What are the CMMC Level 1 self-assessment requirements for DoD contracts in late 2026?

A CMMC Level 1 self-assessment in late 2026 entails meeting the 15 security requirements outlined in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. These requirements are numbered (i) through (xv) in the clause. The CMMC Program rule, published October 15, 2024, and the DFARS CMMC acquisition rule, published September 10, 2025, specify that Level 1 is a self-assessment. The first phase of CMMC implementation began on November 10, 2025, and all Phase 1 self-assessment requirements remain in place as of July 13, 2026. You conduct the self-assessment yourself, and the resulting CMMC Status is valid for three years from the CMMC Status Date. This means you will need to re-assess every three years. You submit the self-assessment data to the DoD's Supplier Performance Risk System (SPRS), which is where the CMMC Status is recorded.