Skip to content
AI assistant — not a lawyer, not the governmentFirmenza's assistant is software. It explains what a section asks and checks the format of what you type. It does not give legal advice, and it is not part of the government.

← All posts

The basic safeguarding self-check: CMMC Level 1's fifteen requirements, your own answers

What the basic safeguarding self-check is: FAR 52.204-21's fifteen requirements, your own private answers, no score.

The Firmenza team ·

Type your business name or UEI. The check is free.

What is the self-check?

Some federal contracts include FAR clause 52.204-21, which asks a contractor to protect the contract's own non-public information on its systems with fifteen basic safeguarding requirements. CMMC Level 1, the foundational level of the Department of Defense's cybersecurity program, is built on those same fifteen requirements. Our guide on CMMC Level 1 says where that comes from.

The basic safeguarding self-check, opened from your dashboard, lists the fifteen requirements in the clause's own words, in English, read from acquisition.gov and held on our server, with the paragraph and the clause date shown and a labeled source link. You mark what is true for your business today.

How do you answer?

Under each requirement you choose "In place", "Not yet" or "Not sure", one at a time, and the answer is saved. Nothing is pre-filled, defaulted or suggested: a requirement you have not answered shows "No answer yet", and a new choice replaces the old one.

Beside each requirement is "Firmenza's explanation", one plain line of our own on what it asks for, such as confirming who someone is before they get in, or wiping a device before it leaves your hands. It is not the clause and not legal advice. The clause's words stay above it, so you answer against the requirement itself.

What does the count mean?

At the top, the page says how many of the fifteen you marked in place, for example "9 of 15 marked in place by you". It is a count of your own marks. It is not a score, it sets no threshold, and it does not say whether a requirement is met.

What is it not?

This is your own self-check. Your answers are private to your account: no other account, no staff screen, no email and no AI reads them, and they are deleted with the account. Firmenza never makes, files or affirms anything in SPRS or anywhere else from them. A CMMC Level 1 self-assessment, its result in SPRS and the affirmation that goes with it are statements the business makes about its own systems, and the self-check is a place to think them through first, not any of those statements.

The AI assistant does not answer for you either. Ask it what CMMC is and it explains in general words; ask it whether your own business meets a requirement, or to pick an answer, and it refers you to a free counselor or an attorney instead.

Does the clause apply to your contract?

Whether this clause applies to a contract is for that contract to say, and whether a CMMC Level 1 requirement applies is for its solicitation or contract to state. The contracting officer on that contract can tell you which. The card just below this post lists free counselors who can read the terms with you, and our guide on a first federal contract says what else comes before a first bid.

Sources

The guides this post builds on

More from the blog

Check your own record

The free health check reads the public SAM.gov record and tells you what it says — status, expiration date, and what is worth a second look.