Features Frameworks Guide Pricing

Frameworks · US

CMMC Level 1

CMMC Level 1 is the entry level of the US Department of Defense Cybersecurity Maturity Model Certification program. It covers Federal Contract Information (FCI) and requires the 15 basic safeguarding requirements of FAR clause 52.204-21, grouped into six domains. Contractors show compliance through an annual self-assessment entered in SPRS with an affirmation by a senior official, and no plan of action is allowed for unmet requirements. It applies to defense contractors and subcontractors that handle FCI but not CUI; organizations that handle CUI should enable CMMC Level 2, which includes these safeguards.

Version
32 CFR Part 170 (CMMC Program, effective December 16, 2024); Level 1 requirements are FAR 52.204-21(b)(1)(i) to (xv)
Requirements
21, each mapped to ProofTrail’s controls
Try it in the demo $20 a year per installation

Requirements and controls

  • AC Access Control

    • AC.L1-b.1.i Only authorized users, processes and devices

      Only authorized users, processes acting for them and authorized devices, including other systems, can access systems that hold FCI.

      • Access Control Policy & Procedure
      • Identity Validation
      • User Access Reviews
      • Termination of Employment
      • Inventory of Endpoint Assets

    • AC.L1-b.1.ii Access limited to permitted functions

      Users can run only the types of transactions and functions their role allows.

      • Identity Validation
      • User Privilege Reviews
      • Access Control Policy & Procedure

    • AC.L1-b.1.iii External system connections controlled

      Connections to and use of systems outside the organization's control are verified and limited.

      • External System Connections
      • Rules of Behavior
      • Third-Party Criticality Assessments

    • AC.L1-b.1.iv FCI kept off public systems

      Content is reviewed before it is posted to publicly accessible systems so that FCI is not published, and any FCI found there is removed.

      • FCI & CUI Identification and Handling
      • Rules of Behavior

  • IA Identification and Authentication

    • IA.L1-b.1.v Users, processes and devices identified

      System users, processes acting for them and devices are identified.

      • Identity Validation
      • User Access Reviews
      • Inventory of Endpoint Assets

    • IA.L1-b.1.vi Identities authenticated before access

      The identity of each user, process or device is authenticated before it can access systems that hold FCI.

      • Multi-Factor Authentication
      • Password Management Guidelines
      • Access Control Policy & Procedure

  • MP Media Protection

    • MP.L1-b.1.vii Media sanitized before disposal or reuse

      Media containing FCI is sanitized or destroyed before it is disposed of or reused.

      • Media Disposal Policy

  • PE Physical Protection

    • PE.L1-b.1.viii Physical access limited

      Physical access to systems, equipment and their operating environments is limited to authorized people.

      • Physical Access Management
      • Physical Protection Policy & Procedure

    • PE.L1-b.1.ix Visitors, access logs and access devices managed

      Visitors are escorted and monitored, physical access is logged, and keys, badges and other physical access devices are controlled.

      • Physical Access Management

  • SC System and Communications Protection

    • SC.L1-b.1.x Boundaries protected

      Communications at the external boundary and key internal boundaries of systems are monitored, controlled and protected.

      • External System Connections
      • Limit Network Connections
      • Anomalous Behavior Detection

    • SC.L1-b.1.xi Public-facing components separated

      Publicly accessible system components sit in subnetworks that are physically or logically separated from internal networks.

      • Limit Network Connections
      • External System Connections

  • SI System and Information Integrity

    • SI.L1-b.1.xii System flaws remediated promptly

      Flaws in information and systems are identified, reported and corrected in a timely way.

      • Vulnerability Remediation Process
      • Centralized Flaw Remediation
      • Endpoint Security Validation

    • SI.L1-b.1.xiii Malicious code protection

      Protection against malicious code is in place at appropriate points in systems.

      • Malware Protection

    • SI.L1-b.1.xiv Malware protection kept up to date

      Malicious code protection is updated whenever new releases are available.

      • Malware Protection
      • Endpoint Security Validation

    • SI.L1-b.1.xv Periodic and real-time scanning

      Systems are scanned periodically, and files from external sources are scanned as they are downloaded, opened or run.

      • Malware Protection

Also in CMMC