The fifteen things a defense supplier must have.
If you hold or want Department of Defense contracts that involve federal contract information, you need a current CMMC Level 1 self-assessment recorded in SPRS, with an annual affirmation by a senior official, since Phase 1 began on November 10, 2025. Level 1 is the fifteen basic safeguarding requirements in FAR 52.204-21. The Defense Department estimates a small contractor's assessment at about $6,000 plus about $560 for the annual affirmation, not counting the cost of fixing gaps. This self-check is preparation; it is not the official assessment.
0 of 15 marked in place
FAR 52.204-21 (b)(1)(i) to (xv)(i) Limit system access to authorized users, processes, and devices.
Evidence: Account list; access policy
Evidence: Account list; access policy
Only people who need access have accounts, and every account belongs to a known person, process, or device. Example: an account list reviewed quarterly, with shared logins removed.
(ii) Limit access to the types of transactions and functions that authorized users are permitted to execute.
Evidence: Role definitions; admin separation
Evidence: Role definitions; admin separation
People can only do what their job requires: a bookkeeper cannot change firewall rules, a salesperson cannot create accounts. Example: roles set in your cloud admin console, with admin rights limited to two people.
(iii) Verify and control connections to and use of external information systems.
Evidence: Approved external systems list; cloud settings
Evidence: Approved external systems list; cloud settings
Know and control which outside systems (personal cloud drives, home computers, partner networks) can connect to yours or hold federal contract information. Example: a list of approved external services and a rule against personal email or drives for contract work.
(iv) Control information posted or processed on publicly accessible systems.
Evidence: Web publishing review step
Evidence: Web publishing review step
Someone checks before anything is posted to the public website or social media so federal contract information is not published by mistake. Example: a review step in the web publishing process.
(v) Identify information system users, processes acting on behalf of users, or devices.
Evidence: Unique accounts; device inventory
Evidence: Unique accounts; device inventory
Every user, process, and device has its own identity; no shared accounts. Example: unique logins for each person and a device inventory with names.
(vi) Authenticate (or verify) the identities of users, processes, or devices before allowing access.
Evidence: Password policy; MFA
Evidence: Password policy; MFA
Identities are verified before access: a password policy and, wherever possible, MFA. Example: a minimum password length and MFA on email and remote access.
(vii) Sanitize or destroy information system media containing federal contract information before disposal or release for reuse.
Evidence: Disposal procedure; certificates
Evidence: Disposal procedure; certificates
Before a laptop, drive, or USB stick is thrown away, sold, or reused, the data on it is securely wiped or destroyed. Example: a disposal procedure with a certificate from the recycler or a wipe log.
(viii) Limit physical access to systems, equipment, and operating environments to authorized individuals.
Evidence: Office access controls
Evidence: Office access controls
Only authorized people can reach the computers, servers, and areas where contract information is handled. Example: a locked office or server closet with keys or badges issued to named people.
(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; control and manage physical access devices.
Evidence: Visitor log; key and badge records
Evidence: Visitor log; key and badge records
Visitors sign in and are escorted, there are records of who had physical access, and keys and badges are tracked. Example: a visitor log at reception and a list of who holds keys.
(x) Monitor, control, and protect organizational communications at external boundaries and key internal boundaries.
Evidence: Firewall configuration; logs
Evidence: Firewall configuration; logs
A firewall or equivalent sits between your network and the internet, and traffic across key internal boundaries is monitored and controlled. Example: a firewall with logging on, reviewed periodically.
(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
Evidence: Network diagram
Evidence: Network diagram
Anything that must be reachable from the public internet, such as a web server, sits on a separate network segment away from internal systems. Example: a network diagram showing the public-facing segment, or your cloud provider's equivalent.
(xii) Identify, report, and correct information and information system flaws in a timely manner.
Evidence: Patch records
Evidence: Patch records
Security flaws are found, reported, and fixed promptly: automatic updates plus a process for vulnerabilities that need manual action. Example: patch records showing updates applied within 30 days.
(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.
Evidence: Endpoint protection deployment
Evidence: Endpoint protection deployment
Protection from malicious code (antivirus or endpoint detection) runs on workstations, servers, and email. Example: endpoint protection deployed to every device.
(xiv) Update malicious code protection mechanisms when new releases are available.
Evidence: Update settings and logs
Evidence: Update settings and logs
That protection updates itself when new definitions and releases come out. Example: automatic updates turned on, with logs showing the current version.
(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
Evidence: Scan configuration and results
Evidence: Scan configuration and results
The protection scans systems periodically and scans files in real time as they are downloaded, opened, or run. Example: scheduled full scans plus real-time scanning, with results kept.
This is preparation. The official Level 1 self-assessment uses the NIST SP 800-171A method, is recorded in SPRS, and needs an annual affirmation by a senior official. Keep records for six years.