FAR 52.204-21(b)(1)(i) MET required
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
How Level 1 readiness is determined
Mark each checklist item as MET, NOT MET or NOT SURE. The tool shows your implementation progress, but only 17 of 17 MET indicates potential readiness against all 15 FAR requirements for Final Level 1 status.
What this result means
This is an educational readiness estimate—not an official assessment, certification, affirmation or SPRS submission. Scope and evidence still require organizational judgment.
Privacy by design: do not enter FCI, credentials or sensitive system details. Your selections remain in this browser session. Nothing is sent unless you choose to send your result to VigilON after finishing the check.
Access Control
4 checklist items
FAR 52.204-21(b)(1)(ii) MET required
Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
FAR 52.204-21(b)(1)(iii) MET required
Verify and control/limit connections to and use of external information systems.
FAR 52.204-21(b)(1)(iv) MET required
Control information posted or processed on publicly accessible information systems.
Identification and Authentication
2 checklist items
FAR 52.204-21(b)(1)(v) MET required
Identify information system users, processes acting on behalf of users, or devices.
FAR 52.204-21(b)(1)(vi) MET required
Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
Media Protection
1 checklist item
FAR 52.204-21(b)(1)(vii) MET required
Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
Physical Protection
4 checklist items
FAR 52.204-21(b)(1)(viii) MET required
Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
FAR 52.204-21(b)(1)(ix) — Action 1 MET required
Escort visitors and monitor visitor activity.
FAR 52.204-21(b)(1)(ix) — Action 2 MET required
Maintain audit logs of physical access.
FAR 52.204-21(b)(1)(ix) — Action 3 MET required
Control and manage physical access devices.
System and Communications Protection
2 checklist items
FAR 52.204-21(b)(1)(x) MET required
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
FAR 52.204-21(b)(1)(xi) MET required
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
System and Information Integrity
4 checklist items
FAR 52.204-21(b)(1)(xii) MET required
Identify, report, and correct information and information system flaws in a timely manner.
FAR 52.204-21(b)(1)(xiii) MET required
Provide protection from malicious code at appropriate locations within organizational information systems.
FAR 52.204-21(b)(1)(xiv) MET required
Update malicious code protection mechanisms when new releases are available.
FAR 52.204-21(b)(1)(xv) MET required
Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
Your Level 1 readiness result
Answer all 17 checklist items to generate a result.
Want VigilON to look at your result?
Optional. Your result above is already yours to keep. If you would like VigilON to follow up on your gaps, leave your details and our team will get in touch.
Frequently asked questions
What is the CMMC Level 1 Readiness Check?
It is a free, educational self-check covering the 15 safeguarding requirements in FAR 52.204-21 used to protect Federal Contract Information. They are presented as 17 checklist items so the three actions in requirement (ix) can be reviewed separately.
Does CMMC Level 1 have a percentage passing score?
No. All Level 1 security requirements must be fully implemented and assessed as MET. No POA&M is permitted for Level 1.
Is this an official CMMC assessment?
No. This tool provides an estimated readiness result and does not replace the required organizational self-assessment, affirmation, SPRS submission, or professional advice.
Important: This tool is educational guidance only. It does not determine contract eligibility or provide an official CMMC status. Under 32 CFR §170.15 and §170.24, every applicable Level 1 requirement must be MET, no POA&M is permitted, and the organization must complete the required self-assessment, affirmation and SPRS submission.