What Records Do You Need to Keep for CMMC Level 1?

Most of the attention on CMMC Level 1 goes to the assessment itself — the 15 requirements, the answers, the SPRS submission. What gets skipped is what happens afterwards.

You’re required to keep the evidence behind your assessment, and the retention period is longer than most people expect.

Six years

The CMMC rule is specific: the artifacts supporting your assessment must be retained for six years from your CMMC Status Date (32 CFR § 170.15(c)(2)).

That’s six years from the date of the assessment, not six years from when you last thought about it. An assessment completed this month has records that need to survive until 2032 — through at least five annual re-affirmations, probably a computer replacement or two, and possibly a change of bookkeeper.

This is the part that tends to go wrong quietly. Nobody fails to keep records on purpose. They just don’t decide where the records live, and three years later nobody can find them.

What counts as evidence

Level 1 doesn’t formally require a System Security Plan the way Level 2 does. That’s often heard as “no documentation needed,” which isn’t what it means. You still need to be able to show what you did and why you concluded each requirement was met.

For a small contractor, useful evidence usually looks like:

  • A list of your systems and who uses them. Which computers, which cloud services, which accounts, and which of those touch Federal Contract Information.
  • Your account list. Who has an account, what access they have, and evidence that former employees were removed.
  • Screenshots of key settings. Sharing restrictions in your file storage, antivirus enabled and updating, automatic updates on, guest access configured. A dated screenshot is modest evidence but it’s real, and it’s far better than a memory.
  • Your written answers and reasoning. For each of the 15 requirements, what you concluded and what you looked at to conclude it. The reasoning matters more than the answer — in three years you will not remember why you marked a requirement met.
  • Records of what you fixed. If a gap was found and closed, note what it was, what you changed, and when.
  • Disposal records. When a computer or drive leaves the building, a note of what happened to it. This is the Media Disposal requirement, and it’s the one that most often has no paper trail at all.
  • Physical access records. Visitor logs if you keep them, and a note of how your premises are controlled.
  • The affirmation itself, and a record of who reviewed what before signing.

Why it matters more than it sounds

Your affirmation is a statement to the government that your assessment is accurate. Records are what make that statement defensible.

If a prime asks for evidence, or a contracting officer questions a score, or a dispute arises years after the fact, the question won’t be whether you believed you were compliant. It’ll be what you can show. An assessment with no supporting record is an assertion; an assessment with contemporaneous notes and screenshots is a documented position.

The gap between those two is small to create and very large to reconstruct after the fact.

A system that actually survives six years

The failure mode isn’t inadequate records. It’s records scattered across one person’s laptop, an email thread, and a folder nobody else can find.

A few things make the difference:

One folder, named plainly. CMMC Level 1 — 2026 Assessment. Not nested six levels into someone’s personal drive.

Somewhere the company controls, not an individual. If your evidence lives in the departing office manager’s OneDrive, it leaves when they do.

A dated subfolder per assessment year. You’ll do this annually. Keeping each year separate means you can show what was true then, not only what’s true now.

An exported copy. Whatever tool you used to run the assessment, export the results to a file you hold yourself. Don’t rely on a vendor’s account still existing in 2032 — including ours.

A note in the calendar. The same reminder that prompts your annual re-affirmation should prompt you to file that year’s evidence.

The bottom line

Keep your supporting evidence for six years from your CMMC Status Date, in a company-controlled folder, organised by year, with your reasoning written down rather than remembered.

It takes an afternoon to set up and it converts your affirmation from a claim into something you can stand behind. For who signs that affirmation, see who can be your affirming official.