CMMC Level 1 gap analysis: what self-attestation actually requires
Geert WarmenbolApril 29, 2026
Key takeaways
CMMC Level 1 covers 17 safeguarding requirements from 48 CFR 52.204-21 for Federal Contract Information (FCI) -- not CUI, not NIST SP 800-171, not the 110-control framework that Level 2 requires.
Self-attestation does not mean light scrutiny: misrepresenting Level 1 compliance in a federal contract creates False Claims Act exposure, where penalties run to three times the contract value plus per-claim fines.
In Vulnox assessments of Level 1 environments, 28% of in-scope hosts lacked FIPS-validated cryptography where required -- a gap that contractors had self-attested away without validating actual system configuration.
The most common Level 1 finding is not a missing control -- it is a control that exists in policy but has never been verified against live system state. Password policies, account lockout configurations, and patch status are the typical offenders.
Microsoft 365 GCC High does not automatically satisfy CMMC Level 1 controls. Conditional access policies, audit log configuration, and data handling procedures are tenant-owner responsibilities, not Microsoft's.
A signed self-attestation that contradicts what an auditor finds in the environment is not a compliance posture -- it is a liability document.
TL;DR
CMMC Level 1 is 17 controls, self-attested, with no third-party verification required. That combination creates a predictable failure pattern: contractors document the controls, believe the documentation, and never validate whether the systems behind it actually behave the way the policy says they do. The gap between the attestation and the environment is where the False Claims Act risk lives. A gap analysis at Level 1 is not bureaucratic overhead -- it is the check that makes the attestation defensible.
What the audit actually found
A mid-size manufacturing contractor -- 60 employees, two IT staff, active DoD subcontracts -- had been self-attesting to CMMC Level 1 compliance for two years. Their system security plan was current. Their policy documents covered all 17 requirements. When a Vulnox assessment was triggered by a contract expansion requiring documented compliance evidence, the technical validation found that the password complexity policy in their Active Directory did not match the policy document. The documented requirement was a 12-character minimum with complexity rules. The enforced Group Policy Object had a 6-character minimum with no complexity requirement and had been that way since a domain migration 18 months earlier.
The policy was not lying. The engineer who wrote it believed it was accurate. Nobody had validated the GPO against the policy since the migration. The self-attestation was signed by an executive who had no reason to doubt the policy document. That is not fraud in intent -- but it is the exact pattern that produces False Claims Act exposure when a breach investigation connects the dots. The gap was not in the policy. It was between the policy and the system.
What the 17 controls actually require
CMMC Level 1 derives from 48 CFR 52.204-21, which establishes basic safeguarding requirements for systems that process, store, or transmit Federal Contract Information. FCI is distinct from CUI -- it is information provided by or generated for the government under a contract, not intended for public release. The 17 practices map across six control families: Access Control (AC), Identification and Authentication (IA), Media Protection (MP), Physical Protection (PE), System and Communications Protection (SC), and System and Information Integrity (SI). The requirements are genuinely basic -- they predate CMMC and existed as FAR clause obligations before the CMMC framework was formalized.
Example
SC requirement 4.21(a)(8) requires that organizations implement cryptographic mechanisms to prevent unauthorized disclosure of FCI during transmission unless otherwise protected by alternative physical safeguards. In practice, this means FIPS-validated encryption on any network path that carries FCI. The gap is not that organizations fail to use encryption -- most use TLS everywhere. The gap is that TLS configured with non-FIPS cipher suites does not satisfy the requirement, and most contractors have never run a cipher suite audit on their FCI-handling systems. On Windows Server environments, running Get-TlsCipherSuites and filtering for non-FIPS-compliant entries takes about four minutes and consistently finds configurations that contradict self-attestation.
The FIPS validation requirement applies to the cryptographic module, not just the protocol. A system running TLS 1.2 with AES-256 is not automatically FIPS-compliant -- the cryptographic module implementing that cipher must be FIPS 140-2 or 140-3 validated, and FIPS mode must be enabled at the OS level. Windows has a FIPS compliance Group Policy setting. It is off by default. Most Level 1 environments have never enabled it.
What Vulnox finds in Level 1 environments
Assessment base: Vulnox assessment data, 2024-2025, DoD subcontractor environments at CMMC Level 1 self-attestation stage
FIPS-validated cryptography gaps are the most common technical finding
In assessments of environments where contractors had self-attested to CMMC Level 1 compliance, Vulnox found that 28% of in-scope hosts lacked FIPS-validated encryption in the configurations required by SC 4.21(a)(8). The gaps were not in TLS adoption -- encryption was present. The gaps were in FIPS mode configuration, cipher suite selection, and the distinction between a validated cryptographic module and a standard implementation of the same algorithm.
A contractor who has attested to meeting SC 4.21(a)(8) and has a breach that exposes FCI on a system running non-FIPS cipher suites has signed a document that contradicts what forensic analysis will find. That is the False Claims Act exposure pattern.
Policy documents and live configurations diverge after routine IT changes
The most consistent pattern across Level 1 assessments is not missing policies -- it is policies that were accurate when written and have since drifted from the system configurations they describe. Domain migrations, cloud transitions, and MSP onboarding events are the most common triggers. When an MSP takes over endpoint management, they typically apply their standard configuration baselines, which may not match the security policy the contractor wrote before the MSP relationship began. Nobody updates the SSP to reflect the change, and nobody validates that the MSP baseline satisfies the requirements.
MSP involvement does not transfer compliance responsibility. The contractor signs the self-attestation. If the MSP's baseline does not satisfy the 17 requirements, the attestation is inaccurate regardless of what the MSP's own compliance documentation says.
Scope definition routinely excludes systems that handle FCI
In scoping interviews before Level 1 gap assessments, contractors consistently scope around their primary production systems and exclude communication platforms, file sharing tools, and personal devices used by employees who receive FCI via email or shared drives. FCI does not require special handling procedures to be in scope -- if the system receives, stores, or transmits information provided under a federal contract, it is in scope. Collaboration tools where contract deliverables are shared, email systems where contracting officers send requirements, and backup systems where project files are retained all qualify.
A self-attestation scoped to the server room while FCI flows through Microsoft Teams and personal laptops is not a compliance attestation -- it is a compliance misunderstanding.
The contractors most at risk are not the ones who skipped the process
Common belief
The conventional assumption about CMMC Level 1 failure is that it happens at organizations that took shortcuts -- that did the minimum paperwork and never thought seriously about the controls. Those organizations exist. But they are not the ones that produce the most consequential compliance gaps.
What we found
In Level 1 gap assessments, organizations with recent MSP onboarding or infrastructure migrations show a higher rate of policy-to-configuration divergence than organizations that have had stable infrastructure for several years. The compliance work was real. The maintenance cadence after the IT event was not.
The higher-risk pattern is the organization that took Level 1 seriously, documented every control, trained staff, and then had a routine IT event -- a migration, an MSP change, a cloud transition -- that changed system configurations without anyone updating the compliance documentation. These organizations have a defensible paper posture and an indefensible technical reality. The documentation creates the appearance of due diligence, which makes the gap harder to detect internally and harder to explain externally when it surfaces during a breach investigation.
Where Level 1 self-attestation programs break down
The MSP responsibility assumption
Contractors who use managed service providers frequently assume that MSP involvement transfers or satisfies compliance obligations. It does not. The contractor signs the self-attestation. The 17 requirements apply to the contractor's systems and processes regardless of who manages them. MSP service agreements define operational responsibilities, not compliance responsibilities. The contractor needs to verify that the MSP's standard configuration baselines satisfy each of the 17 requirements -- and document that verification. Most do not.
M365 GCC High as a compliance proxy
A common belief among contractors using Microsoft 365 Government Cloud High is that the platform's authorization status satisfies CMMC Level 1 controls. The platform's FedRAMP High authorization covers Microsoft's infrastructure and services -- it does not configure the tenant to meet CMMC requirements. Azure AD Conditional Access policies, audit log retention settings, data loss prevention configurations, and guest access controls are tenant-owner responsibilities. An M365 GCC High tenant with default settings and no security configuration hardening does not satisfy Level 1, and the authorization letter does not say it does.
The self-attestation signing process as a control
Self-attestation requires a senior official to affirm that the contractor meets the 17 requirements. In practice, that official is typically signing based on representations from IT staff or the MSP, not based on direct technical validation. The signature is the attestation -- it has legal weight. The validation process behind the signature is rarely documented. When an audit or breach investigation asks how the organization confirmed that the systems matched the attestation, 'the IT manager said so' is not a defensible answer.
Training documentation as evidence of training
Awareness training is a Level 1 requirement, and most contractors have training records. The gap is usually in what the training covers versus what the requirement specifies. Training that covers general cybersecurity awareness and phishing recognition satisfies the spirit of the requirement. Training that does not include specific instruction on how employees should handle FCI -- what it is, where it can be stored, how it can be transmitted, how incidents should be reported -- does not satisfy the letter of it. The distinction matters if a breach involves employee mishandling of FCI after a training program that did not address FCI handling.
Where Level 1 enforcement pressure is heading
The False Claims Act will be used against a CMMC Level 1 self-attesting contractor within 18 months of a significant breach at a DoD subcontractor, creating the enforcement precedent that makes self-attestation accuracy a legal risk rather than a theoretical one.
The legal framework for False Claims Act liability based on cybersecurity misrepresentation already exists -- the DOJ's Civil Cyber-Fraud Initiative established it explicitly. What is missing is a high-profile enforcement action against a small contractor that self-attested to Level 1 compliance and had a breach. Once that precedent exists, the risk calculus for casual self-attestation changes across the contractor base.
Confidence: highA DOJ Civil Cyber-Fraud Initiative enforcement action specifically citing CMMC Level 1 self-attestation inaccuracy as the basis for False Claims Act liability within 24 monthsAI-assisted self-assessment tools will produce a generation of well-formatted, technically plausible SSPs that have no relationship to the actual system configurations they describe -- creating a documentation quality problem that makes breach investigations more complex without improving actual security posture.
SSP generation is a natural AI use case, and several tools already assist with it. The output looks like a real SSP. The problem is that an AI-generated SSP describes a hypothetical environment based on inputs the user provides -- it does not verify that the described controls exist in the actual systems. The gap between document and reality will widen as documentation quality improves without corresponding improvement in configuration validation.
Confidence: mediumC3PAO assessors or breach investigators publicly reporting a pattern of high-quality SSP documentation that does not match observed system configurations, attributed to AI-assisted document generation
Why Level 1 deserves more serious treatment than it gets
CMMC Level 1 is treated as a compliance formality by most of the contractor base, and the 17-control framework reinforces that perception -- 17 controls sounds like an afternoon of work. The problem is that the False Claims Act does not grade on a curve. A self-attestation that misrepresents compliance with 3 of the 17 requirements carries the same legal weight as one that misrepresents all 17. The enforcement threshold is not proportional to the number of gaps -- it is binary. You attested or you did not, and the attestation was accurate or it was not. Treating Level 1 as a serious compliance exercise rather than an administrative step is not overcaution. It is accurate risk management.
Counterargument
The counterargument is that enforcement against small contractors for Level 1 attestation inaccuracies is practically nonexistent and that the compliance overhead is disproportionate for organizations running basic IT environments. That is true today. It will be less true after the first high-profile enforcement action, and the contractors who built a validation habit before that action will be in a different position than those who did not.
One validation to run before the next attestation is signed
Pull the Group Policy Objects or equivalent configuration baselines that enforce your password policy, account lockout settings, and audit logging on every system in your FCI boundary. Compare them to what your SSP says they are. If the configurations match the documented policy on all three, you have a defensible attestation for those controls. If they do not match, you have found a gap that exists right now, regardless of what the policy document says. That comparison takes under an hour and is the single highest-value action a Level 1 contractor can take before signing another self-attestation.
Further Reading
Gap Analysis
CMMC Level 1 gap analysisDigital Footprint
digital footprint monitoringNIST SP 800-30 Risk Assessment Guide
NIST risk assessment guideUnderstanding Compliance Gap Analysis
compliance gap analysis guideNVD CVE Process Explained
NVD CVE process
Frequently Asked Questions
What are the 17 CMMC Level 1 controls and where do they come from?
CMMC Level 1's 17 safeguarding requirements derive from 48 CFR 52.204-21, the FAR clause for basic safeguarding of Federal Contract Information (FCI). They span six control families: Access Control, Identification and Authentication, Media Protection, Physical Protection, System and Communications Protection, and System and Information Integrity. These requirements predate CMMC and apply to any contractor system that receives, stores, or transmits FCI.
What is the False Claims Act risk in CMMC Level 1 self-attestation?
Signing a CMMC Level 1 self-attestation that misrepresents compliance creates False Claims Act exposure under the DOJ Civil Cyber-Fraud Initiative. Penalties run to three times the value of the affected contracts plus per-claim fines. The risk is not theoretical -- the legal framework exists and has been used in cybersecurity misrepresentation cases. A breach that exposes FCI on systems whose configuration contradicts the attestation is the most likely trigger.
Does FIPS-validated cryptography apply to CMMC Level 1?
Yes. SC requirement 4.21(a)(8) requires cryptographic mechanisms to protect FCI in transmission, and FIPS-validated cryptographic modules satisfy that requirement. In Vulnox assessments, 28% of in-scope hosts in Level 1 environments lacked FIPS-validated configurations despite claimed compliance. FIPS mode on Windows is disabled by default and must be explicitly enabled via Group Policy.
Does Microsoft 365 GCC High satisfy CMMC Level 1 requirements?
No. GCC High's FedRAMP High authorization covers Microsoft's infrastructure -- it does not configure the tenant to satisfy CMMC requirements. Conditional Access policies, audit log retention, guest access controls, and data handling configurations are tenant-owner responsibilities. A GCC High tenant with default settings does not satisfy Level 1.
If our MSP manages our systems, are we covered for CMMC Level 1?
No. The contractor signs the self-attestation and owns the compliance obligation. MSP involvement does not transfer responsibility. The contractor must verify that the MSP's standard configuration baselines satisfy each of the 17 requirements and document that verification. If the MSP's baseline does not meet the requirements, the attestation is inaccurate regardless of the MSP's own compliance documentation.
What is the most common CMMC Level 1 finding in gap assessments?
The most common pattern is policy-to-configuration divergence: controls that were accurately documented at one point and have since drifted from live system state due to IT changes, MSP onboarding, or infrastructure migrations. Password policies, account lockout settings, and audit log configurations are the most frequent offenders.
How should an organization scope a CMMC Level 1 gap analysis?
Scope must include any system that receives, stores, or transmits FCI -- including email, collaboration tools, file sharing platforms, and personal devices used to handle contract deliverables. Contractors frequently scope to production servers while FCI flows through Teams, shared drives, and backup systems that are treated as out of scope.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.