Federal Contract Information · CMMC Level 1
Build your baseline.
Find every gap.
Work through 15 FAR safeguards mapped to 17 assessment checks. See what is supported by evidence and what needs work across the systems that handle Federal Contract Information (FCI).
Begin with an honest review. Every check starts as Not reviewed. Select Met only when all applicable assessment objectives are satisfied by evidence. This planning tool does not submit results to SPRS.
Your Level 1 challenge
Six missions. A clearer starting point.
Each reviewed check moves you forward, even when you find a gap. Finish the map, then turn the findings into action.
Mission map 0 / 6 families reviewed
Milestones measure review activity, not compliance. Answers and progress stay in this page and reset when you leave or reload.
Based on your entries
0 justified N/A · 0 known gaps
17 not fully reviewed
Level 1 has no conditional POA&M path. Every applicable safeguard must be satisfied.
No weighted deductions or partial credit. FAR b.1.ix contains three physical protection checks, all of which must be satisfied for that safeguard to count.
ACAccess Control
0/4 reviewed
Access Control
Authorize system access
Restrict access to approved users, processes acting for those users, and authorized devices.
NIST assessment objective mapping: 3.1.1
What evidence should I check?
Compare account and device inventories with access approvals. Check disabled accounts and unauthorized connection attempts.
Limit permitted actions
Allow authorized users only the transactions and functions they are permitted to perform.
NIST assessment objective mapping: 3.1.2
What evidence should I check?
Review role permissions and sample access tests showing that users cannot perform unapproved functions.
Control external connections
Verify and control connections to external systems and how those systems are used.
NIST assessment objective mapping: 3.1.20
What evidence should I check?
Review approved external services, connection rules, and how your team verifies authorization before use.
Protect public information channels
Control information posted or processed on publicly accessible systems so Federal Contract Information is not exposed.
NIST assessment objective mapping: 3.1.22
What evidence should I check?
Review publishing permissions, approval procedures, and checks for unintended FCI disclosure.
IAIdentification and Authentication
0/2 reviewed
Identification and Authentication
Identify users and devices
Identify users, processes acting for users, and devices accessing your systems.
NIST assessment objective mapping: 3.5.1
What evidence should I check?
Inspect unique user identifiers, service identities, and device identification records.
Authenticate before access
Verify the identity of users, processes, and devices before allowing system access.
NIST assessment objective mapping: 3.5.2
What evidence should I check?
Check authentication settings and sample sign-in behavior for the identities and devices in scope.
MPMedia Protection
0/1 reviewed
Media Protection
Sanitize media before disposal
Sanitize or destroy media containing Federal Contract Information before disposal or reuse.
NIST assessment objective mapping: 3.8.3
What evidence should I check?
Review disposal procedures and records demonstrating sanitization or destruction of FCI-bearing media.
PEPhysical Protection
0/4 reviewed
Physical Protection
Restrict physical access
Limit physical access to systems, equipment, and operating environments to authorized people.
NIST assessment objective mapping: 3.10.1
What evidence should I check?
Review authorized access lists and observe how offices, equipment, and work areas are secured.
Escort and monitor visitors
Escort visitors and monitor their activity in areas containing covered systems.
NIST assessment objective mapping: 3.10.3
What evidence should I check?
Check visitor handling procedures and records, and observe escort practices. This is one of three checks for FAR b.1.ix.
Maintain physical access logs
Maintain audit logs of physical access to covered systems and their environments.
NIST assessment objective mapping: 3.10.4
What evidence should I check?
Inspect visitor records, badge logs, or other physical access records. This is one of three checks for FAR b.1.ix.
Manage physical access devices
Control and manage keys, badges, and other physical access devices.
NIST assessment objective mapping: 3.10.5
What evidence should I check?
Review issuance, recovery, and revocation of keys and badges. This is one of three checks for FAR b.1.ix.
SCSystem and Communications Protection
0/2 reviewed
System and Communications Protection
Protect system boundaries
Monitor, control, and protect communications at external and key internal system boundaries.
NIST assessment objective mapping: 3.13.1
What evidence should I check?
Review network boundaries, firewall rules, and monitoring that covers the systems handling FCI.
Separate public system components
Place publicly accessible components in subnetworks separated physically or logically from internal networks.
NIST assessment objective mapping: 3.13.5
What evidence should I check?
Review network diagrams and separation tests. If no publicly accessible components exist in scope, document why this check is not applicable.
SISystem and Information Integrity
0/4 reviewed
System and Information Integrity
Correct system flaws
Identify, report, and correct information and system flaws in a timely manner.
NIST assessment objective mapping: 3.14.1
What evidence should I check?
Review flaw reports, patch records, remediation ownership, and how timely correction is verified.
Protect against malicious code
Provide malicious-code protection at appropriate locations in your systems.
NIST assessment objective mapping: 3.14.2
What evidence should I check?
Inspect protection coverage and settings across the environment, and review detection and response records.
Keep protection current
Update malicious-code protection mechanisms when new releases become available.
NIST assessment objective mapping: 3.14.4
What evidence should I check?
Check update settings, current protection versions, and records of successful updates.
Run periodic and real-time scans
Perform periodic system scans and real-time scans of externally sourced files when downloaded, opened, or executed.
NIST assessment objective mapping: 3.14.5
What evidence should I check?
Review scheduled scan results and settings for real-time scanning of files from external sources.
How this Level 1 check works
The 15 safeguards in FAR 52.204-21 map to 17 assessment checks across six families under 32 CFR 170.15. The three checks for physical access, FAR b.1.ix, count as one safeguard. This page reports both counts and does not calculate a weighted SPRS score.
Met means all applicable objectives are satisfied by evidence. A documented N/A may be appropriate where a requirement does not apply. This tool offers that option for public system separation when there are no publicly accessible components in scope. It is not an exhaustive determination of applicability.
All applicable Level 1 safeguards must be satisfied. There is no partial credit or conditional POA&M path. A completed checklist is not CMMC status, a formal assessment, or a contract eligibility decision.
Level 1 requires an annual self-assessment, submission of results in SPRS, and affirmation of compliance. Retain assessment evidence for six years from the CMMC Status Date. These summaries do not replace the full assessment objectives or scope review.
32 CFR 170.15: Level 1 requirements and mapping ↗
32 CFR 170.24: Assessment findings and scoring ↗
FAR 52.204-21: Basic safeguarding ↗
Make the findings actionable
Turn your gaps into a practical plan.
Rebnetik can help define the FCI boundary, review evidence, and prioritize the work before your Level 1 self-assessment.