CMMC Level 1 self-assessment checklist (construction context)

Every CMMC 2.0 Level 1 practice translated from cybersecurity-speak into construction-firm reality, plus what changed under the 2024 final rule and the 2025-2026 DoD phase-in.

Why construction subs need a CMMC Level 1 checklist in 2026

CMMC went live for federal-construction subcontractors in November 2025. The Department of Defense finalized the Cybersecurity Maturity Model Certification 2.0 final rule in October 2024, and the phase-in began the following year. DoD solicitations now name a required CMMC level under DFARS 252.204-7021, and primes are required to flow that requirement down to every sub that touches Federal Contract Information (FCI).

Roughly 63% of the Defense Industrial Base, including the vast majority of federal-construction subcontractors, falls into Level 1. If you’re a sub on a DoD construction project and you receive RFIs, schedules, submittals, or any non-public job specifics from the contracting agency, you handle FCI. That puts you on the hook for an annual self-assessment against 17 cybersecurity practices, all aligned with FAR clause 52.204-21(b)(1) and required to be self-attested through the SPRS portal.

The complication for construction is that every top-ranked CMMC self-assessment guide on the internet is written by cybersecurity SaaS for IT departments. They walk you through “implement multi-factor authentication” without acknowledging that your “system” is a foreman’s iPad, a BIM workstation in a trailer, a jobsite WiFi router, and a paper set of drawings clipped to a clipboard. The 17 practices apply, but they translate differently when your business runs out of trailers and trucks instead of an office.

This checklist is the practitioner’s translation. We’ve taken the CMMC Level 1 framework, the 17 practices that auditors check, the SPRS submission process, the senior-official attestation requirement, and rendered each item in the actual operational language of a construction firm. Items 1, 4, 9, and 10 are where most construction subs trip up because they don’t realize the practice has a physical-world manifestation on their jobsite. The rest are universal IT hygiene with construction-flavored examples.

Run this list once a year. Sign the SPRS attestation. Keep the evidence log alongside it so when your prime’s contracting officer asks for proof of compliance, you have the answer in a folder rather than a scramble. The cost of a missed CMMC requirement under the new False Claims Act exposure (added by the 2025 final rule) is materially higher than the cost of running the checklist annually.

Who this checklist is for

• Federal-construction subcontractors on DoD-prime projects who handle FCI (RFIs, schedules, submittals, non-public job documents)
• 8(a) federal subs on DoD set-aside contracts
• Construction-firm IT/operations leads preparing the annual SPRS self-attestation
• Compliance officers building the evidence log behind the attestation
• Prime contractors auditing their sub-tier CMMC posture under the new flow-down requirement

If you handle Controlled Unclassified Information (CUI), engineering drawings of sensitive facilities, classified specifications, etc., you need Level 2 instead, which requires a third-party C3PAO assessment against 110 practices. Level 1 is for FCI only.

The 12 practical actions that satisfy CMMC Level 1

The checklist covers 12 practical actions that satisfy the 17 CMMC 2.0 Level 1 practices in a construction-firm operating environment:

1. Confirm whether you handle FCI on DoD jobs. Pull every active and recent DoD subcontract and identify each that flows non-public job specifics to your firm. Schedules, RFIs, submittals, ROEs, and project drawings all count as FCI. Commercial work and federal civilian work (non-DoD) do not trigger CMMC; only DoD prime/sub relationships do. If you handle CUI (sensitive specifications, classified drawings), you need Level 2, not this checklist.
2. Limit jobsite WiFi access to authorized field staff. Practice AC.L1-3.1.1 requires limiting access to authorized users. On a jobsite, that means a separate work-WiFi network with WPA3 (or WPA2 minimum) and a non-default password, and an explicit list of authorized devices. The “guest” network for visiting subs and family-members of crew gets a different SSID and password, isolated from the project network.
3. Restrict project drawings to need-to-know personnel. Practice AC.L1-3.1.2 limits information access to authorized purposes. Drawings stored in shared cloud folders need permission lists. Email distribution of drawings goes only to people whose role requires them. A foreman doesn’t need full structural drawings; an estimator doesn’t need post-bid construction sets.
4. Change default passwords on field tablets and devices. Practice IA.L1-3.5.1 + IA.L1-3.5.2 require unique authentication. Every iPad, ruggedized laptop, total station, and WiFi router on the jobsite must have its factory-default password changed and replaced with one that meets your firm’s password policy. This is the single most-missed practice on construction self-assessments because devices change hands fast.
5. Enforce MFA on email and project portals. Project-management portals (Procore, Autodesk Construction Cloud, Microsoft Teams), corporate email, and any cloud-stored drawings repository must require multi-factor authentication for all users. SMS-based MFA is acceptable at Level 1 (Level 2 requires phishing-resistant MFA). Document the MFA enforcement setting in your IT policy.
6. Sanitize devices before disposal or trade-in. Practice MP.L1-3.8.3 requires sanitizing or destroying media before disposal. When a superintendent’s laptop ages out, when an iPad gets traded in, when a hard drive is replaced. The device must be wiped to a NIST 800-88 standard or physically destroyed. Documented chain-of-custody prevents data leakage and audit findings.
7. Patch superintendent laptops and BIM workstations monthly. Practice SI.L1-3.14.1 requires identifying and remediating system flaws in a timely manner. Operating system patches, software updates, and BIOS/firmware updates get applied on a regular cadence. Monthly is the construction-firm standard. Track the patch dates per device in your evidence log.
8. Run antivirus on all field-issued devices. Practice SI.L1-3.14.2 + SI.L1-3.14.4 require malware protection that’s kept current. Every Windows laptop, Mac, and iPad with file-management capability needs an active endpoint protection agent. Built-in OS protection (Microsoft Defender, macOS XProtect) is acceptable; document its enabled status.
9. Escort visitors at jobsite trailers and IT closets. Practice PE.L1-3.10.1 + PE.L1-3.10.3 + PE.L1-3.10.4 + PE.L1-3.10.5 cover physical access. Vendors, delivery drivers, and other visitors who enter the trailer where FCI is stored must be signed in and escorted. Rack rooms, server closets, and locked filing cabinets follow the same escort rule. Most construction firms already enforce this informally. Formalize it with a sign-in log.
10. Lock physical drawings and FCI documents in trailers. Drawings printed to paper, USB drives carrying project files, and any printed RFIs or submittals must be stored in locked containers when not in use. End-of-day cleanup includes returning drawings to the locked file cabinet. Practice PE.L1-3.10.4 requires this for any media containing FCI.
11. Annual self-attestation in SPRS portal. Once practices 1–10 are evidenced, a senior company official (typically owner, president, or CEO) submits the annual self-assessment through the Supplier Performance Risk System (SPRS) portal at sprs.dla.mil. The submission includes the affirmation that all 17 practices are implemented. Materially false attestations now carry False Claims Act exposure under the 2025 DoD final rule.
12. Sample evidence log for prime contracting officer. Build a single binder (or shared folder) per DoD subcontract with: the SPRS self-assessment confirmation, signed attestation cover letter, a copy of your IT policy showing MFA + patching + sanitization, sign-in logs from the jobsite, and screenshots of antivirus enrollment. Primes will increasingly request this artifact as part of their own sub-tier audit obligations.

How to run the checklist annually

Run this checklist annually before your SPRS attestation deadline (typically the project anniversary date for ongoing subs). For each item:

• Mark
• In place (practice is implemented and evidenced),
• Gap (not yet implemented or no evidence), or
• Document (implemented but evidence file is missing).
• Anything
• Gap gets an owner and 30-day deadline. Don’t sign the SPRS attestation while a Gap is open.
• Anything
• Document gets the evidence file pulled into the binder and indexed by practice ID.
• Save the completed checklist alongside the SPRS submission confirmation. When your prime’s contracting officer requests proof, the binder is the answer.

The 30-minute version: walk through the 12 items with your IT lead and your senior project manager. Most construction subs find 2–3 Gaps on the first run; almost all are remediated within 14 days.

Stop guessing on CMMC compliance

The 17 CMMC Level 1 practices map cleanly to construction-firm operations once you’ve translated the cybersecurity-speak. The hard part isn’t the implementation. It’s keeping the evidence current when devices change hands, jobsites turn over, and IT policies drift. Contracts Connected’s compliance dashboard keeps every practice’s status, evidence file, and last-reviewed date indexed in one place, so the annual SPRS attestation is a 30-minute review, not a 30-hour reconstruction.

Frequently asked questions about CMMC Level 1 for construction

Related templates

• CMMC Level 2 readiness checklist (construction)When you handle CUI, not just FCI. The 110-practice Level 2 prep for construction subs.
• CMMC documentation binder checklistWhat goes in the binder primes will ask for, practice-by-practice evidence index.
• Federal subcontract flow-down clauses checklistEvery clause primes must flow down to subs, including DFARS 7021 and 7012.
• DFARS 252.204-7012 incident reporting checklistThe 72-hour incident report process that pairs with CMMC L1 + L2.