--- title: "CHECKLIST: The 15 Foundational CMMC 2.0 Level 1 Requirements" canonical: https://datanomix.io/2024/12/09/the-15-foundational-cmmc-level-1-requirements/ date: 2024-12-09 11:33:41 description: "Download our comprehensive CMMC 2.0 Level 1 checklist to start your journey toward cyber hygiene compliance." keywords: "CMMC 2.0 Level 1" categories: [eBooks & Infosheets, The Datanomix Blog] tags: [Carbide, checklist, CMMC 2.0, Cyber Security, DoD, G-Code, Technology Partner] --- ## Navigating cybersecurity for your shop can seem like a labyrinth, especially for manufacturers handling Federal Contract Information (FCI). With the DoD’s CMMC 2.0 final rule posted, we’re here to help simplify the process. CMMC 2.0 Level 1 is the entry point for compliance, focusing on securing Federal Contract Information (FCI). Unlike [higher levels](https://datanomix.io/2024/09/23/how-manufacturers-can-get-secure-and-avoid-government-risk-with-cmmc-compliance/), Level 1 allows for self-assessment, which must be completed annually and reported to the [Supplier Performance Risk System](https://www.sprs.csd.disa.mil/) (SPRS). To complete a CMMC 2.0 Level 1 self-assessment, manufacturers must follow 15 foundational practices outlined in [FAR Clause 52.204-21](https://www.acquisition.gov/far/52.204-21) and ensure they are implemented across all systems. To ensure you’re on the easiest path to success, check out our on-demand webinar, [_**How to Streamline Your CMMC 2.0 Compliance**_](https://datanomix.io/2024/09/17/webinar-how-to-streamline-your-cmmc-2-0-compliance/). Then, [**download our comprehensive CMMC 2.0 Level 1 checklist**](https://6402824.fs1.hubspotusercontent-na1.net/hubfs/6402824/CMMC/15CMMC_Level1Requirments_Checklist.pdf) to start your journey toward compliance. The checklist outlines the 15 foundational practices focused on cyber hygiene across your systems. Implementing these controls **establishes** a foundational layer of security to protect FCI and helps your shop mitigate risk. [Get the Checklist](https://6402824.fs1.hubspotusercontent-na1.net/hubfs/6402824/CMMC/15CMMC_Level1Requirments_Checklist.pdf) ### Key Dates to Remember [This phased approach](https://datanomix.io/2024/10/22/the-cmmc-rule-is-final-posted-by-the-dod/) provides contractors with a clear roadmap for achieving compliance while minimizing disruptions*. **Update (July 2026):** On July 13, 2026, the Department of War [suspended CMMC Phase 2](https://www.war.gov/News/Releases/Release/Article/4542329/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/) — the November 10, 2026 deadline — along with all pending and future CMMC rollout milestones, and opened a 60-day review of the program. Phase 1 self-assessment requirements remain firmly in place. **For Level 1 shops, this changes almost nothing:** Level 1 was always self-assessed, never third-party assessed, so your path is intact. You still self-assess against the 15 requirements below. Here’s where each phase stands now: **Phase 1 — November 10, 2025 (in effect):** CMMC clauses appear in new DoD solicitations and contract awards. Level 1 and Level 2 self-assessments are required as a condition of award for applicable contracts. This is the piece that’s still live. **Phase 2 — was November 10, 2026 (suspended):** Would have made third-party (C3PAO) Level 2 the default for CUI contracts and stopped self-assessments from counting. Suspended July 13, 2026, pending the reform review. No replacement date has been set. **Phase 3 — was November 10, 2027 (suspended):** Would have made C3PAO Level 2 a condition for option exercises on existing contracts, and made Level 3 (DIBCAC) mandatory in applicable solicitations. Swept up in the suspension of future milestones. **Phase 4 — was November 10, 2028 (suspended):** Full implementation across all applicable DoD contracts above the micro-purchase threshold. Also on hold. [](https://6402824.fs1.hubspotusercontent-na1.net/hubfs/6402824/CMMC/15CMMC_Level1Requirments_Checklist.pdf) **What applies in the meantime:** During the review, the DoW is enforcing cybersecurity through NIST SP 800-171 Rev 2 self-assessments and DFARS 252.204-7012 — the safeguarding obligation that never went away. A CMMC Reform Task Force will report to the DoW CIO within 60 days, drawing on a public request for information due August 14, 2026. ### Start Your Free Assessment If you’re preparing for CMMC 2.0 Level 1 compliance, our technology partner, Carbide, offers a [free Self-Assessment Tool](https://carbidesecure.com/cmmc-level-1-questionnaire/) to help you navigate the process. This tool provides step-by-step guidance and generates a report identifying any gaps that must be addressed to meet the requirements. [START YOUR FREE ASSESSMENT](https://carbidesecure.com/cmmc-level-1-questionnaire/) _*For more guidance, consult resources such as the [DoD’s CMMC documentation and self-assessment guides](https://dodcio.defense.gov/cmmc/Resources-Documentation/)._ #### BUILT FOR CMMC 2.0 ## G-Code Management & DNC Platform The G-code piece of your CMMC plan. Traceability, compliance, and control — all in a GovCloud-hosted platform. [Learn More](https://datanomix.io/g-code-cloud/) [](https://datanomix.io/g-code-cloud/)