A practical CMMC Level 1 readiness checklist

Start with a one-page scope brief

Record the relevant contract or solicitation, the person who confirmed the requirement, and the information involved. List the business activities that receive, use, send, or retain Federal Contract Information. Follow an actual work item from receipt through delivery, including email, downloads, shared folders, remote access, printing, and disposal.

Then apply the official scoping rules. The purpose of the brief is to support a defensible boundary, not to create a new assessment rule. Assign an internal owner who can resolve questions with IT and the appropriate contract contact. See the Level 1 scoping guide for a more detailed walkthrough.

For the overview behind this checklist, read what CMMC Level 1 requires. Use the cost and timeline guide to turn identified gaps into a realistic work plan.

Work through the safeguards systematically

1. Identify the accounts, devices, applications, facilities, and providers involved.
2. Map implementation to each of the 15 safeguarding requirements.
3. Use the applicable assessment objectives to decide what needs to be examined, discussed, or tested.
4. Locate current supporting records and identify the person who can explain them.
5. Separate unresolved deficiencies from implementation you have verified.

A checklist should expose work, not hide it. If a requirement is only supported by a planned purchase, a draft policy, or a provider’s verbal assurance, ask what still needs to happen before the organization can support its assessment conclusion.

Resolve gaps before the formal result

Give each gap a specific action, owner, dependency, and closure check. For example, if former employees retain access, the action is to remove inappropriate access and verify the relevant applications, not merely write an offboarding policy. Keep the record of the change with the related requirement.

Schedule a review of the completed work before preparing the result for SPRS. The person conducting the assessment should be able to explain the basis for every conclusion. The self-assessment process guide explains how to distinguish investigation, assessment, and submission.

Prepare the record and the next review

Confirm the correct organization, scope, associated CAGE codes, assessment details, and authorized SPRS users. Arrange the internal review needed by the Affirming Official. Keep a controlled record of what was assessed and verify the saved submission afterward.

Level 1 self-assessment is annual, with affirmation requirements addressed separately in the rule. Put the next review on the calendar and identify changes that should trigger an earlier internal check. A new provider, application, office, or remote-work arrangement can make last year’s description incomplete. A maintained workspace makes the next assessment easier to support.