What is CMMC Level 1?
CMMC Level 1 focuses on safeguarding Federal Contract Information (FCI) through the 15 security requirements in FAR 52.204-21.
What does CMMC Level 1 require?
An organization handling FCI must define the systems within scope, implement all 15 safeguards in FAR 52.204-21, verify that each safeguard is operating effectively, complete the applicable annual self-assessment and affirmation, and submit the required result through SPRS. This guide separates the three actions within requirement (ix), creating 17 practical review points.
Access Control (AC)
FAR 52.204-21(b)(1)(i–iv)
NIST SP 800-171: 3.1.1
FAR 52.204-21(b)(1)(i)
CMMC Level 1
FAR 52.204-21(b)(1)(i) — Limit system access
Outcome to achieve
Requirement: Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).Verification points:
- [a] Authorized users are identified.
- [b] Processes acting on behalf of authorized users are identified.
- [c] Authorized devices are identified.
- [d] System access is limited to authorized users, processes, and devices.
Example governance statement
"Logical access to systems processing Federal Contract Information (FCI) is restricted exclusively to personnel with documented operational need, verified service accounts, and managed endpoints compliant with organizational trust criteria."
Put it in place
- Consolidate authentication under an authoritative enterprise directory (e.g., Microsoft Entra ID or Google Workspace).
- Prohibit unmanaged hardware from accessing cloud or local networks using device enrollment and compliance policies.
- Enforce immediate deprovisioning workflows triggered by personnel separation.
Verify and retain proof
Records
Access control policy, active user directory exports, and authorized hardware asset inventories.
People
Discussions with IT administrators demonstrating account provisioning and revocation workflows.
Operation
Live verification that disabled accounts and unmanaged hardware cannot initiate active sessions.
NIST SP 800-171: 3.1.2
FAR 52.204-21(b)(1)(ii)
CMMC Level 1
FAR 52.204-21(b)(1)(ii) — Limit transactions and functions
Outcome to achieve
Requirement: Limit information system access to the types of transactions and functions that authorized users are permitted to execute.Verification points:
- [a] Authorized users are limited to the transactions and system functions they are permitted to perform.
Example governance statement
"Privileges within organizational software and operating systems must adhere to role-based access control (RBAC). Users are restricted from executing administrative or functional actions outside their defined job responsibilities."
Put it in place
- Establish standardized role profiles (e.g., standard employee, project manager, billing admin).
- Strip local workstation administrative privileges from standard user profiles to block unauthorized configurations.
- Audit functional application permissions during quarterly access reviews.
Verify and retain proof
Records
RBAC permission matrices, directory security group rosters, and local admin group audit reports.
People
Interviews with system custodians on how transaction rights are scoped and requested.
Operation
Demonstrating that a non-privileged user cannot run privileged commands or access restricted repositories.
NIST SP 800-171: 3.1.20
FAR 52.204-21(b)(1)(iii)
CMMC Level 1
FAR 52.204-21(b)(1)(iii) — Control external connections
Outcome to achieve
Requirement: Verify and control/limit connections to and use of external information systems.Verification points:
- [a] Connections to external information systems are identified.
- [b] Connections to external information systems are verified.
- [c] Connections to external information systems are controlled or limited.
Example governance statement
"External interconnections—including cloud services, vendor APIs, and remote connection portals—must be inventoried, authorized by security leadership, and routed through inspected access control points."
Put it in place
- Maintain a documented register of all external SaaS, IaaS, and partner connections.
- Block unauthorized remote desktop and file-sharing ports at perimeter firewalls.
- Enforce conditional access policies that restrict connections originating from unauthorized regions or untrusted tenant spaces.
Verify and retain proof
Records
Network boundary topology diagrams, external connection registers, and firewall configuration rules.
People
Interviews with network architects on authorization procedures for new external links.
Operation
Inspection of firewall drops and gateway blocks against unauthorized external IP ranges.
NIST SP 800-171: 3.1.22
FAR 52.204-21(b)(1)(iv)
CMMC Level 1
FAR 52.204-21(b)(1)(iv) — Control publicly accessible information
Outcome to achieve
Requirement: Control information posted or processed on publicly accessible information systems.Verification points:
- [a] Individuals authorized to post or process information on publicly accessible systems are identified.
- [b] Procedures are identified to ensure FCI is not posted on publicly accessible systems.
- [c] Information is reviewed prior to posting on publicly accessible systems.
- [d] Publicly accessible information is reviewed to ensure FCI is not included.
- [e] Mechanisms are maintained to remove improperly posted FCI.
Example governance statement
"Content designated for public websites, marketing collateral, or public forums must undergo documented administrative review prior to release to prevent accidental dissemination of contract-related information."
Put it in place
- Designate an explicit review team (e.g., Communications and Legal/Security) with sign-off authority.
- Enforce write-permission restrictions on public CMS platforms, limiting publishing rights to authorized personnel.
- Maintain a documented emergency takedown procedure for removing inadvertently released sensitive assets.
Verify and retain proof
Records
Public release SOP, authorized publisher rosters, and signed pre-publication review records.
People
Interviews with public-facing staff on their workflow for identifying and excluding FCI.
Operation
Simulating a content takedown workflow to confirm immediate retraction capability.
Identification & Authentication (IA)
FAR 52.204-21(b)(1)(v–vi)
NIST SP 800-171: 3.5.1
FAR 52.204-21(b)(1)(v)
CMMC Level 1
FAR 52.204-21(b)(1)(v) — Identify users, processes and devices
Outcome to achieve
Requirement: Identify information system users, processes acting on behalf of users, or devices.Verification points:
- [a] System users are identified.
- [b] Processes acting on behalf of users are identified.
- [c] Devices accessing the system are identified.
Example governance statement
"Every user, administrative process, and hardware component must be provisioned with a unique, traceable identifier prior to gaining network or system access. Shared or generic accounts are strictly prohibited."
Put it in place
- Enforce standard naming syntax tied to an individual’s identity (e.g., `first.last@domain.com`).
- Assign unique machine accounts and certificates to physical laptops and servers.
- Configure background services to execute using dedicated, named service principals rather than default system accounts.
Verify and retain proof
Records
Active directory listings confirming no generic or shared accounts exist within the environment.
People
Discussions with directory managers on user identification workflows during onboarding.
Operation
Inspection of directory logs to confirm that all events are traceable to specific named identities.
NIST SP 800-171: 3.5.2
FAR 52.204-21(b)(1)(vi)
CMMC Level 1
FAR 52.204-21(b)(1)(vi) — Authenticate identities before access
Outcome to achieve
Requirement: Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.Verification points:
- [a] User identities are authenticated prior to allowing access to organizational systems.
- [b] Process identities are authenticated prior to allowing access to organizational systems.
- [c] Device identities are authenticated prior to allowing access to organizational systems.
Example governance statement
"No session shall be established until the claimed identity has successfully passed verification through approved authentication mechanisms (e.g., passwords, certificates, or multi-factor credentials)."
Put it in place
- Configure systems to challenge every user for credentials at logon before launching the desktop or shell.
- Implement modern identity provider authentication across all web, email, and cloud endpoints.
- Authenticate devices via 802.1X certificates or MDM trust validations before permitting network routing.
Verify and retain proof
Records
Password policy configurations, authentication baseline standards, and identity provider settings.
People
Interviews with system administrators on authentication enforcement mechanisms.
Operation
Assessor observation of a logon attempt to confirm that access is denied prior to successful credential challenge.
Media Protection (MP)
FAR 52.204-21(b)(1)(vii)
NIST SP 800-171: 3.8.3
FAR 52.204-21(b)(1)(vii)
CMMC Level 1
FAR 52.204-21(b)(1)(vii) — Sanitize or destroy FCI media
Outcome to achieve
Requirement: Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.Verification points:
- [a] Information system media containing FCI is sanitized prior to disposal.
- [b] Information system media containing FCI is destroyed prior to disposal.
- [c] Information system media containing FCI is sanitized prior to release for reuse.
- [d] Information system media containing FCI is destroyed prior to release for reuse.
Example governance statement
"All digital storage media (hard drives, solid-state disks, USB media) and physical documents containing FCI must be cryptographically wiped, degaussed, shredded, or pulverized in compliance with NIST SP 800-88 before reuse or disposal."
Put it in place
- Utilize certified cryptographic erase or multi-pass overwrite software on retired hard drives and endpoints.
- Deploy cross-cut shred bins for physical documentation within company facilities.
- Obtain formal Certificates of Destruction from licensed disposal vendors for hardware leaving the facility.
Verify and retain proof
Records
Media sanitization SOPs, signed Certificates of Destruction, and disposal logs.
People
Interviews with IT operations staff on hardware sanitization protocols prior to asset decommissioning.
Operation
Inspection of physical shred containers and verification of drive sanitization software logs.
Physical Protection (PE)
FAR 52.204-21(b)(1)(viii–ix)
NIST SP 800-171: 3.10.1
FAR 52.204-21(b)(1)(viii)
CMMC Level 1
FAR 52.204-21(b)(1)(viii) — Limit physical access
Outcome to achieve
Requirement: Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.Verification points:
- [a] Authorized individuals are identified.
- [b] Physical access to systems is limited to authorized individuals.
- [c] Physical access to equipment is limited to authorized individuals.
- [d] Physical access to operating environments is limited to authorized individuals.
Example governance statement
"Physical entry to facilities, server closets, and workstations hosting organizational systems is restricted strictly to authorized employees holding verified physical credentials."
Put it in place
- Secure all facility entry perimeters with physical door locks or electronic keycard readers.
- Lock server cabinets, network switches, and patch panels in dedicated rooms accessible only to IT staff.
- Maintain a formal roster of personnel approved for unescorted physical building entry.
Verify and retain proof
Records
Physical security policies, building access rosters, and photos of locked infrastructure rooms.
People
Interviews with facility managers regarding access revocation when an employee leaves.
Operation
On-site walk-through testing door locks, badge readers, and server room access points.
NIST SP 800-171: 3.10.3
FAR 52.204-21(b)(1)(ix)
CMMC Level 1
FAR 52.204-21(b)(1)(ix) — Escort and monitor visitors
Outcome to achieve
Requirement: Escort visitors and monitor visitor activity.Verification points:
- [a] Visitors are escorted.
- [b] Visitor activity is monitored.
Example governance statement
"Unaccompanied visitor access to operating environments housing contract information systems is strictly forbidden. Visitors must be escorted and monitored by an authorized employee at all times."
Put it in place
- Establish a single designated entrance for all arriving visitors.
- Assign an authorized escort who remains physically present with the visitor throughout the visit.
- Instruct employees to challenge unescorted strangers observed inside secure work areas.
Verify and retain proof
Records
Visitor management procedures, escort guidelines, and receptionist training manuals.
People
Interviews with designated escorts on their responsibilities when guiding guests.
Operation
Observing the check-in and escort protocol in real time during an assessor visit.
NIST SP 800-171: 3.10.4
FAR 52.204-21(b)(1)(ix)
CMMC Level 1
FAR 52.204-21(b)(1)(ix) — Maintain physical access logs
Outcome to achieve
Requirement: Maintain audit logs of physical access.Verification points:
- [a] Audit logs of physical access are maintained.
Example governance statement
"Physical entry to facilities processing FCI must produce an immutable audit log capturing visitor name, date, entry/exit timestamps, purpose of visit, and escort identity."
Put it in place
- Deploy a physical visitor log book or electronic visitor sign-in iPad terminal at reception.
- Archive electronic badge swipe logs for facility entries on a scheduled monthly basis.
- Retain physical access records for a minimum of one year to support retrospective forensic analysis.
Verify and retain proof
Records
Completed visitor sign-in registers, badge reader electronic logs, and log retention standards.
People
Interviews with reception staff regarding log completion and record archiving.
Operation
Reviewing historical log entries to confirm completeness of required fields (time, date, escort).
NIST SP 800-171: 3.10.5
FAR 52.204-21(b)(1)(ix)
CMMC Level 1
FAR 52.204-21(b)(1)(ix) — Control physical access devices
Outcome to achieve
Requirement: Control and manage physical access devices.Verification points:
- [a] Physical access devices are identified.
- [b] Physical access devices are controlled.
- [c] Physical access devices are managed.
Example governance statement
"Physical access devices—including brass keys, RFID badges, and biometric tokens—must be inventoried, tracked upon issuance, and retrieved immediately upon employee reassignment or separation."
Put it in place
- Maintain a master Key and Badge Register listing card numbers, assigned holders, and access tiers.
- Promptly deactivate lost badges in the access control server.
- Change mechanical combinations or rekey cylinders periodically and following high-level personnel departures.
Verify and retain proof
Records
Master key/badge inventory registers, key return sign-off sheets, and lost token procedures.
People
Interviews with physical security coordinators on badge provisioning and offboarding retrieval.
Operation
Demonstration that a deactivated badge cannot open secured facility doors.
System & Communications Protection (SC)
FAR 52.204-21(b)(1)(x–xi)
NIST SP 800-171: 3.13.1
FAR 52.204-21(b)(1)(x)
CMMC Level 1
FAR 52.204-21(b)(1)(x) — Protect communication boundaries
Outcome to achieve
Requirement: Monitor, control, and protect organizational communications at the external boundaries and key internal boundaries of the systems.Verification points:
- [a] External boundaries are identified.
- [b] Key internal boundaries are identified.
- [c] External boundary communications are monitored.
- [d] Key internal boundary communications are monitored.
- [e] Unauthorized external boundary connections are denied.
- [f] Unauthorized internal boundary connections are denied.
- [g] External boundary communications are protected.
- [h] Key internal boundary communications are protected.
Example governance statement
"The organization deploys managed firewall gateways at all external network ingress/egress points. Network traffic must default to 'deny-all' and permit only explicitly authorized ports, protocols, and services."
Put it in place
- Deploy stateful firewalls at corporate network edges and cloud virtual network perimeters.
- Block all inbound traffic from the internet unless explicitly mapped to an inspected service.
- Segment corporate IT resources from untrusted visitor Wi-Fi networks using dedicated VLANs.
Verify and retain proof
Records
Network architecture diagrams showing security perimeters and exported firewall access control lists (ACLs).
People
Interviews with network security engineers on rule change approval procedures.
Operation
Port scanning perimeter IPs to confirm that unauthorized inbound ports are closed and non-responsive.
NIST SP 800-171: 3.13.5
FAR 52.204-21(b)(1)(xi)
CMMC Level 1
FAR 52.204-21(b)(1)(xi) — Separate public-facing systems
Outcome to achieve
Requirement: Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.Verification points:
- [a] Publicly accessible system components are identified.
- [b] Subnetworks for publicly accessible components are logically or physically separated from internal networks.
Example governance statement
"Public-facing services (e.g., corporate web servers, public file drops) must reside in isolated demilitarized zones (DMZs) or external hosting environments, preventing direct lateral access into internal corporate systems."
Put it in place
- Place any on-premises public web or mail proxies in an isolated DMZ subnet.
- Enforce firewall rules preventing connections initiated from the DMZ toward internal subnets.
- Recommend hosting public web services with isolated commercial SaaS/PaaS providers outside the internal network boundary.
Verify and retain proof
Records
Network segmentation diagrams, VLAN configurations, and cloud security group separation rules.
People
Interviews with infrastructure engineers regarding lateral movement protections from public systems.
Operation
Pinging or attempting connection from a public subnet machine toward an internal IP to confirm routing is blocked.
System & Information Integrity (SI)
FAR 52.204-21(b)(1)(xii–xv)
NIST SP 800-171: 3.14.1
FAR 52.204-21(b)(1)(xii)
CMMC Level 1
FAR 52.204-21(b)(1)(xii) — Identify and correct system flaws
Outcome to achieve
Requirement: Identify, report, and correct information and information-system flaws in a timely manner.Verification points:
- [a] Timeframe to identify system flaws is specified.
- [b] System flaws are identified within the specified timeframe.
- [c] Timeframe to report system flaws is specified.
- [d] System flaws are reported within the specified timeframe.
- [e] Timeframe to correct system flaws is specified.
- [f] System flaws are corrected within the specified timeframe.
Example governance statement
"Operating systems and software applications must undergo automated patch management. Critical and high-severity security vulnerabilities must be remediated within organizationally defined service-level agreements (e.g., within 30 days of release)."
Put it in place
- Enable automated OS patching via Microsoft Intune, Windows Update for Business, or third-party RMM tools.
- Subscribe to vendor vulnerability advisories (CISA alerts, Apple/Microsoft security bulletins).
- Run vulnerability scanners periodically to identify unpatched third-party utilities.
Verify and retain proof
Records
Patch management policy (with explicit timeframes), update deployment reports, and patch logs.
People
Interviews with IT operations personnel on how zero-day or out-of-band security patches are evaluated.
Operation
Checking software version numbers on sample endpoints against current vendor security baselines.
NIST SP 800-171: 3.14.2
FAR 52.204-21(b)(1)(xiii)
CMMC Level 1
FAR 52.204-21(b)(1)(xiii) — Protect against malicious code
Outcome to achieve
Requirement: Provide protection from malicious code at appropriate locations within organizational information systems.Verification points:
- [a] Protection from malicious code is provided at appropriate locations within organizational systems.
Example governance statement
"Centrally managed anti-malware / Endpoint Detection and Response (EDR) software must be installed and active on all workstations, mobile devices, and servers processing organizational data."
Put it in place
- Deploy reputable endpoint protection agents (e.g., Microsoft Defender for Endpoint, CrowdStrike, SentinelOne).
- Lock agent configurations to prevent local employees from stopping or disabling real-time shields.
- Ensure email gateways scan incoming email attachments for viruses and malicious scripts.
Verify and retain proof
Records
Antivirus central console deployment summaries and tamper-protection configuration policies.
People
Interviews with security personnel regarding automated threat quarantine workflows.
Operation
Attempting to disable local security agent protections on a client workstation to verify prevention.
NIST SP 800-171: 3.14.4
FAR 52.204-21(b)(1)(xiv)
CMMC Level 1
FAR 52.204-21(b)(1)(xiv) — Update malicious-code protection
Outcome to achieve
Requirement: Update malicious code protection mechanisms when new releases are available.Verification points:
- [a] Malicious code protection mechanisms are updated when new releases are available.
Example governance statement
"Anti-malware definition updates and engine releases must be applied automatically as soon as published by the vendor to defend against emerging threat signatures."
Put it in place
- Configure protection agents to check for cloud signature updates at least daily or continuously.
- Establish automated alerts in the central management dashboard for endpoints disconnected or out of date for more than 48 hours.
- Force manual definition syncs on devices returning from extended leave.
Verify and retain proof
Records
Agent update schedule configurations and centralized dashboard definition compliance reports.
People
Interviews with IT operations on how endpoints with out-of-date signatures are identified and addressed.
Operation
Inspecting local endpoint antivirus client status screens to verify current definition timestamps.
NIST SP 800-171: 3.14.5
FAR 52.204-21(b)(1)(xv)
CMMC Level 1
FAR 52.204-21(b)(1)(xv) — Perform system and file scans
Outcome to achieve
Requirement: Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.Verification points:
- [a] Periodic scans of the information system are performed.
- [b] Real-time scans of files from external sources are performed as files are downloaded, opened, or executed.
Example governance statement
"Systems must maintain continuous real-time on-access scanning for all files accessed or downloaded from external media or the internet, augmented by scheduled periodic deep-disk scans."
Put it in place
- Enable on-access file interception (real-time protection) in endpoint security profiles.
- Schedule weekly automated background full-disk scans during off-peak hours.
- Configure automatic quarantine action upon detection of malicious payloads.
Verify and retain proof
Records
EDR real-time scanning policy settings and historical scheduled scan completion logs.
People
Interviews with administrators regarding quarantine alert triage procedures.
Operation
Testing the real-time file scanner with a benign EICAR test string to verify immediate interception.
CMMC Level 1: common questions
How many requirements and domains are included?
CMMC Level 1 uses 15 FAR security requirements. This guide organizes them into six security domains and separates the three actions within requirement (ix), creating 17 practical review points.
Why does this guide show 15 FAR requirements but 17 review points?
FAR 52.204-21 contains 15 safeguarding requirements. Requirement (ix) contains three distinct actions—escort visitors, maintain physical access logs, and control physical access devices—so VigilON reviews those actions separately.
What evidence may support a Level 1 self-assessment?
The appropriate evidence depends on the safeguard and your environment. It may include policies, procedures, system configurations, access lists, asset inventories, logs, screenshots, records, interviews, and test results.
Important: This guide provides general implementation and readiness guidance, not legal advice or a guarantee of assessment results. Organizations should evaluate each requirement against their own systems, contracts, FCI environment, and the current authoritative CMMC, FAR, and assessment requirements.