Here's the trap that catches confident shops. You read the 15 Level 1 requirements, you think "we do all of that," and you're probably right - you do. But doing it and being able to prove you did it are two different things, and Level 1 quietly requires the second. The requirement most likely to sink an otherwise-solid self-assessment isn't a control you're failing. It's the evidence you never thought to keep.
This guide is the artifact list nobody hands you: for each requirement, the specific thing to save, where it comes from, and how often to grab it. It's also, not coincidentally, the difference between a self-assessment you can defend and one that falls apart the moment a prime asks "show me."
Why evidence, when it's a self-assessment?
Fair question. Level 1 doesn't involve a third-party auditor combing your files - you assess yourself and affirm the result. So why keep proof?
Three reasons, each real. First, you can be asked for it. If you work through a prime, flowdown means the prime is on the hook for its supply chain, and a growing number verify posture before and during a contract - "send us your evidence" is a normal request now, not a hypothetical. If you hold the contract directly, your contracting officer can ask instead. Second, the DoD can audit. The affirmation is a legal attestation, and the government retains the right to check it; the expectation is that you can produce supporting records for six years. Third, and most practically, next-year-you needs it. The affirmation renews annually, and reconstructing a year of "yes we did that" from memory is miserable. A folder that filled itself as you went makes re-affirmation an afternoon instead of an archaeology project.
The test for every artifact is one question: "Could I email this to a prime tomorrow morning and have it hold up?" If yes, it's evidence. If it lives only in your head or in "trust us, we do that," it isn't - no matter how true it is.
The artifact for each requirement
Most of these are a screenshot or an export that takes under a minute to capture. The trick is capturing them on a schedule instead of scrambling later.
| REQUIREMENT | THE ARTIFACT THAT PROVES IT | WHERE IT COMES FROM |
|---|---|---|
| Authorized users; unique identities | Export of your user account list | Your identity platform (Microsoft Entra, Google admin) |
| Access limited by role | Screenshot of the permission groups on FCI folders, plus one dated test of a non-authorized account being denied | SharePoint / file server permissions |
| Authentication enforced | Screenshot of the MFA status page showing users enrolled | Your email/identity admin console |
| External connections controlled | Your written connections list with approval dates | You maintain it; the MSP helps populate it |
| Media sanitized | A disposal log - item, method, date - plus destruction receipts if a vendor does it | You keep the log |
| Physical access; visitors | The key/badge inventory and photographed sign-in sheets | Your front desk |
| Boundary managed | Firewall config screenshots: firewall on, remote admin off, dated | Firewall admin (often via MSP) |
| Public systems separated | A note of where the website is hosted, plus the hosting invoice | You / your web host |
| Flaws fixed timely | The monthly patch report and a one-line maintenance log | Patch management (often via MSP) |
| Malware protection, updated, scanning | Antivirus console export showing coverage, current definitions, and scan history | Your endpoint protection tool |
| Subcontract flow-down (only if you're a prime who subs work out) | Executed subcontracts containing the FAR 52.204-21(c) clause substance - the signed subcontract, or your subcontract template plus a list of which agreements use it | Whoever holds your contracts |
That last row isn't one of the 15 - it's a contract-administration record a prime keeps because FAR 52.204-21(c) requires the clause substance to flow into subcontracts where a sub may have FCI on its systems. If you only ever work as a subcontractor, skip it.
Not sure which of these you could produce today? The free 5-question check is a fast read on where your posture stands, in about three minutes, no email to start.
The habit that makes it painless
Evidence collection sounds like a burden. Done right, it's about fifteen minutes a quarter. Here's the system that works for small shops:
Create one folder - call it Evidence - in a restricted spot on your file system, with a subfolder per year. Once a quarter, capture the handful of screenshots and exports above, with the date in each filename. If an MSP runs your IT, make it a standing quarterly request: "send me the current user list, the antivirus status, the patch report, and the firewall config." Photograph the visitor sign-in sheet the same day. That's the whole ritual. The monthly maintenance-log line - patched, scanned, reviewed, initialed - takes thirty seconds.
The reason to start the folder today, even before you've closed every gap: evidence is most convincing when it shows a track record, not a snapshot created the week you affirmed. A visitor log with six months of entries reads as "this is how we operate." One created three days before submission reads as exactly what it is.
The one artifact people forget
Almost everyone remembers the technical screenshots. The one that slips through is the visitor log - because it's physical, low-tech, and feels too simple to count. It's also the artifact a prime's supply-chain visit is most likely to ask to see in person, precisely because it can't be faked from a console. A dated sign-in sheet with real entries is worth more than it looks. Start it now, even if your permission scoping or your patch routine still needs work - it's the cheapest evidence to accumulate and the most annoying to fabricate after the fact.
Where this fits
Evidence is the layer that separates "we're compliant" from "we can show we're compliant," and it's the piece the cheap end of the market skips entirely - policy generators hand you documents, not a mapping of which artifact proves which requirement against your actual systems. That mapping, tied to the tools you really run, is part of what a full assessment produces. But you don't need us to start the folder. Open it today, capture this quarter's screenshots, and you've already done the thing most confident shops forget - and the thing that turns a self-assessment into one you can defend.
Where does your shop stand right now?
Five yes/no questions, instant grade, no email required. Know before you're asked.
Take the free 5-question check