What Is CMMC Level 1?

The Level 1 practices establish a security foundation for the higher levels of the model and must be completed by all certified organizations.

CMMC Levels

• CMMC Level 1
• CMMC Level 2
• CMMC Level 3

Simply put, to achieve CMMC level 1 certification, defense contractors must demonstrate basic cyber hygiene, as defined in 48 CFR 52.204-21. The Level 1 practices establish a security foundation for the higher levels of the model and must be completed by all certified organizations.

Level 1 is achievable for smaller companies and includes a subset of universally accepted common security practices. FCI is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. FCI does NOT include information provided by the Government to the public. While practices are expected to be performed, security process maturity is not addressed at CMMC Level 1. So, a CMMC Level 1 organization may have limited or inconsistent cybersecurity maturity processes. Level 1 offers limited protection against data exfiltration and malicious actions.

Why It’s Important To Start With Level 1

WHY IT’S IMPORTANT TO START WITH LEVEL 1

Regardless of which CMMC level defense contractors wish to achieve, they must begin by achieving basic hygiene as defined in Level 1.

Regardless of which CMMC level defense contractors wish to achieve, they must begin by achieving basic cyber hygiene as defined in level 1. If achieving CMMC compliance were to be compared with building a house, then level 1 would be the concrete foundation, plumbing and electrical wiring. The other (higher) levels are unachievable until these basics are set in place. CMMC certification is a sequential process, with each level building off the one before it.

What Are The Requirements Of Level 1?

There are 17 controls that must be met to achieve CMMC level 1, all of which are mapped directly to the Federal Acquisition Regulation (FAR) 52.204.21. Here is how the 17 controls are broken down:

Access Control (AC)

• 1.001
  • Limit information system access to authorized users, process acting on behalf of authorized users, or devices (including other information systems)
• 1.002
  • Limit information system access to the types of transactions and functions that authorized uses are permitted to execute
• 1.003
  • Verify and control/limit connections to and use of external information systems
• 1.004
  • Control information posted or processed on publicly accessible information systems

Identification and Authentication (IA)

• 1.076
  • Identify information system users, processes acting on behalf of users, or devices
• 1.077
  • Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems

Media Protection (MP)

• 1.118
  • Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse

Physical Protection (PP)

• 1.131
  • Limit physical access to organization information systems, equipment, and the respective operating environments to authorized individuals
• 1.132
  • Escort visitors and monitor visitor activity
• 1.133
  • Maintain audit logs of physical access devices
• 1.134
  • Control and manage physical access devices

System and Communications Protection (SC)

• 1.175
  • Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems
• 1.176
  • Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks

System and Information Integrity (SI)

• 1.210
  • Identify, report, and correct information and information system flaws in a timely manner
• 1.211
  • Provide protection from malicious code at appropriate locations within organizational information systems
• 1.212
  • Update malicious code protection mechanisms when new releases are available
• 1.213
  • Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed

How Do I Achieve Level 1?

After reviewing the level 1 requirements above, it seems pretty cut and dry to implement proper security for your company. However, in many cases, business leaders are their own worst enemies because they just don’t show the proper care. Rather than taking the proper precautions to secure their business, they try to just get by with the bare minimum of effort and resources.

Cyber security is NOT an IT issue; it is a business issue. There needs to be alignment from the board room to the server room, and organization leaders must take the lead in developing a proper security strategy for now and in the future. Here are a few quick and easy steps organizations can take to get on road to CMMC level 1 certification:

• Read and understand the level 1 requirements
• If you don’t have the internal resources, CCG can provide the required coverage
• Once level 1 certification is acquired, stay vigilant with your network and data security

Get CMMC Level 1 Certified

CCG offers a comprehensive CMMC compliance solution for government contractors. We allow you to shift the compliance burden to CCG, and we take on the responsibility for successfully achieving CMMC certification on the client’s behalf. Contact us today to schedule a complimentary consultation with our security experts.