Free CMMC Level 1 Self-Assessment Tool (15 Requirements)

AC.L1-b.1.i: “Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).”

Proof: a current list of user accounts and company devices, with no leftover accounts for people who've left.

AC.L1-b.1.ii: “Limit information system access to the types of transactions and functions that authorized users are permitted to execute.”

Proof: role or group lists, and a short list of who has admin rights.

AC.L1-b.1.iii: “Verify and control/limit connections to and use of external information systems.”

Proof: a written rule plus the settings that back it up.

AC.L1-b.1.iv: “Control information posted or processed on publicly accessible information systems.”

Proof: who's allowed to post publicly and how posts get reviewed.

IA.L1-b.1.v: “Identify information system users, processes acting on behalf of users, or devices.”

Proof: the user and device list.

IA.L1-b.1.vi: “Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.”

Proof: your password settings and sign-in policy.

MP.L1-b.1.vii: “Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.”

Proof: a disposal process and wipe or destruction records.

PE.L1-b.1.viii: “Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.”

Proof: a key or badge list.

PE.L1-b.1.ix: “Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.”

Proof: the visitor log and your key/badge tracking.

SC.L1-b.1.x: “Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.”

Proof: firewall make and model, and its rules.

SC.L1-b.1.xi: “Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.”

Proof: a simple network diagram.

SI.L1-b.1.xii: “Identify, report, and correct information and information system flaws in a timely manner.”

Proof: patch settings and update history.

SI.L1-b.1.xiii: “Provide protection from malicious code at appropriate locations within organizational information systems.”

Proof: a console view showing which devices are protected.

SI.L1-b.1.xiv: “Update malicious code protection mechanisms when new releases are available.”

Proof: the update setting and last-updated dates.

SI.L1-b.1.xv: “Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.”

Proof: scan schedule and real-time protection settings.