What are the current CMMC Phase 1 requirements for October 2026, after the suspension of Phase II?

The CMMC Level 1 self-assessment for your October 2026 RFP requires you to implement and attest to the 15 security requirements of FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. These 15 requirements are specified in the FAR clause itself, numbered (i) through (xv). Your company performs a self-assessment to ensure compliance with these safeguards. The CMMC Level 1 self-assessment is conducted every three years, and the resulting CMMC Status is valid for three years from the CMMC Status Date. The Department suspended Phase II of CMMC implementation on July 13, 2026, meaning all Phase I self-assessment requirements remain in place. For your IT services RFP, you need to ensure these 15 basic safeguarding requirements are in place within your information systems and be prepared to attest to that fact.