CMMC Level 1 Security Controls
Version 2.0
The Cybersecurity Maturity Model Certification Level 1 defines 17 foundational cybersecurity practices required for any organization handling Federal Contract Information under Department of Defense contracts. The practices derive from FAR 52.204-21 and cover basic safeguarding of contractor information systems. Level 1 is the entry point for DoD contractors and must be self-assessed annually.
17
Total controls
6
Critical priority
92h
Est. implementation
6
Trust service categories
CMMC 2.0 practices are derived from FAR 52.204-21 and NIST SP 800-171, both published by U.S. federal agencies and in the public domain. The CMMC framework is published by the Department of Defense.
Access Control
4 controlsLimit system access to authorized users, processes, and devices, and restrict each user to only the transactions and functions their role requires.
Authorized Access
External Connections
Identification & Authentication
2 controlsIdentify all users, processes acting on behalf of users, and devices before granting access, and verify their identity through authentication.
Media Protection
1 controlsSanitize or destroy media containing Federal Contract Information before disposal or reuse to prevent data recovery.
Physical Protection
4 controlsLimit and monitor physical access to organizational systems, equipment, and the facilities that house them to authorized individuals only.
Physical Access
Limit physical access to systems and facilities to authorized individuals
Escort visitors and monitor visitor activity in secured areas
Maintain audit logs of physical access to secured areas
Control and manage physical access devices
System & Comms Protection
2 controlsMonitor and protect organizational communications at network boundaries and isolate publicly accessible components from internal networks.
System & Info Integrity
4 controlsIdentify and correct system flaws, provide malware protection at key locations, keep protections current, and perform regular system scans.