Independent education for small defense contractorsPublished by Federal Bid Partners LLC
CMMC Level 1The practical field guide
Home/Readiness work planner
A place for the next action

Your Level 1
working plan.

Organize follow-up for the 15 safeguards. Keep the real evidence in your approved internal systems.

Use owner roles, target dates, and non-sensitive references to coordinate your preparation. Planning stages describe work activity, including whether an internal review was recorded. They never mean a requirement is MET.

This tool does not inspect your systems, evaluate every assessment objective, determine compliance, or connect to SPRS. Your organization performs the assessment and its authorized senior official affirms.

Stored in this browser only.No entries are submitted by this tool. Do not enter FCI, CUI, credentials, personal information, vulnerability details, or confidential contract information. Browser data is not a protected evidence repository. Export before changing devices or clearing browser data. Read the storage policy.
0 of 15 planning reviews recordedA work-planning count · No score, compliance result, or status

Changes save in this browser only when storage is available. Export a copy to keep your plan.

AC.L1-b.1.i / Access control

01. Authorized access

Identify who, which devices, and which service processes may access the environment.

A practical question to investigateCompare current accounts and devices with an approved access list; investigate unfamiliar entries.
AC.L1-b.1.ii / Access control

02. Permitted functions

Limit each authorized user to the transactions and functions their role permits.

A practical question to investigateCompare representative standard and privileged accounts; record how the intended difference was checked.
AC.L1-b.1.iii / Access control

03. External systems

Verify and control connections to and use of external systems.

A practical question to investigateList approved external connections and how personal devices, remote support, and file sharing are controlled.
AC.L1-b.1.iv / Access control

04. Public information

Control what is posted or processed on publicly accessible systems.

A practical question to investigateWalk through who approves website uploads and how material is checked before public release.
IA.L1-b.1.v / Identification & authentication

05. Identity

Identify users, processes acting for users, and devices.

A practical question to investigateTrace a sample account or device identifier to its owner or approved operational purpose.
IA.L1-b.1.vi / Identification & authentication

06. Authentication

Verify identity before access is granted.

A practical question to investigateInspect sign-in settings and demonstrate an authorized sign-in without capturing passwords or tokens.
MP.L1-b.1.vii / Media protection

07. Media disposal

Sanitize or destroy media containing FCI before disposal or reuse.

A practical question to investigateReview the disposal process and a non-sensitive record showing how a retired device was handled.
PE.L1-b.1.viii / Physical protection

08. Physical access

Limit physical access to systems, equipment, and their operating environments.

A practical question to investigateWalk through the office or remote work location and identify how unauthorized access is prevented.
PE.L1-b.1.ix / Physical protection

09. Visitors & access devices

Escort and monitor visitors, maintain physical access logs, and manage access devices.

A practical question to investigateReview visitor handling, physical access records, and key or badge issuance and return.
SC.L1-b.1.x / System & communications protection

10. Communications boundaries

Monitor, control, and protect communications at external and key internal boundaries.

A practical question to investigateInspect the relevant boundary configurations and explain which traffic each boundary allows.
SC.L1-b.1.xi / System & communications protection

11. Public components

Separate public system components physically or logically from internal networks.

A practical question to investigateIdentify public components and demonstrate the network separation used for them.
SI.L1-b.1.xii / System & information integrity

12. Flaw correction

Identify, report, and correct system and information flaws promptly.

A practical question to investigateReview how an update or vulnerability moves from discovery to verified correction.
SI.L1-b.1.xiii / System & information integrity

13. Malicious code protection

Provide malicious code protection at appropriate locations.

A practical question to investigateCompare the endpoint inventory with current protection coverage and investigate gaps.
SI.L1-b.1.xiv / System & information integrity

14. Protection updates

Update malicious code protection mechanisms when releases become available.

A practical question to investigateInspect update configuration and current update health, including failures.
SI.L1-b.1.xv / System & information integrity

15. Periodic & real-time scans

Perform periodic system scans and real-time scans of files from external sources.

A practical question to investigateReview scan configuration and recent scan execution; verify real-time scanning is active.

These requirement summaries and practical questions are starting points. Read FAR 52.204-21 and the assessment procedures in 32 CFR 170.15 before drawing an assessment conclusion. Level 1 POA&Ms are not permitted for obtaining status.