Walking Through the CMMC Level 1 Checklist: 15 Requirements, Yes or No

If your company holds a Department of Defense (DoD) contract or subcontract and handles Federal Contract Information (FCI), the contract will usually call for Cybersecurity Maturity Model Certification (CMMC) Level 1. FCI is information provided by or generated for the government under a contract that is not intended for public release. Level 1 rests on 15 basic safeguarding requirements in Federal Acquisition Regulation (FAR) clause 52.204-21, and our free CMMC Level 1 Checklist lets you test your systems against each one in plain yes or no terms.

What the rules require

The FAR clause is direct about who carries the obligation. Paragraph (b)(1) reads: "The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems." The 15 requirements follow, numbered (i) through (xv). The checklist quotes each one word for word, so you answer against the regulation itself rather than a summary.

Level 1 uses a self-assessment, not a third-party assessor, and it is pass or fail. Higher CMMC levels allow a Plan of Action and Milestones (POA&M) for some open items in limited cases. Level 1 does not. Title 32 of the Code of Federal Regulations (CFR), section 170.15, states: "No POA&Ms are permitted for CMMC Level 1." Every requirement must be met.

Step by step

Step 1. Define what you are checking. List the computers, accounts, email, cloud services, and file storage that hold or send FCI. Answer every question for that whole set, not only the main office.

Step 2. Answer each requirement Yes, in place, or No. Read the requirement as written. Yes means the control is in place today on every system in scope. If you are unsure, answer No for now and write down what needs to be checked. Your answers stay in your browser unless you choose the optional follow-up.

Step 3. Work through the requirements in natural groups.

• Access, (i) through (vi): who can log in, what they are allowed to do, which outside systems connect, what gets posted publicly, and whether every user, process, and device is identified and authenticated. Unique accounts with no shared logins cover a lot of this ground.
• Media and physical, (vii) through (ix): wiping or destroying drives before disposal or reuse, limiting physical access, escorting visitors, and keeping logs of physical access.
• Boundaries, (x) and (xi): monitoring and controlling traffic at the network edge, and separating anything public facing, such as a web server, from the internal network.
• Flaws and malicious code, (xii) through (xv): timely patching, malicious code protection that updates itself, periodic scans, and real-time scans of files as they are downloaded, opened, or executed.

Reading the result panel

The panel shows one of three statuses. Keep going appears while any requirement is unanswered. Not yet passing appears once any requirement is marked No. Pass: all 15 requirements met appears only when every answer is Yes. The count shows how many are met and how many remain unanswered, and Requirements not met lists each No with its full text.

One No means the company is not yet ready to affirm, and there is no partial score. Many Level 1 gaps are configuration and process changes rather than purchases: turning on automatic updates, ending shared logins, writing a media disposal procedure, or starting a visitor log.

The checklist is a planning aid. It is not a CMMC assessment, and it does not post or affirm anything in the Supplier Performance Risk System (SPRS).

Next steps

Close every No, then keep evidence for every Yes: screenshots of settings, a written list of who has access, the visitor log, and scan reports. Run the CMMC Level 1 Checklist again and keep a Portable Document Format (PDF) copy of the result with the Print or Save as PDF button.

When all 15 are met, the self-assessment results go into SPRS and a senior official affirms compliance. Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7021 calls for "A corresponding affirmation of continuous compliance, not older than 1 year, by an affirming official" for a Level 1 self-assessment status, and section 170.15 requires the Level 1 self-assessment to be repeated on an annual basis. Put the next one on the calendar the day you affirm.

If your contract also carries DFARS clause 252.204-7012, or you handle Controlled Unclassified Information (CUI), the 110 requirements of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 apply, and our SPRS Score Estimator covers those. Not sure which clauses you have? The Contract Clause Checker explains each one.

Related reading: Your SPRS Score, Explained, CMMC 2.0 Readiness for San Diego Small Businesses, and What the CMMC Phase 2 Pause Means for Small Defense Contractors. For help beyond Level 1, see our CMMC assessment page.

Sources

• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems - Acquisition.gov
• 32 CFR 170.15, CMMC Level 1 self-assessment and affirmation requirements - Electronic Code of Federal Regulations
• DFARS 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements - Acquisition.gov