Are you already CMMC Level 1 compliant? Find out what’s required:
To verify and validate that a contractor is meeting CMMC practices, evidence needs to exist demonstrating that the contractor has fulfilled the objectives of the Level 1 practices below. Because different self-assessment objectives can be met in different ways (e.g., through documentation, computer configuration, network configuration, or training) a variety of techniques may be used, including interviewing, testing, or examining policy, process, and procedure documents; training materials; plans and planning documents; and system, network, and data flow diagrams.
Carefully read each of the Practice Statements and Assessment Objectives below. If you cannot provide evidence demonstrating how your organization meets each of the Assessment Objectives, then you are not currently CMMC Level 1 compliant.
AC.L1-3.1.1 – Authorized Access Control
Authorized users are identified.
Processes acting on behalf of authorized users are identified.
Devices (and other systems) authorized to connect to the system are identified.
System access is limited to authorized users.
System access is limited to processes acting on behalf of authorized users.
System access is limited to authorized devices (including other systems).
AC.L1-3.1.2 – Transaction & Function Control
The types of transactions and functions that authorized users are permitted to execute are defined.
System access is limited to the defined types of transactions and functions for authorized users.
AC.L1-3.1.20 – External Connections
Connections to external systems are identified.
The use of external systems is identified.
Connections to external systems are verified.
The use of external systems is verified.
Connections to external systems are controlled/limited.
The use of external systems is controlled/limited.
AC.L1-3.1.22 – Control Public Information
Individuals authorized to post or process information on publicly accessible systems are identified.
Procedures to ensure FCI is not posted or processed on publicly accessible systems are identified.
A review process is in place prior to posting of any content to publicly accessible systems.
Content on publicly accessible systems is reviewed to ensure that it does not include FCI.
Mechanisms are in place to remove and address improper posting of FCI.
IA.L1-3.5.1 – Identification
System users are identified.
Processes acting on behalf of users are identified.
Devices accessing the system are identified.
IA.L1-3.5.2 – Authentication
The identity of each user is authenticated or verified as a prerequisite to system access.
The identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access.
The identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.
MP.L1-3.8.3 – Media Disposal
System media containing FCI is sanitized or destroyed before disposal.
System media containing FCI is sanitized before it is released for reuse.
PE.L1-3.10.1 – Limit Physical Access
Authorized individuals allowed physical access are identified.
Physical access to organizational systems is limited to authorized individuals.
Physical access to equipment is limited to authorized individuals.
Physical access to operating environments is limited to authorized individuals.
PE.L1-3.10.3 – Escort Visitors
Visitors are escorted.
Visitor activity is monitored.
PE.L1-3.10.4 – Physical Access Logs
Audit logs of physical access are maintained.
PE.L1-3.10.5 – Manage Physical Access
Physical access devices are identified.
Physical access devices are controlled.
Physical access devices are managed
SC.L1-3.13.1 – Boundary Protection
The external system boundary is defined.
Key internal system boundaries are defined.
Communications are monitored at the external system boundary.
Communications are monitored at key internal boundaries.
Communications are controlled at the external system boundary.
Communications are controlled at key internal boundaries.
Communications are protected at the external system boundary.
Communications are protected at key internal boundaries
SC.L1-3.13.5 – Public Access System Separation
Publicly accessible system components are identified.
Subnetworks for publicly accessible system components are physically or logically separated from internal networks.
SI.L1-3.14.1 – Flaw Remediation
The time within which to identify system flaws is specified.
System flaws are identified within the specified time frame.
The time within which to report system flaws is specified.
System flaws are reported within the specified time frame.
The time within which to correct system flaws is specified.
System flaws are corrected within the specified time frame.
SI.L1-3.14.2 – Malicious Code Protection
Designated locations for malicious code protection are identified.
Protection from malicious code at designated locations is provided.
SI.L1-3.14.4 – Update Malicious Code Protection
Malicious code protection mechanisms are updated when new releases are available.
SI.L1-3.14.5 – System & File Scanning
The frequency for malicious code scans is defined.
Malicious code scans are performed with the defined frequency.
Real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.