Skip to content
Expert CMMC
← Tools

Tools

CMMC Level 1 Readiness Checklist

15 practices with their assessment objectives and, for 15 of them, the evidence to collect from published implementation guidance. Tick each objective only when the evidence exists and is current.

Printing hides the navigation and starts each domain on a new page. Objective text is from the CMMC Level 1 Assessment Guide v2.13.

AC · Access Control

AC.L1-b.1.iAuthorized Access Control [FCI Data]

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

Assessment objectives

  • [a] authorized users are identified;
  • [b] processes acting on behalf of authorized users are identified;
  • [c] devices (and other systems) authorized to connect to the system are identified;
  • [d] system access is limited to authorized users;
  • [e] system access is limited to processes acting on behalf of authorized users; and
  • [f] system access is limited to authorized devices (including other systems).

Evidence to collect

  • Access control policy · reviewed annually
  • Authorized user list (export) · dated within 90 days of the assessment
  • Service account inventory · reviewed quarterly
  • Device inventory and enrollment report · dated within 90 days
  • Conditional access / device-trust policy screenshot · current configuration
  • Quarterly access review record · most recent two reviews

AC.L1-b.1.iiTransaction & Function Control [FCI Data]

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Assessment objectives

  • [a] the types of transactions and functions that authorized users are permitted to execute are defined; and
  • [b] system access is limited to the defined types of transactions and functions for authorized users.

Evidence to collect

  • Role-to-permission matrix · reviewed semi-annually
  • Group membership export · dated within 90 days
  • Folder or site permission report · dated within 90 days
  • Local administrator restriction evidence · current configuration

AC.L1-b.1.iiiExternal Connections [FCI Data]

Verify and control/limit connections to and use of external information systems.

Assessment objectives

  • [a] connections to external systems are identified;
  • [b] the use of external systems is identified;
  • [c] connections to external systems are verified;
  • [d] the use of external systems is verified;
  • [e] connections to external systems are controlled/limited; and
  • [f] the use of external systems is controlled/limited.

Evidence to collect

  • External systems and services inventory · reviewed quarterly
  • Acceptable use / external systems policy · reviewed annually
  • External sharing settings · current configuration
  • Web/DNS filtering policy · current configuration
  • Device-trust access rule · current configuration

AC.L1-b.1.ivControl Public Information [FCI Data]

Control information posted or processed on publicly accessible information systems.

Assessment objectives

  • [a] individuals authorized to post or process information on publicly accessible systems are identified;
  • [b] procedures to ensure [FCI] is not posted or processed on publicly accessible systems are identified;
  • [c] a review process is in place prior to posting of any content to publicly accessible systems;
  • [d] content on publicly accessible systems is reviewed to ensure that it does not include [FCI]; and
  • [e] mechanisms are in place to remove and address improper posting of [FCI].

Evidence to collect

  • Public content policy and authorized posters list · reviewed annually
  • Publishing workflow evidence · current configuration
  • Public content review record · within the last year
  • Takedown procedure · reviewed annually

IA · Identification & Authentication

IA.L1-b.1.vIdentification [FCI Data]

Identify information system users, processes acting on behalf of users, or devices.

Assessment objectives

  • [a] system users are identified;
  • [b] processes acting on behalf of users are identified; and
  • [c] devices accessing the system are identified.

Evidence to collect

  • Identification standard (access control policy section) · reviewed annually
  • User account export · dated within 90 days
  • Service account and process inventory · reviewed quarterly
  • Device inventory with unique identifiers · dated within 90 days
  • Network client list matched to inventory · dated within 90 days
  • Quarterly identity reconciliation record · most recent two reviews

IA.L1-b.1.viAuthentication [FCI Data]

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

Assessment objectives

  • [a] the identity of each user is authenticated or verified as a prerequisite to system access;
  • [b] the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access; and
  • [c] the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.

Evidence to collect

  • Authentication standard · reviewed annually
  • MFA and authentication-method registration report · dated within 90 days
  • Completed new-device checklists · one for every device in the inventory
  • Service account inventory with authentication method · reviewed quarterly
  • Device join and Wi-Fi security settings · current configuration

MP · Media Protection

MP.L1-b.1.viiMedia Disposal [FCI Data]

Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

Assessment objectives

  • [a] system media containing [FCI] is sanitized or destroyed before disposal; and
  • [b] system media containing [FCI] is sanitized before it is released for reuse.

Evidence to collect

  • Media disposal and sanitization procedure · reviewed annually
  • Sanitization and disposal log · most recent twelve months
  • Certificates of destruction · each pickup in the assessment period
  • Photo of shredder or locked shred bin · current

PE · Physical Protection

PE.L1-b.1.viiiLimit Physical Access [FCI Data]

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

Assessment objectives

  • [a] authorized individuals allowed physical access are identified;
  • [b] physical access to organizational systems is limited to authorized individuals;
  • [c] physical access to equipment is limited to authorized individuals; and
  • [d] physical access to operating environments is limited to authorized individuals.

Evidence to collect

  • Physical access authorization list · reviewed at least annually and after departures
  • Floor plan or photos of controlled areas · current
  • Physical security procedure · reviewed annually
  • Access review record · most recent review

PE.L1-b.1.ixManage Visitors & Physical Access [FCI Data]

Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

Assessment objectives

  • [a] visitors are escorted;
  • [b] visitor activity is monitored;
  • [c] audit logs of physical access are maintained;
  • [d] physical access devices are identified;
  • [e] physical access devices are controlled; and
  • [f] physical access devices are managed.

Evidence to collect

  • Visitor and physical access procedure · reviewed annually
  • Visitor log · retained for your defined period (for example one year)
  • Badge reader or entry logs · retained for your defined period
  • Physical access device inventory · reviewed at least annually
  • Key and badge return and revocation records · every departure in the assessment period
  • Photo of visitor badges and key box · current

SC · System & Communications Protection

SC.L1-b.1.xBoundary Protection [FCI Data]

Monitor, control, and protect organizational communications ( i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

Assessment objectives

  • [a] the external system boundary is defined;
  • [b] key internal system boundaries are defined;
  • [c] communications are monitored at the external system boundary;
  • [d] communications are monitored at key internal boundaries;
  • [e] communications are controlled at the external system boundary;
  • [f] communications are controlled at key internal boundaries;
  • [g] communications are protected at the external system boundary; and
  • [h] communications are protected at key internal boundaries.

Evidence to collect

  • Network boundary diagram · updated when the network changes; reviewed annually
  • Firewall rule set export · current configuration
  • Web or DNS filtering configuration · current configuration
  • Boundary traffic logs or blocked-activity digest · dated within 90 days
  • Boundary encryption settings · current configuration
  • Log and rule review record · most recent two quarters

SC.L1-b.1.xiPublic-Access System Separation [FCI Data]

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Assessment objectives

  • [a] publicly accessible system components are identified; and
  • [b] su bnetworks for publicly accessible system components are physically or logically separated from internal networks.

Evidence to collect

  • Public-facing component inventory · reviewed annually and on change
  • Network diagram showing the DMZ or off-site hosting · updated on change
  • DMZ firewall rules · current configuration
  • External exposure scan · within the last 12 months
  • Hosting evidence for externally hosted sites · current

SI · System & Information Integrity

SI.L1-b.1.xiiFlaw Remediation [FCI Data]

Identify, report, and correct information and information system flaws in a timely manner.

Assessment objectives

  • [a] the time within which to identify system flaws is specified;
  • [b] system flaws are identified within the specified time frame;
  • [c] the time within which to report system flaws is specified;
  • [d] system flaws are reported within the specified time frame;
  • [e] the time within which to correct system flaws is specified; and
  • [f] system flaws are corrected within the specified time frame.

Evidence to collect

  • Patch and vulnerability management policy · reviewed annually
  • Automatic update configuration · current configuration
  • Advisory review and scan records · most recent three months
  • Patch compliance report · dated within 30 days
  • Remediation tickets and exceptions · within the assessment period

SI.L1-b.1.xiiiMalicious Code ProTection [FCI Data]

Provide protection from malicious code at appropriate locations within organizational information systems.

Assessment objectives

  • [a] designated locations for malicious code protection are identified; and
  • [b] protection from malicious code at designated locations is provided.

Evidence to collect

  • Malware protection locations list · reviewed annually
  • Endpoint protection status report · dated within 30 days
  • Email and web filtering configuration · current configuration

SI.L1-b.1.xivUpdate Malicious Code Protection [FCI Data]

Update malicious code protection mechanisms when new releases are available.

Assessment objectives

  • [a] malicious code protection mechanisms are updated when new releases are available.

Evidence to collect

  • Malware protection update requirement · reviewed annually
  • Antivirus update configuration · current configuration
  • Definition version report · dated within 30 days

SI.L1-b.1.xvSystem & File Scanning [FCI Data]

Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

Assessment objectives

  • [a] the frequency for malicious code scans is defined;
  • [b] malicious code scans are performed with the defined frequency; and
  • [c] real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.

Evidence to collect

  • Scan frequency requirement · reviewed annually
  • Scheduled scan configuration · current configuration
  • Scan history report · dated within 30 days
  • Real-time and email scanning settings · current configuration