Free Tool

CMMC Level 1 Checklist
The 15 Basic Safeguarding Requirements

Check your systems against the 15 requirements in Federal Acquisition Regulation (FAR) clause 52.204-21, the standard behind a Cybersecurity Maturity Model Certification (CMMC) Level 1 self-assessment.

Start the Tool All Free Tools

Who Needs Level 1

If your company only handles Federal Contract Information (FCI), information provided by or generated for the government under a contract that is not intended for public release, the contract will usually call for CMMC Level 1. Level 1 is built on the 15 requirements in FAR 52.204-21, quoted word for word below.

Level 1 does not use a third-party assessor. The company performs a self-assessment every year and an affirming official affirms continuous compliance in the Supplier Performance Risk System (SPRS), as required by Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7021. To pass, every one of the 15 requirements must be met.

Your answers stay in your browser. Nothing is sent anywhere unless you choose the optional follow-up.

FAR 52.204-21 basic safeguarding requirements
(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
(iii) Verify and control/limit connections to and use of external information systems.
(iv) Control information posted or processed on publicly accessible information systems.
(v) Identify information system users, processes acting on behalf of users, or devices.
(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
(xii) Identify, report, and correct information and information system flaws in a timely manner.
(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.
(xiv) Update malicious code protection mechanisms when new releases are available.
(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
Optional

Want a Detailed Follow-Up?

Your results above are yours to keep with no sign-up. If you would like Thabiti to review them and send recommended next steps, add your contact details. Your results are included automatically.

Your contact

Submitting sends your contact details and results to thabiti@adamscloudcyber.com over an encrypted connection. We never sell or share your information.

Sources

More Free Tools

Want a Second Set of Eyes?

If any requirement came back No, we can help you close it and prepare the evidence your annual self-assessment and affirmation rely on.

Book a Free Consultation Call (619) 289-8064