CMMC Level 1: the 15 basic safeguarding requirements, in plain words

FAR 52.204-21 defines it: “Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.”

In plain words, it is the contract's own information that is not public, kept on or passing through your systems. The 15 requirements are about protecting those systems.

Paragraph (b)(1) of the clause lists them. Each item below gives the requirement's letter in the clause, the identifier CMMC gives it, and a plain reading that is Firmenza's own, not the clause and not legal advice. The clause's exact words are on acquisition.gov, linked at the foot of this guide.

1. Requirement (i), CMMC identifier AC.L1-b.1.i: Only the people, programs and devices you have allowed can get into your systems.
2. Requirement (ii), CMMC identifier AC.L1-b.1.ii: Each person can do only what their job needs on your systems, not everything.
3. Requirement (iii), CMMC identifier AC.L1-b.1.iii: You know which outside systems connect to yours, such as a vendor's tool or a personal device, and you limit how they are used.
4. Requirement (iv), CMMC identifier AC.L1-b.1.iv: You decide what goes onto public places such as your website or social pages, and information that is not for the public stays off them.
5. Requirement (v), CMMC identifier IA.L1-b.1.v: Every person, program and device that uses your systems can be told apart, for example by its own user name.
6. Requirement (vi), CMMC identifier IA.L1-b.1.vi: Before someone gets in, you confirm they are who they say they are, for example with a password and a second step.
7. Requirement (vii), CMMC identifier MP.L1-b.1.vii: Before you throw away, sell or give away a computer, phone, drive or paper that holds contract information, you wipe or destroy what is on it.
8. Requirement (viii), CMMC identifier PE.L1-b.1.viii: Only the people who should be there can get into the rooms and buildings where your equipment is.
9. Requirement (ix), CMMC identifier PE.L1-b.1.ix: Visitors are escorted and watched, you keep a record of who comes in, and you control keys, badges and similar devices.
10. Requirement (x), CMMC identifier SC.L1-b.1.x: You watch and protect what enters and leaves your network, and what passes between its main parts, for example with a firewall.
11. Requirement (xi), CMMC identifier SC.L1-b.1.xi: Anything the public can reach, such as a website server, sits on a part of your network separate from your internal computers.
12. Requirement (xii), CMMC identifier SI.L1-b.1.xii: When you learn of a flaw in your software or systems, you report it and fix it promptly, for example by installing updates.
13. Requirement (xiii), CMMC identifier SI.L1-b.1.xiii: You run protection against viruses and other harmful programs where they could get in, such as on computers and in email.
14. Requirement (xiv), CMMC identifier SI.L1-b.1.xiv: You keep that protection up to date when its maker releases a new version.
15. Requirement (xv), CMMC identifier SI.L1-b.1.xv: You scan your systems regularly, and scan files from outside when they are downloaded, opened or run.

Clause date Nov 2021, as acquisition.gov showed it in October 2026.

A contract or a solicitation says. The clause applies where a contract includes it, and a CMMC Level 1 requirement applies where a solicitation or contract states one. The contracting officer on that contract can tell you which, and a free counselor or an attorney can read the terms with you.

Level 1 is a self-assessment: the business checks its own safeguards, with no outside assessor. It has to meet all 15 requirements, and a plan of action for a requirement that is not yet met is not permitted.

The result is entered in SPRS, the Supplier Performance Risk System, with an affirmation of it, and the self-assessment is repeated every year. Before an award of a contract that requires Level 1, the business has to have that status and have submitted the affirmation. The evidence behind the assessment is kept for six years.

The assessment and the affirmation are statements the business makes about its own systems.

Firmenza's basic safeguarding self-check lists the same 15 requirements in your dashboard, with a plain reading of each, and lets you mark which are in place, not yet or not sure. Your answers are private to your account, and the count it shows is a count of your own marks, not a score.

Firmenza never makes, files or affirms anything in SPRS or anywhere else from your answers.

Whether a clause or a requirement applies to a particular contract is a question for its contracting officer or an attorney. The free help that already exists names the counselor networks that advise small businesses on federal contracting at no charge, and SAM.gov help says which to ask first.