CMMC Level 1 · Free workbook

Your Level 1 evidence, one objective at a time.

All 59 assessment objectives behind the 15 Level 1 practices. Each one gets a plain-English check, the evidence to gather, and a starter sentence for your System Security Plan.

Download the workbook (.xlsx) Read it here ↓

Free. No email needed. Prints cleanly from this page, too. Version 1.1 (2026-10-05).

What Level 1 asks of you.

Level 1 applies if you handle Federal Contract Information (FCI) but not CUI. It is the 15 safeguards in FAR 52.204-21.
It is a self-assessment. You score every practice each year, and a senior official affirms the result in SPRS.
Every practice must be met. Level 1 allows no plan of action for open gaps.
Keep your evidence for six years from the date your Level 1 status is recorded in SPRS.

What's in the workbook.

An Objectives sheet: one row per objective, with a status dropdown, an evidence location, an owner, and notes.
A Practices sheet that rolls your answers up. A practice turns Met only when every objective under it is met.
The DoD's own lists of what an assessor may examine, who they may interview, and what they may test.
SSP statement stubs. Fill in the brackets and you have a first draft.

Handle CUI too? You need Level 2.

Take the Level 2 readiness check →

The 15 practices.

The requirement and objective text is quoted from the DoD CMMC Assessment Guide, Level 1, Version 2.13. The checks, evidence lists, and stubs are our own guidance.

AC.L1-b.1.i · FAR 52.204-21(b)(1)(i) · NIST 3.1.1

Authorized Access Control

Only people, programs, and devices you have approved can get into your systems.

Requirement: Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

Obj.	The assessor determines	Ask yourself
[a]	authorized users are identified	Can you produce a list of every person allowed to use your systems?
[b]	processes acting on behalf of authorized users are identified	Can you list the service accounts and automated programs that sign in, and who owns each?
[c]	devices (and other systems) authorized to connect to the system are identified	Can you list every device allowed to connect?
[d]	system access is limited to authorized users	Is everyone who can sign in on the approved user list?
[e]	system access is limited to processes acting on behalf of authorized users	Can only listed service accounts and programs get in?
[f]	system access is limited to authorized devices (including other systems)	Are unlisted devices kept off your systems?

Evidence to gather

A list of every user account, with the person it belongs to
A list of service accounts and what each one runs
An inventory of laptops, phones, and other devices allowed to connect
A record that departed staff lost access the day they left
Screenshots of the account list in Microsoft 365, Google Workspace, or your domain

SSP statement stub

[Company] keeps a list of authorized users, service accounts, and devices in [location]. [Role] approves new accounts before they are created and removes accounts within [timeframe] of a departure. Only listed users, processes, and devices can sign in to [systems].

AC.L1-b.1.ii · FAR 52.204-21(b)(1)(ii) · NIST 3.1.2

Transaction & Function Control

Each person can only do what their job needs. Not everyone is an administrator.

Requirement: Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Obj.	The assessor determines	Ask yourself
[a]	the types of transactions and functions that authorized users are permitted to execute are defined	Have you written down what each role is allowed to do?
[b]	system access is limited to the defined types of transactions and functions for authorized users	Do the systems actually stop people from doing more than their role allows?

Evidence to gather

A short list of roles and what each role may do
A list of who holds administrator rights
Screenshots of role or group membership
A record of how a change in access is requested and approved

SSP statement stub

[Company] defines what each role may do in [location]. Administrator rights are limited to [roles or names of roles]. [Systems] enforce these roles through [groups, roles, or permissions].

AC.L1-b.1.iii · FAR 52.204-21(b)(1)(iii) · NIST 3.1.20

External Connections

You know which outside systems connect to yours, such as personal phones, home computers, and cloud apps, and you control them.

Requirement: Verify and control/limit connections to and use of external information systems.

Obj.	The assessor determines	Ask yourself
[a]	connections to external systems are identified	Do you know which outside systems connect to yours?
[b]	the use of external systems is identified	Do you know which outside systems people use for work, such as personal phones and cloud apps?
[c]	connections to external systems are verified	Have you confirmed those connections are approved?
[d]	the use of external systems is verified	Have you confirmed that use is approved?
[e]	connections to external systems are controlled/limited	Are connections from outside systems limited by a setting or rule?
[f]	the use of external systems is controlled/limited	Is the use of outside systems limited by a setting or rule?

Evidence to gather

A list of external systems and cloud services that connect or hold company data
A written rule on personal devices and home computers
Settings that block or limit unmanaged devices
Any agreements with outside providers

SSP statement stub

[Company] lists the external systems and services that connect to company systems in [location]. [Rule on personal devices]. Connections are limited by [mechanism, such as conditional access or device enrollment] and reviewed [frequency].

AC.L1-b.1.iv · FAR 52.204-21(b)(1)(iv) · NIST 3.1.22

Control Public Information

Nobody posts contract information on your website or social media. Someone checks first.

Requirement: Control information posted or processed on publicly accessible information systems.

Obj.	The assessor determines	Ask yourself
[a]	individuals authorized to post or process information on publicly accessible systems are identified	Have you named who may post to your website and social media?
[b]	procedures to ensure [FCI] is not posted or processed on publicly accessible systems are identified	Do you have a written step that keeps contract information off public sites?
[c]	a review process is in place prior to posting of any content to publicly accessible systems	Does someone review content before it is posted?
[d]	content on publicly accessible systems is reviewed to ensure that it does not include [FCI]	Do you check what is already posted for contract information?
[e]	mechanisms are in place to remove and address improper posting of [FCI]	Do you have a way to take down contract information posted by mistake?

Evidence to gather

A list of who may post to the website and social media
A short review step before anything is posted
A record of the last few reviews
How you would take down something posted by mistake

SSP statement stub

Only [roles] may post to [website and social accounts]. Before posting, [role] checks that the content holds no Federal Contract Information. If FCI is posted by mistake, [role] removes it within [timeframe].

IA.L1-b.1.v · FAR 52.204-21(b)(1)(v) · NIST 3.5.1

Identification

Every person, program, and device has its own name in your systems. No shared logins.

Requirement: Identify information system users, processes acting on behalf of users, or devices.

Obj.	The assessor determines	Ask yourself
[a]	system users are identified	Does every user have their own account?
[b]	processes acting on behalf of users are identified	Does every service account and automated program have its own identity?
[c]	devices accessing the system are identified	Does every device that connects have a name or record?

Evidence to gather

A user list showing one account per person
A list of service accounts and what each runs
A device inventory with a name for each device
Proof that shared or generic accounts are disabled or tied to one owner

SSP statement stub

Each user at [Company] has a unique account. Service accounts are named and tied to an owner in [location]. Devices are identified by [name, serial, or enrollment record] in [inventory].

IA.L1-b.1.vi · FAR 52.204-21(b)(1)(vi) · NIST 3.5.2

Authentication

Every person, program, and device proves who it is before it gets in, with a password, key, or certificate.

Requirement: Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

Obj.	The assessor determines	Ask yourself
[a]	the identity of each user is authenticated or verified as a prerequisite to system access	Must each user prove who they are before getting in?
[b]	the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access	Must each service account or program prove who it is before getting in?
[c]	the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access	Must each device prove what it is before connecting?

Evidence to gather

Password or sign-in settings screenshots
Multifactor authentication settings if you use it
Proof that default passwords on routers, printers, and other devices were changed
How devices are verified before they join the network

SSP statement stub

[Systems] require each user to authenticate with [password and any second factor] before access. Default passwords are changed before a device is put in service. Devices authenticate through [mechanism].

MP.L1-b.1.vii · FAR 52.204-21(b)(1)(vii) · NIST 3.8.3

Media Disposal

Before you throw away or reuse a drive, laptop, phone, or paper with contract information, you wipe it or destroy it.

Requirement: Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

Obj.	The assessor determines	Ask yourself
[a]	system media containing [FCI] is sanitized or destroyed before disposal	Do you wipe or destroy drives and paper with contract information before throwing them away?
[b]	system media containing [FCI] is sanitized before it is released for reuse	Do you wipe drives before reusing them or giving them to someone else?

Evidence to gather

A short written disposal procedure
Certificates of destruction from a recycler or shredding service
A log of wiped or destroyed devices with dates
The wiping tool or method you use

SSP statement stub

[Company] sanitizes or destroys media that held FCI before disposal or reuse, using [method]. [Role] records each item in [log location]. Destruction by a vendor is documented with a certificate.

PE.L1-b.1.viii · FAR 52.204-21(b)(1)(viii) · NIST 3.10.1

Limit Physical Access

Only approved people can walk up to your computers, network equipment, and work areas.

Requirement: Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

Obj.	The assessor determines	Ask yourself
[a]	authorized individuals allowed physical access are identified	Do you have a list of people allowed into your office and equipment areas?
[b]	physical access to organizational systems is limited to authorized individuals	Can only those people physically reach your computers?
[c]	physical access to equipment is limited to authorized individuals	Can only those people physically reach your network equipment and servers?
[d]	physical access to operating environments is limited to authorized individuals	Can only those people enter your work areas?

Evidence to gather

A list of people allowed into the office, server closet, or equipment room
How keys, badges, or codes are issued
A record that access was removed for departed staff
Photos of locked doors or racks

SSP statement stub

Physical access to [office, equipment room, and work areas] is limited to the people listed in [location]. [Role] issues and revokes [keys, badges, or codes].

PE.L1-b.1.ix · FAR 52.204-21(b)(1)(ix) · NIST 3.10.3;3.10.4;3.10.5

Manage Visitors & Physical Access

Visitors are escorted and signed in, and you control your keys, badges, and door codes.

Requirement: Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

Obj.	The assessor determines	Ask yourself
[a]	visitors are escorted	Are visitors escorted?
[b]	visitor activity is monitored	Does someone watch what visitors do?
[c]	audit logs of physical access are maintained	Do you keep a record of who came in, such as a visitor log or door system log?
[d]	physical access devices are identified	Do you have a list of your keys, badges, and door codes?
[e]	physical access devices are controlled	Do you control who holds each key, badge, and code?
[f]	physical access devices are managed	Do you change, collect, or revoke keys, badges, and codes when people leave or they are lost?

Evidence to gather

A visitor log or sign-in sheet
A written rule that visitors are escorted
An inventory of keys, badges, and codes and who holds each
A record of the last time locks or codes were changed

SSP statement stub

Visitors to [Company] sign in at [location] and are escorted by staff. Physical access records are kept for [period]. [Role] keeps an inventory of keys, badges, and codes and changes them when [trigger].

SC.L1-b.1.x · FAR 52.204-21(b)(1)(x) · NIST 3.13.1

Boundary Protection

A firewall sits at the edge of your network and between its important parts. It watches and controls what comes in and goes out.

Requirement: Monitor, control, and protect organizational communications ( i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

Obj.	The assessor determines	Ask yourself
[a]	the external system boundary is defined	Have you drawn where your network meets the internet?
[b]	key internal system boundaries are defined	Have you identified the important internal dividing lines, if any?
[c]	communications are monitored at the external system boundary	Is traffic at the internet edge logged or watched?
[d]	communications are monitored at key internal boundaries	Is traffic at the internal dividing lines logged or watched?
[e]	communications are controlled at the external system boundary	Does a firewall block traffic at the edge unless it is allowed?
[f]	communications are controlled at key internal boundaries	Is traffic controlled at the internal dividing lines?
[g]	communications are protected at the external system boundary	Is traffic protected at the edge?
[h]	communications are protected at key internal boundaries	Is traffic protected at the internal dividing lines?

Evidence to gather

A simple network diagram showing the internet connection and the firewall
Firewall rule list or screenshots
Firewall logs or alerts
Settings that block inbound traffic by default
Notes on any internal network separation

SSP statement stub

[Company]'s network boundary is defined in [diagram location]. [Firewall or device] monitors and controls traffic at the boundary and blocks inbound connections not explicitly allowed. [Internal boundaries, if any] are separated by [mechanism].

SC.L1-b.1.xi · FAR 52.204-21(b)(1)(xi) · NIST 3.13.5

Public-Access System Separation

Anything the public can reach, such as a web server or guest Wi-Fi, is kept apart from your internal network.

Requirement: Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Obj.	The assessor determines	Ask yourself
[a]	publicly accessible system components are identified	Have you listed what the public can reach, such as a website, guest Wi-Fi, or remote access portal?
[b]	subnetworks for publicly accessible system components are physically or logically separated from internal networks	Are those public systems on a separate network from your internal systems?

Evidence to gather

A list of public-facing systems, such as a website, guest Wi-Fi, or remote-access portal
The network diagram showing them on a separate network or VLAN, or hosted outside your office
Firewall rules that separate them

SSP statement stub

Publicly accessible components are listed in [location]. They are separated from internal networks by [hosting outside the network, a separate VLAN, or a DMZ], enforced by [firewall or device].

SI.L1-b.1.xii · FAR 52.204-21(b)(1)(xii) · NIST 3.14.1

Flaw Remediation

You find, report, and fix security flaws on a set schedule. In practice, you patch on time.

Requirement: Identify, report, and correct information and information system flaws in a timely manner.

Obj.	The assessor determines	Ask yourself
[a]	the time within which to identify system flaws is specified	Have you set how often you look for security flaws?
[b]	system flaws are identified within the specified time frame	Do you actually find flaws on that schedule?
[c]	the time within which to report system flaws is specified	Have you set how quickly flaws must be reported?
[d]	system flaws are reported within the specified time frame	Are flaws reported that quickly?
[e]	the time within which to correct system flaws is specified	Have you set how quickly flaws must be fixed?
[f]	system flaws are corrected within the specified time frame	Are flaws fixed that quickly?

Evidence to gather

A written patch timeline, for example critical updates within 14 days
Update settings screenshots for computers, servers, and network devices
A recent patch report or update history
A record of flaws found and when each was fixed

SSP statement stub

[Company] checks for flaws in [systems] every [frequency], reports them to [role] within [timeframe], and installs fixes within [timeframe]. Patch history is kept in [location].

SI.L1-b.1.xiii · FAR 52.204-21(b)(1)(xiii) · NIST 3.14.2

Malicious Code Protection

You run antivirus or endpoint protection on the computers and servers that need it.

Requirement: Provide protection from malicious code at appropriate locations within organizational information systems.

Obj.	The assessor determines	Ask yourself
[a]	designated locations for malicious code protection are identified	Have you listed where antivirus or endpoint protection must run?
[b]	protection from malicious code at designated locations is provided	Is it running in each of those places?

Evidence to gather

A list of where protection runs, such as each laptop, server, and email
Screenshots of the antivirus or endpoint console
A device count compared to the protected device count

SSP statement stub

[Company] protects [locations, such as endpoints, servers, and email] from malicious code with [product]. Protection is managed from [console].

SI.L1-b.1.xiv · FAR 52.204-21(b)(1)(xiv) · NIST 3.14.4

Update Malicious Code Protection

Your antivirus updates itself whenever new versions or signatures come out.

Requirement: Update malicious code protection mechanisms when new releases are available.

Obj.	The assessor determines	Ask yourself
[a]	malicious code protection mechanisms are updated when new releases are available	Does your antivirus update when new versions come out?

Evidence to gather

Settings showing automatic updates
A console screenshot showing current signature or engine versions
A list of any device out of date, and how it was fixed

SSP statement stub

[Product] updates automatically when new releases are available. [Role] checks [console] [frequency] for devices that are out of date.

SI.L1-b.1.xv · FAR 52.204-21(b)(1)(xv) · NIST 3.14.5

System & File Scanning

You run scheduled antivirus scans, and files are checked as they are downloaded or opened.

Requirement: Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

Obj.	The assessor determines	Ask yourself
[a]	the frequency for malicious code scans is defined	Have you set how often scans run?
[b]	malicious code scans are performed with the defined frequency	Do scans actually run that often?
[c]	real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed	Are files scanned as they are downloaded, opened, or run?

Evidence to gather

Scan schedule settings
A recent scan report
Settings showing real-time or on-access scanning is on

SSP statement stub

[Product] runs full scans every [frequency] and scans files in real time as they are downloaded, opened, or run. Scan results are kept in [location].

Two of the 15 practices live in your firewall. Want an engineer to check yours?

See the Hardening Review Or book a check-in

This workbook helps you prepare a self-assessment. It is not an assessment, a score, or a certification, and filling it in does not make you compliant. You are responsible for your own SPRS affirmation. Lawson Cyber does not certify.