CMMC Level 1 has 15 security practices. Every organization that handles Federal Contract Information (FCI) under a Department of Defense (redesignated the Department of War by executive order, September 2025) (DoD) contract must implement all 15. They are derived directly from FAR Clause 52.204-21 and cover six security domains.
This article walks through each of the 15 practices, explains what each one requires in plain language, and gives a concrete example of what implementation looks like. If you are working toward Level 1 compliance, this is your checklist.
The 15 practices span six domains. Each practice has a CMMC identifier in the format [Domain].[Level]-b.[FAR paragraph]:
Requirement: Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
What it means: Only people who are supposed to have access to your systems and data should have it. Shared accounts, guest accounts left active, and former employees who still have credentials are the most common failures.
What implementation looks like:
Requirement: Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
What it means: Users should only be able to do what their job requires. An accountant does not need administrative access to servers. A warehouse employee does not need access to contract data repositories.
What implementation looks like:
Requirement: Verify and control/limit connections to and use of external information systems.
What it means: You need visibility and control over how your systems connect to outside systems and how external systems connect to yours. This includes employee use of personal devices to access work resources and connections from vendors or external service providers.
What implementation looks like:
Requirement: Control information posted or processed on publicly accessible information systems.
What it means: If your organization has a website, social media presence, or any publicly accessible system, you must have controls to ensure FCI does not end up there. Someone has to be responsible for reviewing what goes onto public systems before it is posted.
What implementation looks like:
Requirement: Identify information system users, processes acting on behalf of users, and devices.
What it means: Every user, automated process, and device accessing your systems must have a unique identity. You need to know who (or what) is accessing your systems at any given time.
What implementation looks like:
Requirement: Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
What it means: Knowing who a user is means verifying it, not just assuming it. Passwords are the minimum. This practice requires that authentication happens before access is granted.
What implementation looks like:
Note: Level 1 requires authentication but does not mandate multi-factor authentication (MFA). MFA is a Level 2 requirement. At Level 1, strong passwords with proper management satisfy this practice.
Requirement: Sanitize or destroy information system media containing Federal Contract Information before disposal or reuse.
What it means: Before a hard drive, USB drive, laptop, workstation, or any storage media leaves your control, you must ensure FCI on it cannot be recovered. This applies to end-of-life equipment, returns to manufacturers, trade-ins, and repurposing old hardware.
What implementation looks like:
Requirement: Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
What it means: Physical access to your systems and the spaces where they operate must be controlled. Unauthorized individuals should not be able to walk up to a server, workstation, or network closet without a barrier.
What implementation looks like:
Requirement: Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices (e.g., keys, locks, combinations, and card readers).
What it means: When people who are not employees visit your facility, you need to manage their access. You also need records of who accessed what spaces and when, and you need to manage the keys and badges that control that access.
What implementation looks like:
Requirement: Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
What it means: Your network needs a protected perimeter. Traffic coming in and going out should be controlled and monitored. This is fundamentally about having and maintaining a firewall with appropriate rules.
What implementation looks like:
Requirement: Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
What it means: If your organization runs any publicly accessible systems (a web server, public file share, or external-facing application), those systems must be separated from your internal network. They should not be on the same network segment as your workstations and internal servers.
What implementation looks like:
Requirement: Identify, report, and correct information and information system flaws in a timely manner.
What it means: Software vulnerabilities need to be found and patched. This applies to operating systems, applications, firmware, and any other software running on your systems. "Timely" is not defined with a specific number of days in Level 1, but the intent is a systematic process, not ad hoc patching.
What implementation looks like:
Requirement: Provide protection from malicious code at appropriate locations within organizational information systems.
What it means: Antivirus and endpoint protection must be deployed on your systems. The standard is protection at "appropriate locations," which means at minimum on endpoints and servers.
What implementation looks like:
Requirement: Update malicious code protection mechanisms when new releases are available.
What it means: Antivirus definitions and endpoint protection software must be kept current. A six-month-old antivirus signature database does not protect against current threats.
What implementation looks like:
Requirement: Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
What it means: Two types of scanning are required: scheduled scans of the full system, and real-time scanning of files as they enter your environment (downloads, email attachments, USB files). Most modern endpoint protection tools handle both automatically.
What implementation looks like:
Use this quick checklist to estimate your current Level 1 posture:
For most organizations, the technical controls (firewall, antivirus, patch management) are either present or straightforward to implement. The gaps are usually in documentation, process, and the edge cases: the server room that is always unlocked, the retired employee whose account was never disabled, the old laptop sitting in a closet that was never wiped.
For the full CMMC program overview, see the CMMC 101: The Complete Guide to CMMC Compliance for Defense Contractors.
Related articles in this series:
Working through Level 1 compliance and need help getting to a clean score? NR Labs provides guided Level 1 gap assessments and SPRS submission support for defense contractors. Contact us to schedule a conversation.
