# CMMC Level 1 Checklist: 15 Practices for Federal Contract Information (Excel and PDF) > Source: https://netray.co/tools/cmmc-level-1-checklist-15-practices-fci-excel > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer An editable worksheet of the 15 CMMC Level 1 practices with plain-English meaning, example evidence, owner and status. Export to Excel or PDF for your self-assessment. ## Category compliance-legal ## Industry Defense ## Audience - Small defense supplier - IT manager - Compliance lead ## Tool **Kind:** worksheet **Mode:** editable **Columns:** #### Practice **Key:** id **Type:** text #### Domain **Key:** domain **Type:** text #### What it means **Key:** meaning **Type:** text #### Example evidence **Key:** evidence **Type:** text #### Owner **Key:** owner **Type:** text #### Status **Key:** status **Type:** select **Options:** - Not started - In progress - Implemented - Not applicable #### Target date **Key:** due **Type:** date **Rows:** **Id:** AC.L1-B.1.I **Domain:** Access control **Meaning:** Limit system access to authorized users, processes and devices **Evidence:** User list, account approval records **Owner:** IT manager **Status:** In progress **Due:** 2026-12-01 **Id:** AC.L1-B.1.II **Domain:** Access control **Meaning:** Limit users to the transactions and functions they are permitted to run **Evidence:** Role definitions, admin account list **Owner:** IT manager **Status:** In progress **Due:** 2026-12-01 **Id:** AC.L1-B.1.III **Domain:** Access control **Meaning:** Verify and control connections to external systems **Evidence:** Firewall rules, cloud service list **Owner:** IT manager **Status:** Not started **Due:** 2026-12-15 **Id:** AC.L1-B.1.IV **Domain:** Access control **Meaning:** Control information posted on public systems **Evidence:** Posting approval procedure, website review **Owner:** Compliance lead **Status:** Not started **Due:** 2026-12-15 **Id:** IA.L1-B.1.V **Domain:** Identification and authentication **Meaning:** Identify every user, process and device **Evidence:** Unique user IDs, device inventory **Owner:** IT manager **Status:** Implemented **Due:** 2026-11-15 **Id:** IA.L1-B.1.VI **Domain:** Identification and authentication **Meaning:** Authenticate identities before granting access **Evidence:** Password policy, MFA settings **Owner:** IT manager **Status:** Implemented **Due:** 2026-11-15 **Id:** MP.L1-B.1.VII **Domain:** Media protection **Meaning:** Sanitize or destroy media containing FCI before disposal or reuse **Evidence:** Disposal log, wiping records **Owner:** IT manager **Status:** Not started **Due:** 2027-01-15 **Id:** PE.L1-B.1.VIII **Domain:** Physical protection **Meaning:** Limit physical access to systems, equipment and operating environments **Evidence:** Key or badge list, locked server room **Owner:** Facilities **Status:** In progress **Due:** 2026-12-01 **Id:** PE.L1-B.1.IX **Domain:** Physical protection **Meaning:** Escort visitors, monitor activity, keep audit logs and manage access devices **Evidence:** Visitor log, badge return records **Owner:** Facilities **Status:** Implemented **Due:** 2026-11-15 **Id:** SC.L1-B.1.X **Domain:** System and communications protection **Meaning:** Monitor and protect communications at the system boundary **Evidence:** Firewall configuration, network diagram **Owner:** IT manager **Status:** In progress **Due:** 2026-12-15 **Id:** SC.L1-B.1.XI **Domain:** System and communications protection **Meaning:** Separate publicly accessible systems from internal networks **Evidence:** DMZ or hosted website separation **Owner:** IT manager **Status:** Not started **Due:** 2026-12-15 **Id:** SI.L1-B.1.XII **Domain:** System and information integrity **Meaning:** Identify, report and fix system flaws promptly **Evidence:** Patch records, update schedule **Owner:** IT manager **Status:** In progress **Due:** 2026-12-01 **Id:** SI.L1-B.1.XIII **Domain:** System and information integrity **Meaning:** Protect against malicious code at appropriate locations **Evidence:** Endpoint protection deployment report **Owner:** IT manager **Status:** Implemented **Due:** 2026-11-15 **Id:** SI.L1-B.1.XIV **Domain:** System and information integrity **Meaning:** Keep malicious code protection up to date **Evidence:** Definition update settings and logs **Owner:** IT manager **Status:** Implemented **Due:** 2026-11-15 **Id:** SI.L1-B.1.XV **Domain:** System and information integrity **Meaning:** Run periodic scans and real-time scans of files from external sources **Evidence:** Scan schedule and results **Owner:** IT manager **Status:** Implemented **Due:** 2026-11-15 **Totals:** #### Practices listed **Key:** id **Agg:** count **Format:** integer **Notes:** Level 1 covers the 15 basic safeguarding requirements of FAR 52.204-21 for Federal Contract Information. You assess yourself annually and an authorized official affirms the result. Edit status and evidence for your own environment; the examples are common, not required. ## Content **Intro:** CMMC Level 1 applies to contractors that handle Federal Contract Information but not controlled unclassified information. It has 15 practices drawn from FAR 52.204-21. Use this worksheet to record what you have, who owns it and what proof you can show, then export it for your self-assessment file. **Sections:** #### How to use the worksheet **Body:** Start by confirming that your contracts involve FCI and that you do not handle CUI, which would require Level 2. Review each practice, change the status to match reality, name an owner and attach a target date for gaps. In the evidence column record the specific document, screenshot or configuration that proves the practice. Keep the evidence together in one folder with the exported worksheet, because the affirmation is signed by a company official who is responsible for its accuracy. #### What the 15 practices cover **Body:** The practices fall into six domains and are basic cyber hygiene: control who can use your systems, identify and authenticate users, sanitize media, limit physical access, protect the boundary, and keep software patched and free of malware. Most small companies already meet several of them through standard IT tools. The gaps are usually documentation, such as media disposal logs, visitor records, and proof that patches and scans are happening. **Bullets:** - Access control: four practices. - Identification and authentication: two practices. - Media protection: one practice. - Physical protection: two practices. - System and communications protection: two practices. - System and information integrity: four practices. #### Common mistakes and scope **Body:** The first mistake is to assume the whole company is in scope when only the assets that process, store or transmit FCI are. Define that boundary and write it down. The second is to mark a practice as implemented without evidence. The third is to treat Level 1 as one-off: the assessment is annual and the affirmation must be renewed. Companies that also handle CUI need Level 2 and should use a separate, more detailed assessment of the 110 NIST SP 800-171 requirements. **Cta:** Netray works with defense suppliers on private AI that runs inside their own boundary, so adopting AI does not widen your CMMC scope. **Faq:** #### How many practices are in CMMC Level 1? **Answer:** Fifteen. They correspond to the basic safeguarding requirements in FAR clause 52.204-21 and protect Federal Contract Information. They are grouped under access control, identification and authentication, media protection, physical protection, system and communications protection, and system and information integrity. #### Does Level 1 need a third-party assessment? **Answer:** No. Level 1 is an annual self-assessment, followed by an affirmation from an affirming official, with the result entered in the government's reporting system. Level 2 may require a third-party assessment depending on the contract. #### What is FCI? **Answer:** Federal Contract Information is information provided by or generated for the government under a contract that is not intended for public release. It excludes simple transactional information such as payment data. If you also handle CUI you need Level 2. #### Can I use this worksheet as my assessment record? **Answer:** Yes, as a working record of status and evidence, provided you keep the underlying proof and follow the official assessment guide. It is a planning aid and does not replace the official CMMC assessment guide or legal advice. ## Search terms cmmc level 1 checklist pdf, cmmc level 1 checklist excel, cmmc level 1 requirements checklist, cmmc level 1 15 practices, cmmc level 1 self assessment, far 52.204-21 checklist, fci cmmc checklist --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json