What Evidence to Keep for a CMMC Level 1 Self-Assessment

Evidence should help an organization explain what safeguard is in place, where it applies, and how it verified the result. The exact assessment scope and procedure matter: 32 CFR 170.15 directs Level 1 self-assessments to defined objectives and requires assessment artifacts to be retained for six years from the CMMC Status Date. A folder of policies alone does not demonstrate that every applicable safeguard is operating.

A practical evidence index

Keep a simple index with the requirement, system or location in scope, artifact name, owner, date reviewed, and storage location. Depending on the safeguard and your actual environment, useful records may include:

• Access and permitted functions: current authorized-user and device rosters, account approval/removal records, and role or permission reviews.
• External connections and public information: approved external-system list, boundary/network diagrams, connection settings, and review/approval records for public content.
• Identification and authentication: account standards and relevant configuration evidence showing how identities are established and authenticated.
• Media and physical access: media sanitization/disposal records; facility access lists; visitor logs; escort procedures; access-device records; and physical-access audit logs.
• Communications and separation: diagrams and relevant configuration records showing boundary protections and separation of public-facing components from internal networks.
• Flaws, malicious-code protection, and scanning: patch or remediation tickets, malware-protection configuration and update records, and periodic or real-time scan evidence relevant to the in-scope systems.

Use records that reflect the system and period actually assessed. Record exceptions truthfully and follow the formal Level 1 assessment process; Level 1 does not permit POA&Ms for requirements that are not MET. Protect the evidence itself: minimize copies, limit access, redact unrelated personal or sensitive information where appropriate, and never store passwords, secrets, or unnecessary sensitive contract details in a general evidence packet.

The retention rule is specific: artifacts used as evidence for the assessment must be retained for six years from the CMMC Status Date under § 170.15. Follow applicable contract, legal, and company recordkeeping requirements as well; this summary is not a complete retention policy.

The free Readiness Check helps list items to review. The CMMC Level 1 Self-Assessment Kit includes an evidence checklist and nine fill-in evidence forms. These are organizational aids, not proof that a control is implemented or an official assessment.

Important limits: CyberSure is a private company, not affiliated with or endorsed by DoD/DoW, the U.S. Army, or any government agency. This guide is general information, not legal advice, certification, or an official assessment. Contract and data applicability depend on the specific contract and scope.