Start with your contract and FCI boundary, confirm that every applicable Level 1 requirement is met, and prepare the assessment record and affirmation. A completed checklist alone does not establish CMMC status.
Use a checklist that leads to decisions
A small contractor can lose time collecting screenshots before anyone agrees which systems belong in the assessment. Begin with a one-page assessment brief: the contract requirement, business owner, technical lead, relevant CAGE codes, and intended system boundary. Record unresolved questions before treating them as assumptions.
1. Confirm the requirement and the boundary
Read the solicitation or contract language and the information your organization will receive or create. Identify Federal Contract Information (FCI), its working locations, and the people who use it. If Controlled Unclassified Information (CUI) is involved, resolve the appropriate assessment path before relying on a Level 1 plan.
2. Map the safeguards to your actual environment
Current Level 1 requirements follow the 15 safeguards in FAR 52.204-21. Older resources often describe 17 practices because the physical-protection requirement was split into separate items. Use the current rule and assessment objectives as the reference; a difference in checklist length is not permission to omit a safeguard.
Create a working record with these columns: requirement, implementation owner, systems covered, evidence location, verification method, result, and unresolved question. Keep a separate list for future improvements so it cannot be confused with a completed requirement.
3. Test the work, not just the paperwork
- Ask a process owner to demonstrate how access is approved and removed.
- Compare the device inventory with the systems shown in your evidence.
- Check whether remote work and shared services match the documented boundary.
- Confirm that the records show current operation rather than an old configuration.
- Have someone other than the evidence collector follow the evidence links.
These are suggested review techniques, not an alternative assessment method. Use the official objectives to decide whether the evidence supports each result.
4. Close gaps before recording a final result
Level 1 does not allow a POA&M to support a conditional status. Keep an internal remediation list while preparing, then verify completed changes before concluding that requirements are met. Distinguish a planned fix from an implemented fix and an implemented fix from a verified one.
5. Prepare a repeatable handoff
Assemble the scope summary, results, evidence index, review notes, and responsible officials in one controlled location. Plan the SPRS submission and affirmation with the appropriate company representatives. Put recurring ownership and the next review on the business calendar rather than leaving the next cycle to memory.
For an efficient kickoff with Federal Bid Partners (FBP), bring a sanitized system inventory and your open scope questions. Explore CMMC Pulsar as a workspace for organizing the resulting readiness tasks. Keep actual sensitive artifacts only in environments approved for them.
Common questions
Why do some Level 1 lists have 17 items?
Older practice lists split the physical-protection safeguard into separate practices. The current rule identifies the 15 FAR safeguards; use the current assessment objectives.
Can an open gap be carried on a Level 1 POA&M?
An internal task list can track preparation, but a POA&M cannot establish a conditional Level 1 status.
Sources and further reading
Check the current source, applicable contract, and official process before relying on a requirement. Suggested workflows are practical working methods and do not replace official instructions.