CMMC Level 1 Checklist: 15 FAR Practices

0%

0 of 28 items complete

13 critical items still open - these are the highest-risk gaps.

Download checklist:

Scope: know where Federal Contract Information lives

List every contract and subcontract that includes FAR 52.204-21 or a CMMC Level 1 requirement.CRITICALIdentify the Federal Contract Information (FCI) you receive or create: POs, drawings marked for the contract, statements of work, delivery schedules.Map every system, laptop, phone, file share, email tenant and cloud service that stores, processes or transmits FCI.CRITICALRecord the physical locations where those systems and any printed FCI sit.Confirm whether any of the data is actually Controlled Unclassified Information (CUI). If yes, Level 1 is not enough and Level 2 applies.CRITICAL

Access control (4 practices)

Access to FCI systems is limited to authorized users, processes and devices. Evidence: user list with approvals, group membership export.CRITICALAuthorized users are limited to the transactions and functions their job needs. Evidence: role or permission matrix, no shared admin rights for office staff.Connections to external systems are verified and controlled, including personal devices and partner portals. Evidence: allowed-device policy, VPN or conditional access settings.Information posted on publicly accessible systems is controlled: website, social media and marketing posts are reviewed so FCI is not published. Evidence: posting approval procedure, named reviewer.CRITICAL

Identification and authentication (2 practices)

Every user, process and device is uniquely identified. Evidence: no shared logins, device inventory with asset IDs.CRITICALIdentities are authenticated before access is granted. Evidence: password policy or MFA configuration, screenshot of sign-in settings.CRITICAL

Media protection and physical protection (5 practices)

Media containing FCI is sanitized or destroyed before disposal or reuse. Evidence: disposal log, shredding or wipe record, certificate from the vendor.CRITICALPhysical access to offices, server closets and systems is limited to authorized individuals. Evidence: badge or key list, locked door photos.Visitors are escorted and their activity is monitored. Evidence: visitor log, sign-in sheet, escort procedure.Physical access logs are maintained (door system export, visitor log retained).Physical access devices (keys, badges, codes) are controlled and managed. Evidence: key register, badge issue and return records, code change record after departures.

System and communications protection (2 practices)

Communications are monitored, controlled and protected at external boundaries and key internal boundaries. Evidence: firewall in place with rules reviewed, managed switch or router config.CRITICALPublicly accessible components such as a web server sit on a separate subnetwork or hosted service, not on the internal network with FCI. Evidence: network diagram showing the separation.

System and information integrity (4 practices)

System flaws are identified, reported and corrected in a timely way. Evidence: patch policy, Windows Update or patch tool report.CRITICALMalicious code protection is in place at appropriate locations. Evidence: antivirus or EDR console showing coverage of all FCI devices.CRITICALMalicious code protection is kept current. Evidence: definition update status, auto-update enabled.Periodic scans of the system and real-time scans of files from external sources are performed. Evidence: scan schedule and last run report.

Affirmation and upkeep

Record each practice result as met, not met or not applicable with a one-line justification.Name the affirming official, a senior person who can attest for the whole company.CRITICALEnter the self-assessment and affirmation in SPRS for the in-scope CAGE codes before contract award, as your contract or prime requires.CRITICALKeep your evidence folder for the retention period your contract and the DoD rule specify.Diary the annual re-assessment and affirmation, and re-check whenever scope, systems or staff change.Pass the correct flow-down to subcontractors that receive FCI from you.

Level 1 is a self-assessment and it is pass or fail: every practice must be met (or properly marked not applicable) before your affirming official posts the result and affirmation in SPRS. Anything unchecked is a gap to close first. Items marked critical are the ones assessors and primes ask about most.

CMMC scoping review

Optional: a short call to check how your ERP and file shares fall in or out of FCI scope.

Optional. The tool and every export work without this. No spam.

How to use this CMMC Level 1 checklist

Start with the scope group: you cannot answer the practices until you know which systems touch FCI. Then work down each group, tick what is genuinely in place today and note the evidence you could show an assessor or a prime. Be strict. A policy that nobody follows is not a met practice. Print or export the result, assign an owner to every unchecked line and re-run the list when the fixes are done. Small shops often finish in an afternoon because the same few controls (MFA, antivirus, a visitor log, a firewall) cover many lines.

Scope first, then the six control groups, then affirmation.
Write the evidence next to each item, not just a tick.
Critical items are the ones most often questioned.

What Level 1 requires and what it does not

Level 1 covers basic safeguarding of FCI: information provided by or generated for the government under a contract that is not meant for public release. FAR 52.204-21 lists 15 safeguarding requirements, which CMMC expresses as 17 practices across access control, identification and authentication, media protection, physical protection, system and communications protection, and system and information integrity. Level 1 is a yearly self-assessment with an affirmation, with no third-party assessor. If you hold CUI, for example export-controlled technical drawings or data under DFARS 252.204-7012, you need Level 2, which is a much larger scope based on NIST SP 800-171. Confirm the level with your contract, not your assumptions.

Example evidence and common mistakes

Good evidence is simple and dated: an exported user list, a screenshot of the MFA policy, the antivirus console showing every device protected, a visitor log with the last six months of entries, a shred bin pickup receipt. The most common mistakes are scoping too narrowly (forgetting personal phones that read email with FCI), shared logins on the shop floor PC that opens drawings, unmanaged home laptops, no process for departing staff, and an affirmation signed by someone who never saw the evidence. Another frequent miss is treating the web site and social posts as out of scope when a proud post could reveal contract details.

Forgotten devices: phones, tablets, USB drives, personal laptops.
Shared accounts on production terminals that display drawings.
No leaver checklist for keys, badges and accounts.
Affirming official has not reviewed the evidence.

Annual affirmation and keeping it current

After the self-assessment, an affirming official confirms the result in SPRS for each CAGE code in scope. Repeat every year and whenever the environment changes materially, such as a new cloud service, a new site or a different IT provider. Keep the evidence folder, the scope diagram and the dated checklist together so you can answer a prime's request in minutes. Rules and effective dates for the CMMC program have shifted during rulemaking, so check the current DoD and contract language before you rely on any date in this page.

Frequently Asked Questions

Who needs a CMMC Level 1 assessment?

Contractors and subcontractors that process, store or transmit Federal Contract Information but no CUI. Your contract or prime will say the required level. If any CUI is involved you generally need Level 2 instead.

Is there an official CMMC Level 1 form?

There is no paper certificate. You do a self-assessment against the practices and an affirming official enters the result and affirmation in SPRS. This checklist is a working record of that assessment, not a government form.

How many practices are in CMMC Level 1?

FAR 52.204-21 has 15 basic safeguarding requirements. CMMC maps them to 17 practices that are assessed through a set of objectives. All must be met for a passing Level 1 result.

Do I need a consultant or C3PAO for Level 1?

No assessor is required at Level 1, since it is a self-assessment. A consultant can help with scoping and evidence, but your affirming official remains accountable for the accuracy of the affirmation.

If your drawings and POs live in an ERP, we can show how to keep FCI inside your own network with a private AI layer, so staff get answers without sending data to a public service. This checklist works without us.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Compliance & Contracts tools

See all

CMMC Level 1 Checklist (FAR 52.204-21 Practices, Example Evidence)