Free download · CMMC Level 1 · FAR 52.204-21
The CMMC Level 1 checklist, on one page
All 15 FAR 52.204-21 requirements in plain English, the four steps to your yearly SPRS affirmation, and what the Phase 2 pause does and does not change. Print it, share it with your team, or hand it to your IT provider.
The 15 requirements, in plain English
They apply when you hold a DoD contract or subcontract and handle Federal Contract Information (FCI).
- 01
Authorized users only
Only approved people, programs and devices can use your systems.
- 02
Right access for each role
People can only do what their job needs.
- 03
Control outside systems
Know and limit connections to systems you don't control, such as personal devices and outside cloud accounts.
- 04
Watch what goes public
Review anything posted to public websites so FCI isn't exposed.
- 05
Identify users and devices
Everyone gets their own login, with no shared accounts.
- 06
Verify before access
Use passwords, and ideally multi-factor sign-in.
- 07
Wipe or destroy old media
Clean or shred drives and paper before disposal or reuse.
- 08
Limit physical access
Lock offices, server closets and equipment.
- 09
Manage visitors and keys
Escort visitors, keep a visitor log, and track keys and badges.
- 10
Separate public systems
Keep anything public-facing, such as a website or guest Wi-Fi, apart from your internal network.
- 11
Protect the network edge
Use a firewall to monitor and control traffic in and out.
- 12
Fix flaws promptly
Turn on automatic updates and patch known issues.
- 13
Malware protection
Run antivirus or endpoint protection on your systems.
- 14
Keep it updated
Make sure malware protection updates itself.
- 15
Scan regularly
Run periodic scans and scan files from outside sources, such as downloads, email and USB drives, when they're opened.
Four steps, once a year
- 01
Assess
Check each requirement and note your evidence: a screenshot, a policy or a log.
- 02
Fix
Close every gap. Level 1 is pass/fail, and plans of action (POA&Ms) aren't allowed.
- 03
Enter in SPRS
Record your self-assessment result in the Supplier Performance Risk System.
- 04
Affirm
A senior official affirms compliance in SPRS, and the affirmation is repeated every year.
A checklist records gaps. Fix&Affirm closes them.
Step-by-step fixes for every gap, records and reminders all year, and the document pack your official signs behind. $97 a year, everything included. Starting is free.