CMMC Level 1: the basic safeguards defense suppliers need

What is cmmc level 1?

The Cybersecurity Maturity Model Certification (CMMC) is a program designed to ensure that defense contractors protect sensitive information. For many small businesses in the supply chain, cmmc level 1 is the starting point. It focuses on 'Basic Cyber Hygiene.' If your company handles Federal Contract Information (FCI)—which is information provided by the government under a contract that is not intended for public release—you must meet Level 1 requirements.

Level 1 is not about protecting top-secret data; it is about the fundamental steps every business should take to secure their computers and networks. By meeting these standards, you show the Department of Defense (DoD) that you are a reliable partner that takes security seriously.

The 15 basic security requirements

CMMC Level 1 is made up of 15 security requirements. These come directly from Federal Acquisition Regulation (FAR) clause 52.204-21. These rules are divided into six 'domains' or categories. Most businesses already do some of these things, but Level 1 requires you to do all of them, all the time.

• Limit system access to authorized users (Access Control).
• Verify the identities of all users and devices (Identification and Authentication).
• Sanitize or destroy information system media before disposal (Media Protection).
• Limit physical access to systems and equipment to authorized people (Physical Protection).
• Conduct periodic scans and updates to protect against malicious code (System and Information Integrity).
• Monitor and protect your communications at the external boundaries of your network (System and Communications Protection).

Access control and authentication

A big part of cmmc level 1 is knowing exactly who is on your network. You must give each employee their own username and password. You should never share logins. Furthermore, you must limit what each user can do. For example, a person in the shipping department likely does not need access to the financial records or the contract drafting systems. This 'least privilege' approach reduces the risk if one account is compromised.

Physical security for defense contractors

You must also protect the physical equipment that stores FCI. This means locking your office doors, using badge readers, or having a visitor log. If you have servers or network gear, they should be in a locked room or cage. You should also ensure that people who are not authorized to see FCI, like delivery drivers or cleaning crews, are escorted when they are in sensitive areas.

Maintaining your systems

CMMC Level 1 requires you to keep your software up to date. Hackers love to use old bugs in software that has not been patched. You must use antivirus software and keep it updated. You should also have a process for regularly checking your systems for signs of trouble, such as strange login attempts or files that have been changed without a reason.

The self-assessment process

Unlike higher levels of CMMC, Level 1 typically allows for a self-assessment. This means a senior official at your company must sign off every year, stating that the company meets all 15 requirements. This is a legal certification. If you say you are compliant when you are not, you could face serious legal trouble, including being banned from government contracts. It is vital to be honest and thorough in your assessment.