CMMC 2.0 Level 1

United States

6 domains

17 controls

Cybersecurity Maturity Model Certification version 2.0 Level 1 (Foundational). 17 practices mapped to FAR 52.204-21.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Access Control

4 controls

Controls in the Access Control domain of CMMC 2.0 Level 1 — 4 controls
Code	Title	Description
AC.L1-3.1.1	Authorized Access Control	Limit information system access to authorized users, processes acting on behalf of authorized users, and devices includi...
AC.L1-3.1.2	Transaction and Function Control	Limit information system access to the types of transactions and functions that authorized users are permitted to execut...
AC.L1-3.1.20	External Connections	Verify and control or limit connections to and use of external information systems.
AC.L1-3.1.22	Control Public Information	Control information posted or processed on publicly accessible information systems.

Identification and Authentication

2 controls

Controls in the Identification and Authentication domain of CMMC 2.0 Level 1 — 2 controls
Code	Title	Description
IA.L1-3.5.1	Identification	Identify information system users, processes acting on behalf of users, and devices.
IA.L1-3.5.2	Authentication	Authenticate or verify the identities of users, processes, or devices as a prerequisite to allowing access to organizati...

Media Protection

1 controls

Controls in the Media Protection domain of CMMC 2.0 Level 1 — 1 controls
Code	Title	Description
MP.L1-3.8.3	Media Disposal	Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reus...

Physical Protection

4 controls

Controls in the Physical Protection domain of CMMC 2.0 Level 1 — 4 controls
Code	Title	Description
PE.L1-3.10.1	Limit Physical Access	Limit physical access to organizational information systems, equipment, and the respective operating environments to aut...
PE.L1-3.10.3	Escort Visitors	Escort visitors and monitor visitor activity.
PE.L1-3.10.4	Physical Access Logs	Maintain audit logs of physical access.
PE.L1-3.10.5	Manage Physical Access	Control and manage physical access devices such as keys, locks, combinations, and card readers.

System and Communications Protection

2 controls

Controls in the System and Communications Protection domain of CMMC 2.0 Level 1 — 2 controls
Code	Title	Description
SC.L1-3.13.1	Boundary Protection	Monitor, control, and protect organizational communications at the external boundaries and key internal boundaries of th...
SC.L1-3.13.5	Public-Access System Separation	Implement subnetworks for publicly accessible system components that are physically or logically separated from internal...

System and Information Integrity

4 controls

Controls in the System and Information Integrity domain of CMMC 2.0 Level 1 — 4 controls
Code	Title	Description
SI.L1-3.14.1	Flaw Remediation	Identify, report, and correct information and information system flaws in a timely manner.
SI.L1-3.14.2	Malicious Code Protection	Provide protection from malicious code at appropriate locations within organizational information systems.
SI.L1-3.14.4	Update Malicious Code Protection	Update malicious code protection mechanisms when new releases are available.
SI.L1-3.14.5	System and File Scanning	Perform periodic scans of the information system and real-time scans of files from external sources as files are downloa...

Frequently Asked Questions

What is CMMC 2.0 Level 1?

CMMC 2.0 Level 1 is a compliance framework from United States with 6 domains and 17 controls. Cybersecurity Maturity Model Certification version 2.0 Level 1 (Foundational). 17 practices mapped to FAR 52.204-21. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does CMMC 2.0 Level 1 have?

CMMC 2.0 Level 1 has 17 controls organised across 6 domains. The largest domains are Access Control (4 controls), Physical Protection (4 controls), System and Information Integrity (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does CMMC 2.0 Level 1 map to?

CMMC 2.0 Level 1 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with CMMC 2.0 Level 1 compliance?

Start your CMMC 2.0 Level 1 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CMMC 2.0 Level 1 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 17 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 769 frameworks.

Get Started Free →

Free forever — no credit card required