CMMC and NIST SP 800-171AwarenessFoundation

CMMC Level 1 Overview

The 15 basic safeguards for federal contract information and how the annual self-assessment works

Duration: 1.5 hours
Modules: 4
Final exam: 70% to pass
Certificate: No expiry

$59

Lifetime access to the course and your certificate
Verifiable Certificate of Completion. Certificate does not expire.
3 exam attempts
Progress saved to your account on every slide

Buying for a team? Volume pricing from 5 seats

1 to 4 seats	List price
5 to 10 seats	15% off
11 to 20 seats	25% off
21 or more seats	35% off

Seats

$250.75

5 × $50.15 · save $44.25

Each seat is a single-use code. Send one to each learner; they sign in with their own account and earn their own certificate. Track progress on your Team page.

About this course

CMMC Level 1 is the entry point to the Cybersecurity Maturity Model Certification programme. It applies to every defense supplier that holds federal contract information: purchase orders, schedules, quality clauses, invoices and the emails that carry them. The requirement reaches small companies through DFARS 252.204-7021 as the programme phases into contracts over several years from late 2025, and a current status in SPRS is a condition of award.

This awareness course explains what CMMC is, how the three levels differ and who needs Level 1. It then takes the 15 requirements of FAR 52.204-21, grouped into the 6 CMMC domains, and explains each in plain language with what it looks like in a small machine shop, distributor or service provider. You learn how to scope the annual self-assessment, how the senior official's affirmation in SPRS works, why no plan of action is allowed at Level 1 and what evidence to keep for 6 years. The last module covers the gaps found most often and what every employee is responsible for.

The course is awareness level. It is anchored on 32 CFR Part 170, FAR 52.204-21 and the CMMC Level 1 Assessment and Scoping Guides published by the DoD CIO. It does not give legal advice, does not make anyone an assessor and does not replace your company's procedures.

The course closes with a 10-question examination drawn from a bank of 20. On passing you receive a PlanetISO Certificate of Completion with lifetime access to the course content and your certificate. The certificate does not expire.

What you will be able to do

Explain what the CMMC programme is, how 32 CFR Part 170 and DFARS 252.204-7021 bring it into contracts, and how the three levels differ.
Define federal contract information and decide whether a given document or system is in scope for Level 1.
Describe each of the 15 FAR 52.204-21 requirements in plain language and recognize what MET looks like in a small company.
Outline the annual self-assessment: scoping, the examine, interview and test methods, the SPRS entry and the senior official's affirmation.
State why Level 1 permits no plan of action and what evidence must be retained for 6 years.
Identify the common gaps that stop a small supplier reaching Level 1 and the daily habits every employee must keep.

Course outline

1
What CMMC is and who needs Level 1
The Cybersecurity Maturity Model Certification programme, its three levels, how it reaches your contracts through the DFARS, and what federal contract information is.
About 18 minutes, then a module quiz
2
The 15 requirements in plain language
The 15 basic safeguards of FAR 52.204-21 grouped into the 6 CMMC Level 1 domains, each explained in plain words with what it looks like in a small machine shop or distributor.
About 25 minutes, then a module quiz
3
The annual self-assessment and affirmation
Scoping to the assets that process, store or transmit FCI, how the self-assessment is done, the senior official's affirmation in SPRS, why no plan of action is allowed and what evidence to keep.
About 20 minutes, then a module quiz
4
Getting ready: common gaps and your part in it
The gaps that most often stop a small company reaching Level 1, what each employee is responsible for every day, and scenarios from the shop floor and the stockroom.
About 20 minutes, then a module quiz
Final examination and certificate
10 questions drawn from the course bank. Score 70% or higher to receive your Certificate of Completion.

Who it is for

Owners, general managers and office managers of small defense suppliers who must get a Level 1 status into SPRS
Quality, purchasing and IT staff asked to run or support the self-assessment
Shop floor, stockroom, shipping and administrative employees whose daily habits make the 15 requirements work
Prime contractor supplier quality staff who need to explain Level 1 to their supply base

Prerequisites

None.

Questions

Does completing this course give my company CMMC Level 1 status?

No. Level 1 status comes from your company's own self-assessment against the 15 requirements, entered in SPRS and affirmed by a senior official. This course teaches you what that involves so you can do it well.

We receive government drawings. Is Level 1 enough?

Probably not. Drawings and technical data on a defense contract are usually controlled technical information, a form of CUI, which puts you at Level 2. Level 1 is still the foundation and the fastest thing to put in place. PlanetISO offers a separate CMMC Level 2 and NIST SP 800-171 Overview.

Is this course a substitute for the official CMMC guides or legal advice?

No. It is awareness level training. The authority on the programme is the DoD CIO, which publishes the CMMC Assessment and Scoping Guides, and the Cyber AB for the assessor ecosystem. Follow your company's procedures and consult your own advisers on contract questions.

What certificate do I receive?

You receive a PlanetISO Certificate of Completion showing the course title, your name and your exam result. It does not expire. It is evidence of training for your company's training record and for an assessor. It is not an accreditation and does not make you a CMMC Certified Professional or Certified Assessor.

How long do I have access?

Lifetime access to the course and your certificate. You can revisit any module and download your certificate at any time.

What happens if I fail the exam?

You have 3 attempts. Each attempt draws a different 10-question set from the bank of 20, and module quizzes can be retaken without limit to prepare.

CMMC and NIST SP 800-171Short course
CMMC Level 2 and NIST SP 800-171 Overview
What a Level 2 assessment expects, how the 110 requirements are organized and how to build a program that passes
Duration
3 hours
Level
Foundation
$99
View course
CMMC and NIST SP 800-171Awareness
Insider Threat Awareness
Recognize and report the indicators that protect your colleagues, your company and controlled information
Duration
1.5 hours
Level
Foundation
$59
View course
CMMC and NIST SP 800-171Awareness
Phishing and Email Security
Spot the message that is trying to trick you, and know exactly what to do next
Duration
1.5 hours
Level
Foundation
$59
View course
CMMC and NIST SP 800-171Awareness
Social Engineering Prevention
Recognize manipulation in person, on the phone and online, and verify before you act
Duration
1.5 hours
Level
Foundation
$59
View course
CMMC and NIST SP 800-171Awareness
CUI Handling and Marking
Recognize controlled unclassified information, mark it correctly and handle it safely
Duration
1.5 hours
Level
Foundation
$59
View course

About this course

What you will be able to do

Course outline

What CMMC is and who needs Level 1

The 15 requirements in plain language

The annual self-assessment and affirmation

Getting ready: common gaps and your part in it

Final examination and certificate

More CMMC and NIST SP 800-171 training

CMMC Level 2 and NIST SP 800-171 Overview

Insider Threat Awareness

Phishing and Email Security

Social Engineering Prevention

CUI Handling and Marking