CyberSureCyberSure

CMMC Level 1 readiness check

Review all 15 CMMC Level 1 safeguarding requirements.

Answer from your current, documented practice. This tool helps you prepare and document your own self-assessment; it is not a certification or official assessment.

Built by SSG (Ret.) Tony Garner, U.S. Army (retired), former CEMA team leader.

Level 1 is pass/fail: all 15 requirements must be MET; no POA&Ms are permitted. Submit self-assessment results and affirmation in SPRS annually. This readiness check is not an official assessment.

Start the check

Your progress

0 of 15 requirements answered. Results appear after every requirement is answered.

01 / AC.L1-b.1.i

Authorized access control

Official wording

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

In plain English

Only approved people, approved automated services, and approved devices should be able to get into systems that handle Federal Contract Information (FCI).

Done looks like

A 10-person shop keeps a current list of approved staff accounts and company laptops, removes access when someone leaves, and disables unused accounts.

How would you describe this today?

02 / AC.L1-b.1.ii

Transaction and function control

Official wording

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

In plain English

An approved user should only be able to do the work their role requires, not every administrative or financial action in a system.

Done looks like

In a 10-person shop, bookkeeping staff can submit invoices but only the owner can change bank details or add administrator accounts.

How would you describe this today?

03 / AC.L1-b.1.iii

External connections

Official wording

Verify and control/limit connections to and use of external information systems.

In plain English

Know which outside systems connect to your environment and permit only the connections your business has reviewed.

Done looks like

The shop keeps a short list of approved cloud storage, email, remote-support, and accounting connections, and does not allow FCI on personal file-sharing accounts.

How would you describe this today?

04 / AC.L1-b.1.iv

Control public information

Official wording

Control information posted or processed on publicly accessible information systems.

In plain English

Review material before it goes on a public website, portal, or social account so FCI and other nonpublic material are not posted there.

Done looks like

Before posting a project update, one named reviewer checks that it does not include contract files, customer details, or internal screenshots.

How would you describe this today?

05 / IA.L1-b.1.v

Identification

Official wording

Identify information system users, processes acting on behalf of users, or devices.

In plain English

Systems should be able to tell which person, service, or device is requesting access.

Done looks like

Each staff member uses an individual account, company laptops have distinct names, and any automated backup service has its own documented account.

How would you describe this today?

06 / IA.L1-b.1.vi

Authentication

Official wording

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

In plain English

Verify that a person, service, or device is really who or what it claims to be before allowing access.

Done looks like

All staff sign in with unique passwords, default passwords are changed before use, and the shop enables available multi-factor authentication for the systems handling FCI.

How would you describe this today?

07 / MP.L1-b.1.vii

Media disposal

Official wording

Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

In plain English

Before a drive, phone, USB device, or paper record containing FCI is discarded or reused, remove the information or destroy the media appropriately.

Done looks like

The shop uses a documented wipe process for retired laptops and keeps FCI paper in a locked shred bin before destruction.

How would you describe this today?

08 / PE.L1-b.1.viii

Limit physical access

Official wording

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

In plain English

Only authorized people should be able to physically reach equipment and work areas that handle FCI.

Done looks like

Networking equipment sits in a locked cabinet, and only named staff have keys or access codes for the office where FCI workstations are kept.

How would you describe this today?

09 / PE.L1-b.1.ix

Manage visitors and physical access

Official wording

Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

In plain English

Visitors need supervision, physical entry needs a record, and keys, badges, and codes need an owner and a removal process.

Done looks like

The shop signs visitors in, keeps them with a host near work areas, and collects or disables access devices when staff leave.

How would you describe this today?

10 / SC.L1-b.1.x

Boundary protection

Official wording

Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

In plain English

Protect the points where your systems connect to the internet and where important internal segments connect to one another.

Done looks like

The shop uses a managed router or firewall, changes its default admin password, reviews remote-access settings, and separates guest Wi-Fi from business devices.

How would you describe this today?

11 / SC.L1-b.1.xi

Public-access system separation

Official wording

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

In plain English

Public-facing services should be separated from the internal network where business work and FCI are handled.

Done looks like

A public website is hosted separately from office systems, and guest Wi-Fi cannot reach company laptops, printers, or file storage.

How would you describe this today?

12 / SI.L1-b.1.xii

Flaw remediation

Official wording

Identify, report, and correct information and information system flaws in a timely manner.

In plain English

Keep track of security fixes and apply them on a routine schedule, with a process for urgent issues.

Done looks like

The shop turns on supported updates, reviews patch notifications monthly, and records when critical fixes are installed or why a delay is necessary.

How would you describe this today?

13 / SI.L1-b.1.xiii

Malicious code protection

Official wording

Provide protection from malicious code at appropriate locations within organizational information systems.

In plain English

Use appropriate anti-malware protections where your systems can receive or run harmful code.

Done looks like

Company laptops use supported anti-malware protection, and the responsible person can check that it is enabled and reporting normally.

How would you describe this today?

14 / SI.L1-b.1.xiv

Update malicious code protection

Official wording

Update malicious code protection mechanisms when new releases are available.

In plain English

Keep anti-malware tools and their protection data current when updates are released.

Done looks like

The shop allows endpoint protection to update automatically and checks failed or overdue updates during its monthly review.

How would you describe this today?

15 / SI.L1-b.1.xv

System and file scanning

Official wording

Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

In plain English

Run routine scans and check externally obtained files as they enter or run on your systems.

Done looks like

Endpoint protection runs scheduled scans on company laptops and real-time scanning checks email attachments and downloaded files before staff open them.

How would you describe this today?

Self-Assessment Kit

Use the CMMC Level 1 Self-Assessment Kit to organize your documentation, or use the free Windows Evidence Check to review settings on one computer.

View the CMMC Level 1 kitGet the free Evidence Check

Sources and scope

Last reviewed: October 6, 2026. Requirements and identifiers are mapped from the official sources below.

CyberSure is a private company and is not affiliated with or endorsed by the U.S. Army, the Department of Defense, or any government agency. Content is provided for informational purposes and does not constitute legal advice.

    CMMC Level 1 Readiness Check | CyberSure