| Domain | Requirements | Objectives |
|---|---|---|
| Access Control (AC) | 4 | 19 |
| Identification and Authentication (IA) | 2 | 6 |
| Media Protection (MP) | 1 | 2 |
| Physical Protection (PE) | 2 | 10 |
| System and Communications Protection (SC) | 2 | 10 |
| System and Information Integrity (SI) | 4 | 12 |
| Total | 15 | 59 |
| Business Premium coverage | Definition | Service examples | Total inherited service mapping | The requirements it contributes to |
|---|---|---|---|---|
| Primary service | At least one enabled Microsoft service is a primary contributor to meeting the requirement. | Entra ID, Intune, Microsoft Purview, Azure Datacenter, Microsoft Defender XDR | 9 requirements (60%) | AC.L1-B.1.I, AC.L1-B.1.II, AC.L1-B.1.III, AC.L1-B.1.IV, IA.L1-B.1.V, IA.L1-B.1.VI, PE.L1-B.1.VIII, PE.L1-B.1.IX, SI.L1-B.1.XIV |
| Secondary service | At least one enabled Microsoft service supports meeting the requirement, but is not the primary contributor. | Microsoft Purview Information Protection, Microsoft Purview Data Loss Prevention | 5 requirements (33%) | MP.L1-B.1.VII, SC.L1-B.1.X, SI.L1-B.1.XII, SI.L1-B.1.XIII, SI.L1-B.1.XV |
| Available enabler | At least one Microsoft service can contribute to meeting the requirement, but it is not enabled and meaningful work is required outside Microsoft as well. | Network Security Groups, Azure Firewall | 1 requirement (7%) | SC.L1-B.1.XI |
| Requirement | What it means in plain terms | What to do | What not to do |
|---|---|---|---|
| AC.L1-B.1.I: Limit system access | You know who is allowed on your systems, and which devices can connect, and have policies and configurations in place so only those get on to the company network | Keep track of and put policies and configuration settings in place to limit access based on user and device | Allow shared accounts |
| AC.L1-B.1.II: Limit transactions and functions | People get access to the apps, functions, and data their job requires, not to everything | Assign roles or groups and set up policies and configurations to limit access based on those roles and responsibilities | Assign overly permissive defaults |
| AC.L1-B.1.III: Control external connections | You know which outside systems or devices can connect to your network, and have documented and enforced how they can do so | Identify what external systems are authorized to connect (and/or how and when) and implement controls such as policies, firewalls, and connection allow/deny lists to verify and limit those connections | Allow remote workers to use personal devices or cloud storage that isn't approved for FCI |
| AC.L1-B.1.IV: Control public information | Whatever you publish publicly gets reviewed first, so FCI never ends up on it | Designate and train individuals that can publicly post information and set up a review process | Mark as N/A if you have social media |
| Requirement | What it means in plain terms | What to do | What not to do |
|---|---|---|---|
| IA.L1-B.1.V: Identification | Every person, service account, and device has a distinct identity on your systems | Issue unique identifiers to authorized users and devices such as usernames and IP addresses | Use generic logins like "shopfloor" or "frontdesk" |
| IA.L1-B.1.VI: Authentication | Identities get verified before access is granted | Create and enforce policy requiring changing default credentials, minimum password length, etc. | Assume MFA is required |
| Requirement | What it means in plain terms | What to do | What not to do |
|---|---|---|---|
| MP.L1-B.1.VII: Media disposal | Drives, USB sticks, and paper with FCI get wiped, redacted, or destroyed before disposal or reuse | Define a sanitization or destruction method for every media type that holds FCI, including paper, and record each time you use it | Recycle, donate, or reassign a device with FCI without wiping it first |
| Requirement | What it means in plain terms | What to do | What not to do |
|---|---|---|---|
| PE.L1-B.1.VIII: Limit physical access | You know who is allowed into the spaces where FCI lives, and other people cannot get in | Limit and control physical access to specific individuals with locks, badges, and/or secured rooms | Rely on a locked front door alone |
| PE.L1-B.1.IX: Manage visitors and physical access | You don't let visitors wander, write down who came in, and keep track of keys and badges | Use logs, physical access points, and devices like badges to monitor and restrict access of employees and visitors | Giving out physical access devices without inventorying or managing them |
| Requirement | What it means in plain terms | What to do | What not to do |
|---|---|---|---|
| SC.L1-B.1.X: Boundary protection | You know where your network ends, and traffic crossing that edge is watched, controlled, and protected | Define your external boundary and your key internal boundaries, then monitor, control, and protect traffic at both | Think encryption creates logical separation |
| SC.L1-B.1.XI: Public-access system separation | Anything the public can reach does not sit on the same network as your internal systems | Identify publicly accessible system components, then place them on a separate subnet or DMZ | Assume this is a firewall question rather than an inventory question |
| Requirement | What it means in plain terms | What to do | What not to do |
|---|---|---|---|
| SI.L1-B.1.XII: Flaw remediation | You have decided how fast you patch, and you patch that fast | Write down timeframes for identifying, reporting, and correcting flaws, then set up policies and configurations to patch within them | Rely on automatic updates without documented timeframes or reviews |
| SI.L1-B.1.XIII: Malicious code protection | You decided where antivirus needs to run, and it runs there | Identify the locations that need malicious code protection and deploy it to all of them | Leave in-scope endpoints out of the deployment |
| SI.L1-B.1.XIV: Update malicious code protection | Your EDR or antivirus solution updates itself | Enable automatic updates and keep records | Build a manual process where an automated setting would do |
| SI.L1-B.1.XV: Periodic and real-time scans | You decided how often to scan, you scan that often, and files from outside get scanned as they arrive | Define a scan frequency, schedule scans to match it, and enable real-time scanning of files from external sources | Leave the frequency undefined and assume defaults count |
| Requirement at Level 2 | What's actually required at Level 1 |
|---|---|
| System Security Plan (SSP) | While the DoD's Level 1 Assessment Guide recommends an SSP as a best practice, it explicitly states it is not required to obtain a Level 1 self-assessment. |
| POA&M | Prohibited at Level 1 since all 15 requirements in FAR 52.204-21 must be MET. |
| C3PAO assessment | Only self-assessments are required at Level 1. |
| Multi-factor authentication | Mandated by an Identification and Authentication requirement for CMMC Level 2 and higher only (3.5.3 from NIST 800-171 Rev 2). |
| FIPS-validated encryption | Required by multiple Access Control and System and Communications Protection requirements at CMMC Level 2 and higher only. |
| Security awareness training | CMMC Level 1 does not contain any requirements or practices from the Awareness & Training domain, but security awareness training records and materials can be evidence for certain Level 1 requirements. |
| Incident response plan | CMMC Level 1 does not contain any requirements or practices from the Incident Response domain, but incident response procedures or tickets can be evidence for certain Level 1 requirements. |
| Risk assessment and vulnerability remediation | CMMC Level 1 does not contain any requirements or practices from the Risk Assessment domain, although risk assessment and remediation is foundational to Level 1 requirements. |
| Audit logging and review | CMMC Level 1 does not contain any requirements or practices from the Audit & Accountability domain, although audit logs can be evidence for certain Level 1 requirements. |