A program manager forwards a DoD solicitation. The team starts pricing MFA, SIEM, endpoint tools, and a full NIST 800-171 rollout.
First, confirm the contract clause. Then trace where Federal Contract Information (FCI) moves.
A Level 1 effort can otherwise become an expensive Level 2 project.
Confirm the contract trigger before spending
Confirm the solicitation or award language and decide whether Level 1 applies.
Read the award, not a sales page
Read the solicitation, award, and all security clauses. Look for the CMMC level, the assessment requirement, and any flow-down terms.
Do not rely on a vendor page or a prime contractor's informal email. The award language sets the requirement.
The typical mistake is buying tools before confirming the clause. This review often takes 10 to 20 minutes per document.
Use zero trust to limit access
Use zero trust to limit access to FCI. Think of it like checking a badge at every locked door.
Give FCI access only to approved people, devices, and accounts. Remove access when a worker changes roles or leaves.
A fast review checks the main contract clause. A correct review also checks attachments, amendments, and subcontract terms.
⚠️ Do not assume Level 1 applies because your company sells to the government. The solicitation or award must require it.
Once the trigger is clear, map every place where FCI exists. That boundary decides what you must protect.
Inventory every FCI location and draw a boundary that includes people, systems, places, and providers.
Check the overlooked FCI locations
List every place where FCI is stored, sent, viewed, or copied. Include cloud services, local devices, paper, backups, and support accounts.
FCI is nonpublic information given by the government under a contract. It also includes information created for the government under that contract.
Email copies cause many scope failures. A sent attachment can remain in mailboxes, downloads, backups, and phone caches.
Decide: include, remove, or investigate
For each location, choose one action: include it, remove the FCI, or investigate it. Record the choice in your boundary list.
Include a location if it can store, process, or access FCI. Remove FCI before excluding a personal device or unapproved service.
A common case involves a sales mailbox with old proposal files. Removing the files and confirming deletion can reduce the boundary.
| Location | Check | Boundary decision | Proof |
|---|
| Email and shared drives | FCI attachments and sync copies | Include or remove files | Search export, access list |
| Endpoints and phones | Downloads, caches, mobile mail | Managed only | Device inventory, MDM report |
| SaaS and providers | Tenant, backups, support access | Include or block | Provider list, settings export |
| Paper and facilities | Files, cabinets, visitors | Include controlled areas | Visitor log, cabinet photo |
Treat scope records, operating procedures, and proof as three separate deliverables. The FCI inventory and CMMC boundary define the FCI scope.
That scope includes users, devices, apps, SaaS accounts, facilities, backups, and providers. Each item may store, process, or access FCI.
CMMC documents explain the rule and the responsible role. They show how access approvals, identity settings, and security training are managed.
Proof shows that the rule was followed. Keep dated account reviews, MFA reports, training records, visitor logs, patch reports, and disposal records.
Link these records in a CMMC evidence matrix. This lets you trace each Level 1 requirement from boundary to control to proof.
Scope is not just a diagram. The next step gives every required practice a named owner.
⚠️ Do not exclude SaaS backups or provider support access without proof that they cannot access FCI.
Assign all 17 practices to named owners
Build one evidence matrix that connects every Level 1 practice to an action, owner, proof, and status.
Access, identity, and awareness
Assign one primary owner to every practice. That person must show the setting, process, and dated evidence.
Do not assign every row to "IT." HR, facilities, reception, and executives often own parts of Level 1.
The most frequent error is naming an owner who lacks access to the evidence. Test this during assignment, not during self-assessment.
| Practice | Concrete action | Expected evidence | Owner / status |
|---|
| AC.L1-3.1.1 | Limit access to authorized users, processes, and devices | Account and device inventory | IT / ___ |
| AC.L1-3.1.2 | Limit authorized functions | Role and admin settings | IT / ___ |
| IA.L1-3.5.1 | Identify users, processes, devices | Named-account report | IT / ___ |
| IA.L1-3.5.2 | Authenticate before access | Password and MFA settings | IT / ___ |
| AT.L1-3.2.1 | Train users on security duties | Completion report | HR / ___ |
System media protection is a separate Level 1 duty. It is not only a disposal task.
Add MP.L1-3.8.1 to the CMMC 17 practices checklist. Protect and securely store media that contains FCI.
Media includes printed solicitations, laptop files, removable drives, backup devices, and stored multifunction-printer jobs. Protect each form while it remains in use.
Use locked paper storage, removable-media limits, an approved-media list, and off-site FCI rules. These controls are simple, but they need proof.
Useful proof includes secured-storage photos, a media register, device encryption settings, and a signed media-handling procedure. MP.L1-3.8.3 covers destruction or sanitization, but it does not replace protection during normal use.
| Practice | Concrete action | Expected evidence | Owner / status |
|---|
| MP.L1-3.8.3 | Sanitize or destroy FCI media | Destruction log or certificate | Facilities / ___ |
| PE.L1-3.10.1 | Limit physical access | Locks, badge list, photos | Facilities / ___ |
| PE.L1-3.10.3 | Escort and monitor visitors | Visitor and escort log | Reception / ___ |
| PE.L1-3.10.4 | Maintain physical access logs | Dated log sample | Facilities / ___ |
| PE.L1-3.10.5 | Manage keys and badges | Key or badge inventory | Facilities / ___ |
| SC.L1-3.13.1 | Protect network boundaries | Firewall configuration | IT / ___ |
| SC.L1-3.13.5 | Separate public components | Network diagram | IT / ___ |
| SI.L1-3.14.1 | Correct system flaws | Patch report and tickets | IT / ___ |
| SI.L1-3.14.2 | Protect from malicious code | Endpoint console report | IT / ___ |
| SI.L1-3.14.3 | Update malware protection | Update policy and report | IT / ___ |
| SI.L1-3.14.4 | Run scans and updates | Scan schedule and results | IT / ___ |
A named owner makes weak controls visible. Next, collect proof that each control actually worked.
⚠️ Do not treat a signed policy as proof. The owner must also show a current record that proves the control operated.
Preserve proof that each control operated
Collect dated evidence that shows the control worked, not merely that a policy exists.
Match proof to the practice
Match each practice with proof from the system or process. A policy describes intent, while evidence shows actual work.
Use reports, screenshots, logs, tickets, and signed records. Date each item and link it to the correct matrix row.
A screenshot without a date can fail to prove current operation. Export reports when possible because they retain dates and account details.
Review samples before self-assessment
Before a Level 1 assessment, review all 17 practices with evidence. Do this before any required annual affirmation.
Ask each owner to show the control setting. Ask them to explain the procedure and show a current dated record.
Test realistic cases during the review. Find a former employee account, check a managed endpoint, inspect visitor logs, and review FCI sharing rights.
Record each gap, owner, due date, and retest result in the matrix. This turns self-assessment into a repeatable management process.
Paper controls often fail during this test because they may exist on paper but work inconsistently. Fix those gaps before making an assessment claim.
⚠️ Do not accept a policy statement when the owner cannot produce current evidence. A missing record is a gap until you can retest it.
Evidence review shows the real workload. The next phase turns those gaps into a funded 90-day plan.
Close level 1 gaps in 30, 60, and 90 days
Contain FCI exposure by day 30, complete controls and procedures by day 60, and validate evidence by day 90.
Days 1 through 30: confirm the contract trigger and map FCI. Disable former-worker accounts and remove FCI from personal storage.
Identify unmanaged endpoints and lock down shared mailboxes. These tasks reduce immediate exposure.
Days 31 through 60: configure missing safeguards and write short procedures. Train users and complete every row in the 17-practice matrix.
Days 61 through 90: sample proof and correct failures. Obtain executive review and prepare self-assessment and annual affirmation processes, if required.
Fix exposed FCI before polishing documents.
Fund the work with a gap ledger
Build a gap ledger with the owner, cost, due date, and proof needed. This gives executives a clear approval list.
Internal time often costs more than tool licenses. Count time for account cleanup, evidence collection, training, and retesting.
Use defined outside-support hours rather than open-ended work. This makes costs easier to approve and review.
| Cost category | Budget formula | Evidence created | Approval owner |
|---|
| Internal time | Hours × loaded rate | Matrix, reviews, tickets | Executive sponsor |
| Identity and endpoint tools | Per-user or per-device fees | MFA and endpoint reports | IT owner |
| Physical safeguards | Locks, badges, logs, disposal | Access and destruction records | Facilities owner |
| Outside support | Defined hours × rate | Deliverables and review notes | Executive sponsor |
Know when this checklist stops
This checklist does not fit every DoD contract. Stop and use Level 2 scope when the environment handles Controlled Unclassified Information (CUI).
CUI has specific rules for sharing or safeguarding. It commonly moves the environment toward CMMC Level 2 and NIST SP 800-171.
Also stop when an agency, prime contractor, or customer adds stronger security terms. Follow the applicable contract requirements in those cases.
⚠️ Do not claim readiness while known FCI remains on an unmanaged device, in a former employee account, or in an unapproved SaaS service.
FAQs
How many practices are in CMMC level 1?
CMMC Level 1 has 17 practices aligned with FAR 52.204-21 Basic Safeguarding Requirements. They cover access, identity, media, physical security, network boundaries, malware protection, patching, and training.
Is MFA required for CMMC level 1?
MFA can support identity authentication, but Level 1 requires all 17 practices. MFA alone does not meet Level 1.
Keep settings and enrollment reports if MFA is part of your control. Those reports show who enrolled and when.
What is the difference between FCI and CUI?
FCI is nonpublic information for the government under a contract. CUI has specific safeguarding or sharing controls.
CUI commonly moves the environment toward CMMC Level 2 and NIST SP 800-171. Confirm the data type before setting your scope.
Can we use Microsoft 365 for FCI?
Microsoft 365 can hold FCI when access, devices, sharing, and evidence are controlled. Keep those items inside your boundary.
Personal accounts, unmanaged endpoints, and open external sharing create separate gaps. Review each one before storing FCI.
Does CMMC level 1 need a third-party assessment?
Level 1 generally uses self-assessment and annual affirmation when the contract requires them. A CMMC Third-Party Assessment Organization supports Level 2 certification assessments.
It is not the normal Level 1 path. Check the contract for any added requirement.
How long should we keep level 1 evidence?
Keep evidence through the required assessment cycle and your documented retention rule. It must support self-assessment, annual affirmation, and contract needs.
Do not delete dated records after one review. Keep them long enough to show continued control operation.
What causes most level 1 readiness failures?
Most Level 1 failures involve untracked FCI, old accounts, unmanaged devices, or missing proof. Compare the FCI map with account, device, and physical-access records.
This comparison finds gaps quickly. It also identifies owners who need to fix them.
Turn the checklist into a defensible record
Start with the contract, contain FCI, and preserve proof before expanding the security stack.
A defensible record connects the contract, boundary, control, owner, and dated proof. It lets leaders approve costs without building an oversized Level 2 program.
What matters most:- Level 1 depends on the specific DoD solicitation or contract, not federal-contractor status alone.
- The boundary must include FCI copies in email, SaaS, endpoints, backups, paper files, facilities, and provider access.
- Each of the 17 practices needs a control, owner, procedure, and dated operating evidence.
- A 30-, 60-, and 90-day plan should fix exposure before documentation gaps.
- Use Level 2 and NIST SP 800-171 scope when CUI or stronger contract terms apply.
Who needs CMMC level 1?
Organizations need CMMC Level 1 when an applicable DoD solicitation or contract requires it. They must also handle FCI.
Verify each award because this is not a universal rule. It does not apply to all federal contractors.
