The 15 CMMC Level 1 safeguards, explained in plain language

Access and identity: requirements 1 through 6

Ask six distinct questions: who or what may access the system; which functions each authorized identity may use; how connections to external systems are controlled; how public-facing information is reviewed; how users, processes, and devices are identified; and how identities are authenticated.

These questions overlap operationally, but one answer does not automatically cover all six. An account list helps explain authorization; it does not by itself demonstrate appropriate permissions or control over an external connection. For a practical review, trace a new employee, a privileged administrator, and an outside collaborator through the relevant systems. Note who approves each kind of access and how it is removed.

Start with the CMMC Level 1 introduction if you need context on FCI, annual self-assessment, and SPRS before working through individual safeguards.

Media and physical access: requirements 7 through 9

The next group addresses sanitizing or destroying FCI-bearing media before disposal or reuse, restricting physical access to systems and their operating environments, and managing visitors, access records, and physical access devices.

Think beyond the main office door. Laptops, paper output, removable drives, shared offices, and equipment sent for service all deserve a clear handling decision. A useful internal exercise is to select one retired device and one recent visitor and ask the responsible person to explain what happened. This is a suggested review technique, not a prescribed government sampling method. Follow the applicable assessment objectives when reaching the formal result.

Boundaries and system integrity: requirements 10 through 15

The final group addresses protecting communications at relevant boundaries, separating publicly accessible components from internal networks, identifying and correcting flaws, placing malicious-code protection appropriately, updating that protection, and performing the required scans.

Review the actual configuration and operational records with the IT owner. A firewall invoice does not explain its rules, and an installed security agent does not show whether it is reporting or updated. Ask how exceptions are detected and corrected. Where the clause uses terms such as timely or periodic, explain the organization’s approach and confirm it against the applicable assessment criteria rather than inventing a universal deadline.

Turn the summary into a working review

Create a row for each safeguard with the implementation, responsible person, affected systems, and supporting records. Link to the full requirement and relevant objectives so nobody treats this article as the assessment standard. Keep separate fields for observed facts, open questions, and remediation.

Use the readiness checklist to organize the overall effort, then examine the details. Level 1 does not permit a POA&M as the basis for leaving a requirement unmet. A partially completed list is a useful project record, but it is not a completed Level 1 result.