Is CMMC Level 1 a certification?

Short Answer

No. CMMC Level 1 is an annual self-assessment, not a certification. Each year you assess your own systems, record the result in SPRS, and have a senior official affirm it. Both steps repeat annually. No certificate is issued and no third-party assessor is involved.

Why people expect a certificate

The name has the word certification in it, so it is natural to assume Level 1 is a credential you earn from an outside body. It is not. The certification in CMMC refers to the program, not to a certificate for Level 1 suppliers.

What actually happens

You perform a self-assessment against the fifteen Level 1 requirements, record each result, submit the result in SPRS, and have a senior official affirm it. This repeats every year. The word certified does not apply at Level 1.

How do I get CMMC Level 1 certified?

There is no certificate to get. What people mean by getting certified at Level 1 is completing the self-assessment, entering the result in SPRS, and having a senior official affirm it. That is the whole process, and no assessor issues a certificate.

Does a Level 1 status expire?

A Level 1 status in SPRS is current for one year. DFARS 252.204-7021 treats a Final Level 1 (Self) status as current only when it is not older than one year and its affirmation is not older than one year. 32 CFR 170.15(a)(1) requires the self-assessment on an annual basis, and 32 CFR 170.22(b)(1) requires the affirmation at completion and annually thereafter. So both the self-assessment and the affirmation are repeated every year.

An annual affirmation on its own does not keep a Level 1 status current. The DoW CIO CMMC FAQs (C-A1) say the same thing. Level 1 self-assessments are required annually, and an affirmation of continued compliance is required at the time of assessment and annually thereafter.

A change to your environment can also call for a new self-assessment before the year is out. The DoD CMMC Scoping Guide, Level 1, says a new assessment is required after significant architectural or boundary changes to the previous assessment scope, such as network expansions or mergers and acquisitions, while operational changes within the existing boundary are covered by the annual affirmations (page 4). The DoW CIO CMMC FAQs (C-A12) place the decision on whether a change is significant enough to require reassessment with the Affirming Official.