Read the complete requirement, not only the nickname
The 15 basic safeguarding requirements in FAR 52.204-21 form the Level 1 foundation. Short labels help a team navigate, but they omit detail. The visitor requirement, for example, combines several actions. A checklist entry called “visitors” can conceal missing physical access logs or unmanaged keys.
Use the table below as an orientation map. It paraphrases the requirements and suggests a starting question. During the actual self-assessment, read the official requirement and the assessment objectives identified by 32 CFR 170.15. A screenshot that seems relevant to a short title may cover only part of the required behavior.
A map of the work
| Requirement | Working label | Practical starting question |
|---|---|---|
| AC.L1-b.1.i | Authorized access Identify who, which devices, and which service processes may access the environment. | Compare current accounts and devices with an approved access list; investigate unfamiliar entries. |
| AC.L1-b.1.ii | Permitted functions Limit each authorized user to the transactions and functions their role permits. | Compare representative standard and privileged accounts; record how the intended difference was checked. |
| AC.L1-b.1.iii | External systems Verify and control connections to and use of external systems. | List approved external connections and how personal devices, remote support, and file sharing are controlled. |
| AC.L1-b.1.iv | Public information Control what is posted or processed on publicly accessible systems. | Walk through who approves website uploads and how material is checked before public release. |
| IA.L1-b.1.v | Identity Identify users, processes acting for users, and devices. | Trace a sample account or device identifier to its owner or approved operational purpose. |
| IA.L1-b.1.vi | Authentication Verify identity before access is granted. | Inspect sign-in settings and demonstrate an authorized sign-in without capturing passwords or tokens. |
| MP.L1-b.1.vii | Media disposal Sanitize or destroy media containing FCI before disposal or reuse. | Review the disposal process and a non-sensitive record showing how a retired device was handled. |
| PE.L1-b.1.viii | Physical access Limit physical access to systems, equipment, and their operating environments. | Walk through the office or remote work location and identify how unauthorized access is prevented. |
| PE.L1-b.1.ix | Visitors & access devices Escort and monitor visitors, maintain physical access logs, and manage access devices. | Review visitor handling, physical access records, and key or badge issuance and return. |
| SC.L1-b.1.x | Communications boundaries Monitor, control, and protect communications at external and key internal boundaries. | Inspect the relevant boundary configurations and explain which traffic each boundary allows. |
| SC.L1-b.1.xi | Public components Separate public system components physically or logically from internal networks. | Identify public components and demonstrate the network separation used for them. |
| SI.L1-b.1.xii | Flaw correction Identify, report, and correct system and information flaws promptly. | Review how an update or vulnerability moves from discovery to verified correction. |
| SI.L1-b.1.xiii | Malicious code protection Provide malicious code protection at appropriate locations. | Compare the endpoint inventory with current protection coverage and investigate gaps. |
| SI.L1-b.1.xiv | Protection updates Update malicious code protection mechanisms when releases become available. | Inspect update configuration and current update health, including failures. |
| SI.L1-b.1.xv | Periodic & real-time scans Perform periodic system scans and real-time scans of files from external sources. | Review scan configuration and recent scan execution; verify real-time scanning is active. |
Look for dependencies between families
An account inventory supports both authorized access and identification, but those are separate questions. Knowing that an account exists does not prove that its permissions are appropriate. Likewise, installing endpoint protection does not prove it receives updates or performs the required scans. Record the distinct checks rather than reusing one “complete” mark for the entire product.
The business process matters as much as the setting. A public website can be isolated from an internal network while an employee still posts FCI to it. Network separation and content approval address different failure paths, and both deserve attention.
Choose evidence that reveals what happens
Use a combination of explanations, records, and demonstrations that fits the environment and the official objectives. An approved policy describes intent; a current account report shows implementation at a point in time; a walkthrough can show that a person understands the process. None should be treated as a universal substitute for the others.
For a small illustrative company, the first review might reveal that one owner can explain the process but has never checked whether the settings match it. That is a useful finding. Assign the verification step, capture the result internally, and resolve the gap before relying on it in an assessment.
Keep the map maintainable
Review ownership when an employee leaves, a managed service changes, or a device category is added. Use stable requirement identifiers so an evidence reference remains understandable after titles or folder names change. Keep a short note explaining which systems and date each review covered.
The browser planner mirrors these 15 requirements for work coordination. Its workflow labels describe planning activity only. It does not evaluate every assessment objective, submit results, or award CMMC status. Use it to prepare a focused internal review, then follow the official assessment and SPRS processes.