CMMC Level 1 checklist for small manufacturers (2026)

The short answer

CMMC Level 1 is the starting point for a manufacturer whose covered contract systems handle Federal Contract Information (FCI), but not Controlled Unclassified Information (CUI). It is not a badge you get by buying a security product. Your business must implement the requirements, assess them and maintain the required status and affirmation in the Supplier Performance Risk System (SPRS).

The familiar Level 1 checklist has 17 practices in six domains, drawn from FAR 52.204-21. The FAR clause expresses the underlying safeguards in 15 numbered requirements; the CMMC assessment guide separates some of those into individual practices. Use the official guide and assessment objectives, not just the shorthand below, when deciding whether a practice is met. [1][2][3]

FCI versus CUI: start with the information

FCI is nonpublic information provided by or generated for the government under a contract to develop or deliver a product or service. Public information and simple transactional information needed to process payments are excluded from the FAR definition. A nonpublic purchase order or production schedule may be FCI. [3]

CUI is information requiring safeguarding or dissemination controls under applicable law, regulation or government-wide policy. Some technical drawings, specifications or other defense information may be CUI, but not every drawing is. Ask your prime or contracting officer to confirm markings, information categories and handling instructions. Do not guess from a filename or assume that an unmarked file is safe to treat as public. [1][4]

Employee count does not decide your CMMC level. A ten-person supplier can handle CUI. A larger shop may have a contract scope limited to FCI. Read the solicitation, flow-down clauses and required CMMC level, then map the systems that process, store or transmit the relevant information.

The 17 Level 1 practices

These are one-line descriptions of what good implementation looks like, not complete assessment procedures. Keep evidence that supports the official objectives: configurations, account lists, written procedures, logs and interviews with people who perform the work. [2]

Access Control: four practices

1. AC.L1-3.1.1, authorized access. Good looks like: only named, approved users, processes acting on their behalf and approved devices can access the covered systems.
2. AC.L1-3.1.2, permitted actions. Good looks like: each user can perform only the transactions and functions their approved role needs, rather than everyone having administrator rights.
3. AC.L1-3.1.20, external connections. Good looks like: connections to external systems are identified, verified and controlled, including remote support and personal devices.
4. AC.L1-3.1.22, public systems. Good looks like: a responsible person reviews information before posting it publicly, and checks that covered information has not reached a public website or shared link.

Identification and Authentication: two practices

5. IA.L1-3.5.1, identification. Good looks like: the business can identify every system user, process acting for a user and device needing access.
6. IA.L1-3.5.2, authentication. Good looks like: identities are authenticated before access is granted, with credentials controlled and not casually passed between shifts.

Shared logins make it difficult to establish who accessed information or whether a departing worker still has access. MFA is a sensible control and a frequent insurance requirement, but do not describe it as a separately named Level 1 practice. Level 1 and an insurer's questionnaire are different checklists.

Media Protection: one practice

7. MP.L1-3.8.3, media disposal. Good looks like: media containing FCI is sanitized or destroyed before disposal or reuse, using a documented method appropriate to the media.

Include old laptops, USB drives and other storage devices. Deleting a folder or placing a computer in a recycling pile does not establish that the information has been sanitized. Keep a disposal record showing what happened and who handled it.

Physical Protection: four practices

8. PE.L1-3.10.1, physical access. Good looks like: only authorized people have physical access to covered systems, equipment and their operating environments.
9. PE.L1-3.10.3, visitors. Good looks like: visitors are escorted and their activity is monitored where covered systems or information are accessible.
10. PE.L1-3.10.4, physical access logs. Good looks like: the shop maintains records of physical access to the relevant areas or systems.
11. PE.L1-3.10.5, access devices. Good looks like: keys, badges and other physical access devices are issued, tracked, controlled and removed when no longer needed.

A reception desk sign-in sheet can be part of the evidence, but it must reflect your actual process. Think about delivery drivers, equipment service technicians, shared buildings and after-hours access, not only front-office visitors.

System and Communications Protection: two practices

12. SC.L1-3.13.1, boundary protection. Good looks like: communications are monitored, controlled and protected at external boundaries and key internal boundaries of the covered systems.
13. SC.L1-3.13.5, public-facing systems. Good looks like: publicly accessible system components are separated, physically or logically, from the internal network.

A flat network deserves review because office computers, guest Wi-Fi, cameras and production devices may share paths they do not need. Segmentation helps, but a diagram alone is not implementation evidence. Verify firewall rules and actual traffic paths. If you have no public-facing component, document how the official assessment objectives apply rather than marking the practice met without review.

System and Information Integrity: four practices

14. SI.L1-3.14.1, flaws. Good looks like: system flaws are identified, reported and corrected in a timely manner through an assigned patching process.
15. SI.L1-3.14.2, malicious code protection. Good looks like: appropriate locations in the covered environment have protection against malicious code.
16. SI.L1-3.14.4, protection updates. Good looks like: malicious code protection mechanisms are updated when new releases are available.
17. SI.L1-3.14.5, scanning. Good looks like: systems are scanned periodically and files from external sources are scanned in real time as they are downloaded, opened or executed.

Check devices on every shift, not just laptops in the office. Older production systems may have vendor restrictions on patches or security software. Record those constraints and get qualified help resolving them; do not simply declare the device outside scope because it is difficult to update.

Annual self-assessment and SPRS affirmation

Level 1 requires an annual self-assessment, with results entered into SPRS. An authorized Affirming Official also affirms continuing compliance after the assessment and annually thereafter. The assessment and the affirmation are separate responsibilities. [1]

All applicable Level 1 requirements must be met. Level 1 does not allow a Plan of Action and Milestones (POA&M) to create a conditional status. An unfinished fix list is useful for managing work, but it is not permission to affirm that everything is met.

Before submission, define your assessment scope, work through the official objectives, record evidence and resolve gaps. Use the current SPRS instructions for access and entry. Do not confuse a Level 1 assessment result with the separate NIST SP 800-171 DoD assessment score your prime may request. Ask which result is required instead of sending a number that answers a different question.

Common gaps at small shops

• Shared logins: Replace informal shared access with identifiable accounts and a documented access process.
• No MFA: Review email, remote access and privileged access. This is especially important for insurance, even though MFA is not a separately listed Level 1 practice.
• Flat networks: Map and test boundaries between business, guest and production systems.
• Uncontrolled USB drives: Document permitted use, scanning and sanitization, especially when files move onto shop-floor equipment.
• Untested backups: Test restores and record results. Backup testing is useful resilience and insurance evidence, not a standalone Level 1 practice.

Do not turn this list into a new compliance standard. Check each problem against your actual contract, the Level 1 objectives and any additional insurance or CUI obligations.

When you need Level 2

If your covered work involves CUI and the contract calls for Level 2, the scope changes substantially. Under the current CMMC rule, Level 2 uses the 110 requirements of NIST SP 800-171 Revision 2. NIST has published Revision 3, but that publication alone does not change the revision incorporated into the CMMC rule. [1][5]

The required assessment type depends on the contract. A Level 1 checklist is not a substitute for a full NIST 800-171 gap assessment, nor does a short intake establish a defensible official score. Identify cloud service boundaries and required safeguards before choosing tools. A product's FedRAMP authorization does not automatically make your business CMMC compliant.

Turn the checklist into a practical plan

The GBTech.ai CMMC & Cyber Insurance Readiness Snapshot is a flat $1,500 readiness review for manufacturers, machine shops, DoD subcontractors with 10 to 250 employees and firms facing renewal questionnaires. It includes a 35-question intake, a 30-minute intake call, a written report and a 30-minute readout, delivered in 5 business days after completed intake.

The report covers all 17 Level 1 practices, early Level 2 exposure if you handle CUI, insurance controls and your Top 10 fixes with effort, rough cost and who can do them. 100% is credited toward any implementation bought through GBTech.ai within 90 days. GBTech.ai is not a C3PAO. This is not certification or legal advice. Book a free 15-minute call if you want to confirm fit first.

Official sources

• [1] 32 CFR Part 170, CMMC program rule: See sections 170.14, 170.15 and 170.22 for requirements, Level 1 assessment and affirmation.
• [2] DoD CIO CMMC documentation and Level 1 assessment guide: Use the current guide and its assessment objectives.
• [3] FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems: FCI definition and underlying safeguards.
• [4] DoD CIO CMMC overview: Official program information and resources.
• [5] NIST SP 800-171 Revision 2: The 110-requirement baseline incorporated into the current CMMC rule.