CMMC (Cybersecurity Maturity Model Certification) 2.0 Level 1 is designed to protectFederal Contract Information (FCI)and consists of17 foundational cybersecurity practices. These practices are directly derived fromFAR 52.204-21(Basic Safeguarding of Covered Contractor Information Systems), which outlines minimum security requirements for contractors handling FCI.
Breakdown of CMMC Level 1 PracticesThe17 practicesin Level 1 focus on basic cybersecurity hygiene and fall under the following6 domains:
Access Control (AC)– 4 practices
AC.L1-3.1.1: Limit system access to authorized users
AC.L1-3.1.2: Limit user access to authorized transactions and functions
AC.L1-3.1.20: Verify and control connections to external systems
AC.L1-3.1.22: Control information posted or processed on publicly accessible systems
Identification and Authentication (IA)– 2 practices
IA.L1-3.5.1: Identify and authenticate system users
IA.L1-3.5.2: Use multifactor authentication for local and network access
Media Protection (MP)– 1 practice
MP.L1-3.8.3: Sanitize media before disposal or reuse
Physical Protection (PE)– 4 practices
PE.L1-3.10.1: Limit physical access to systems containing FCI
PE.L1-3.10.3: Escort visitors and monitor visitor activity
PE.L1-3.10.4: Maintain audit logs of physical access
PE.L1-3.10.5: Control and manage physical access devices
System and Communications Protection (SC)– 2 practices
SC.L1-3.13.1: Monitor and control communications at system boundaries
SC.L1-3.13.5: Implement subnetworks for publicly accessible system components
System and Information Integrity (SI)– 4 practices
SI.L1-3.14.1: Identify, report, and correct system flaws in a timely manner
SI.L1-3.14.2: Provide protection from malicious code at designated locations
SI.L1-3.14.4: Update malicious code protection mechanisms periodically
SI.L1-3.14.5: Perform scans of system components and real-time file scans
Official Reference from CMMC 2.0 DocumentationThe 17 practices forCMMC Level 1are explicitly listed in theCMMC 2.0 Appendices and Assessment Guide for Level 1, as well as in theFAR 52.204-21 requirements. These practices representbasic safeguarding measuresthat all DoD contractors handlingFCImust implement.
????CMMC 2.0 Level 1 Summary:
Focus:Basic safeguarding of FCI
Total Practices:17
Derived From:FAR 52.204-21
Assessment Type:Self-assessment (annual)
Final Verification and ConclusionThe correct answer isB. 17 practicesas verified from theCMMC 2.0 official documentsandFAR 52.204-21 requirements.
