text and assessment objectives.
Assessment ObjectivesThe 59 assessment objectives from NIST SP 800-171A, each with the official examine, interview, and test procedures.
GuidesDirect answers to the most common Level 1 questions, such as whether it is a certification, whether you need a C3PAO, FCI vs CUI, cost, and how to submit in SPRS.
GlossaryPlain-English definitions of the Level 1 terms, from FCI and CUI to SPRS, the Affirming Official, POA&M, and determinations.
Level 1 ChecklistAll 15 requirements and 59 objectives on one page, each linked to the official page that prints it.
MethodologyWhere the official text comes from, how it is shown, and how it is checked against the official documents.
Common Questions
Sources
How This Reference Is Maintained
Requirement statements, assessment objectives, and assessment procedures are reproduced exactly as printed in the DoD CMMC Assessment Guide, Level 1, Version 2.13, which sets out the FAR 52.204-21 requirements and the NIST SP 800-171A (June 2018) objectives and procedures for Level 1. Nothing in that official text is reworded. Each requirement and objective page links to the page of the official document that prints it. The text is checked character for character against the official documents, and the requirement statements against FAR 52.204-21 as published in the eCFR. Plain-English answers and guides are written by AssessrLog and are kept apart from the official text. When an authority publishes a new version, the text is extracted and checked again before any page changes.