CMMC Level 1 Checklist: The 15 FAR 52.204-21 Requirements in Plain English

CMMC Level 1 is based on the 15 basic safeguarding requirements in FAR 52.204-21(b)(1), for Federal Contract Information (FCI) in the applicable assessment scope. The CMMC rule defines the Level 1 requirement set and assessment procedures in 32 CFR 170.14 and 170.15. This checklist paraphrases the rule; it does not replace the contract, exact clause text, assessment objectives, or a scoped assessment.

The 15 safeguards, in practical terms

1. Limit system access to authorized users, processes, and devices. Know which people, service processes, and devices can access the covered system; remove access when it is no longer authorized.
2. Limit access to permitted transactions and functions. Give an authorized user only the functions needed for their role, rather than unrestricted capabilities by default.
3. Control connections to external systems. Identify and verify outside systems and services that connect to or are used with the covered environment.
4. Control information on public systems. Review information before posting or processing it publicly so FCI is not exposed through a public-facing system.
5. Identify users, processes, and devices. Use identities that let the organization distinguish who or what is requesting access.
6. Authenticate before access. Verify the identity of users, processes, or devices before allowing access to organizational systems.
7. Sanitize or destroy media containing FCI. Before media is disposed of or released for reuse, clear or destroy it so the information is not left accessible.
8. Restrict physical access. Limit entry to systems, equipment, and operating environments to authorized people.
9. Manage visitors and physical access records. Escort visitors, monitor their activity, maintain physical-access audit logs, and control access devices.
10. Protect communications at boundaries. Monitor, control, and protect organizational communications at external and key internal system boundaries.
11. Separate public-facing components. Use subnetworks that physically or logically separate publicly accessible system components from internal networks.
12. Correct system flaws in a timely way. Identify, report, and correct information and system flaws.
13. Protect against malicious code. Put malicious-code protection at appropriate locations in organizational systems.
14. Update malicious-code protection. Keep those protection mechanisms current when new releases are available.
15. Scan systems and files. Perform periodic system scans and real-time scans of files from external sources as they are downloaded, opened, or executed.

How to use the checklist

Start by confirming the contract language and the systems that process, store, or transmit relevant FCI. Then examine how each safeguard actually operates in that scope. A written policy may help explain a process, but it is not by itself proof that a technical or physical safeguard is operating. Record what you reviewed, when, and where supporting evidence is kept. The Level 1 rule calls for all applicable requirements to be MET; it does not permit POA&Ms for Level 1. Follow the assessment procedures and scope rules in 32 CFR 170.15.

You can try the free CMMC Level 1 Readiness Check to organize your initial review, then see the CMMC Level 1 Self-Assessment Kit and its current details. Neither replaces your assessment work.

Important limits: CyberSure is a private company, not affiliated with or endorsed by DoD/DoW, the U.S. Army, or any government agency. This guide is general information, not legal advice, certification, or an official assessment. CyberSure's tools and kit do not certify compliance or submit results for you. Contract and data applicability depend on the specific contract and scope; ask the contracting officer or prime for direction where needed.