The email comes from the supplier compliance desk at a customer you have shipped to for years. It asks for your CMMC level, and somewhere in the second paragraph is an acronym you have not seen before: SPRS. There is a date. Nobody at the shop remembers agreeing to any of this.
Here is what is being asked, in the order it will make sense.
What Level 1 is, and when it is yours
CMMC is the Pentagon’s program for checking that its suppliers protect contract information. It has three levels, and which one applies depends on the kind of information you touch.
Level 1 covers Federal contract information: information “not intended for public release” that the government provides, or that is generated for it, under a contract to deliver a product or service. In a small shop that is usually the purchase order, the delivery schedule, the emails about the job, the quote. Public website material and plain payment details do not count.
If drawings or specifications arrive marked as controlled unclassified information, you have left Level 1. A missing stamp does not settle it the other way, so when you are unsure what a document is, ask. The rule sets Level 2 as the minimum for a subcontractor handling that, and Level 2 is a different and much larger project. Ask your customer which one the subcontract carries before you do anything else. They are required to pass the right level down to you, and for a subcontractor who only touches Federal contract information, the rule says that level is Level 1, self-assessed.
Two smaller notes. Contracts solely for commercial off-the-shelf items are carved out. And at Level 1 some floor equipment sits outside the assessment. The rule treats operational technology, industrial devices and test equipment that cannot be fully secured as specialized assets, “not part of the Level 1 CMMC Assessment Scope.” An ordinary computer is a different matter wherever it sits. The PC at the inspection bench that opens the job folder is in scope, same as the one in the front office.
The fifteen, walked through the building
The requirements come from one paragraph of a federal contract clause, FAR 52.204-21, that has been in government contracts for years. There are fifteen. Read as a list they sound like a security textbook. Walked through a building they sound like a shop.
Take the walk as orientation. The assessment itself is scored against the objectives in the program’s Level 1 assessment guidance, one requirement at a time, and several requirements have more parts than a walk shows.
The front door (two requirements). Limit physical access to your systems and equipment to authorized people. Escort visitors, watch what they do, keep a log of who came in, and control the keys and badges. If you already sign visitors in because of the forklifts, you have a head start. The log is the piece to check: it has to exist, and somebody has to be able to produce last March.
The login screen (four). Only authorized users and devices get on. Each user can do only what their job needs. Every user is identified, and every identity is checked before access. In plain terms: everyone has their own account and their own password, and the person doing quotes is not signed in as an administrator. Devices and automated jobs that sign in count too. The shared “office” login on the front-desk PC is the usual casualty here, and it is a fair one.
The edge of the network (three). Control connections to outside systems, which means deciding whether contract email belongs on personal phones and home computers and then enforcing the answer. Monitor and protect traffic at the boundary, which is a firewall that someone actually manages. Keep anything the public can reach on a network separated from the inside. Start by listing what that is: a website or portal you host yourself, anything else that answers from the internet. If the list is empty because the website lives at a hosting company, write that down as the answer.
The website and the feed (one). Control what gets posted publicly. The photo of the finished part with the traveler visible in the background is the example to keep in mind. One person should own the decision about what goes up.
The shelf of old drives (one). Sanitize or destroy media that held contract information before it leaves or gets reused. That covers the retired office PC, the USB stick in the desk drawer, and the hard drive inside the leased copier when the lease ends.
Updates and antivirus (four). Find and fix flaws in a timely manner, which is patching. Run protection against malicious code. Keep that protection updated. Scan the system periodically, and scan files as they are downloaded or opened. A current, supported computer with its built-in protection switched on and updates left alone covers a lot of this ground. The work is proving it is true on every machine in scope, including the one in the back that nobody likes to restart.
That is all fifteen. A shop with individual logins, a managed firewall and automatic updates will recognize a good part of the list. Recognizing it is the easy half. Being able to show it, for every machine in scope, is the assessment.
How the self-assessment works
Nobody comes to your shop for Level 1. You assess yourself, once a year, and the result goes into SPRS, the Supplier Performance Risk System, which you reach through the government’s PIEE portal.
Three rules shape it.
First, you set the scope before you start: the systems that process, store or transmit the contract information, and the people, facilities and outside providers around them. A smaller, cleaner scope is easier to assess honestly. If the contract folder lives in one place instead of six, there are fewer machines to vouch for. Count every device that can open it, floor PCs included.
Second, every one of the fifteen has to come out MET. The rule is blunt about it: “No POA&Ms are permitted for CMMC Level 1.” A POA&M is a written plan to fix something later. At the higher levels you can carry a short one for a while. At Level 1 there is no later. Fourteen out of fifteen is a no.
Third, a senior person signs. The rule calls them the Affirming Official, and they affirm in SPRS that the shop “has implemented and will maintain implementation” of the requirements. That affirmation is repeated every year. The evidence behind the assessment has to be kept for six years.
Which brings up the one piece of advice we would give before any technical step. Treat the assessment as an inventory. Go requirement by requirement and write down what is true today, with something you could show for it: the visitor log, the list of accounts, the firewall’s admin page, the patch report. Where the honest answer is “not yet,” fix it and then mark it. The signature belongs to a named person and the statement goes to the federal government, so the only version worth signing is the one that is true on an ordinary Tuesday.
Where the program stands
CMMC has been a moving target for years, and it moved again this year. Level 1 and Level 2 self-assessments began appearing as a condition of award on November 10, 2025. The next phase, which would have brought outside assessors into more contracts, was due a year later. In July 2026 the Pentagon suspended that step and opened a review of the program. Its September 2026 instructions to contracting officers kept self-assessment in place: Level 1 (Self) and Level 2 (Self) may still be written into solicitations. That is the latest official word we have read, and this page carries the date we last checked.
So for a shop at Level 1, the pause changed very little. The fifteen requirements are the same fifteen, they sit in a clause that predates CMMC, and your customer can still ask. If a date in that first email worried you, ask the customer which contract it comes from and what level it names.
We help shops prepare for this: scoping, the walk-through, the evidence folder. The assessment and the signature stay yours. If you want a second set of eyes before someone senior signs, book a call.