FAR 52.204-21: the 15 safeguards for CMMC Level 1, a self-check
FAR 52.204-21: the 15 safeguards for CMMC Level 1, a self-check
If you run a small defense shop, you may already have a firewall, antivirus, and passwords in place. The remaining work is often writing down what you do and gathering proof that it happens.
After 30 years in cybersecurity, I've found the fastest way to start is a plain checklist: one row per requirement, a yes or no answer, and a note about the evidence you can point to. This post gives you that checklist for the 15 basic safeguarding requirements in FAR 52.204-21, which are also the 15 CMMC Level 1 requirements.
Where things stand (as of October 2026)
DoD suspended the CMMC Phase 2 transition on July 13, 2026, and no new date has been announced. For background, see what the Phase 2 suspension means for defense contractors.
Level 1 is unchanged. When a contract requires CMMC Level 1 (Self), your company completes an annual self-assessment, and a senior official posts an annual affirmation in SPRS. POA&Ms are not permitted at Level 1, so each requirement needs to be in place when you affirm.
What Level 1 covers
FAR 52.204-21(b)(1) lists 15 basic safeguarding requirements for company systems that handle Federal Contract Information (FCI). 32 CFR 170.15 lists the same 15 requirements as CMMC Level 1, numbered AC.L1-b.1.i through SI.L1-b.1.xv, across six domains:
- Access Control (AC): 4
- Identification and Authentication (IA): 2
- Media Protection (MP): 1
- Physical Protection (PE): 2
- System and Communications Protection (SC): 2
- System and Information Integrity (SI): 4
Requirement (ix) covers three related physical protection tasks. The table below checks it in three parts (3.10.3, 3.10.4, and 3.10.5), the same way the 32 CFR 170.15 table does.
How to use this self-check
- Copy the table into a document or spreadsheet you can edit.
- For each row, answer Yes only if the safeguard is in place today on every system that stores, processes, or transmits FCI.
- In "Evidence we have," name the proof: a written policy, a screenshot, a log, a configuration export, or a visitor sign-in sheet.
- Treat every No as a gap to close before your senior official affirms in SPRS.
- Repeat the check at least once a year, since the self-assessment and affirmation are annual.
The 15-requirement self-check
| # | FAR 52.204-21(b)(1) in plain words | CMMC L1 requirement | Met? | Evidence we have |
|---|---|---|---|---|
| (i) | Only approved people, processes, and devices can get into company systems. | AC.L1-b.1.i (3.1.1) | Yes / No | |
| (ii) | Each user can do only the tasks their job needs. | AC.L1-b.1.ii (3.1.2) | Yes / No | |
| (iii) | Connections to outside systems, including personal devices and cloud services, are checked and limited. | AC.L1-b.1.iii (3.1.20) | Yes / No | |
| (iv) | Someone reviews what goes on public websites and social accounts so FCI stays off them. | AC.L1-b.1.iv (3.1.22) | Yes / No | |
| (v) | Every user, process, and device has its own ID. | IA.L1-b.1.v (3.5.1) | Yes / No | |
| (vi) | Identities are verified, for example with a password, before access is allowed. | IA.L1-b.1.vi (3.5.2) | Yes / No | |
| (vii) | Drives, paper, and other media with FCI are wiped or destroyed before disposal or reuse. | MP.L1-b.1.vii (3.8.3) | Yes / No | |
| (viii) | Only authorized people can physically reach systems, equipment, and work areas. | PE.L1-b.1.viii (3.10.1) | Yes / No | |
| (ix) | Visitors are escorted and watched. | PE.L1-b.1.ix (3.10.3) | Yes / No | |
| (ix) | A log of physical access is kept. | PE.L1-b.1.ix (3.10.4) | Yes / No | |
| (ix) | Keys, badges, and lock codes are controlled and tracked. | PE.L1-b.1.ix (3.10.5) | Yes / No | |
| (x) | Traffic in and out of the network is monitored and controlled at its edges, for example with a firewall. | SC.L1-b.1.x (3.13.1) | Yes / No | |
| (xi) | Anything public facing, like a web server, sits on a network segment apart from internal systems. | SC.L1-b.1.xi (3.13.5) | Yes / No | |
| (xii) | Software flaws are found, reported, and patched on time. | SI.L1-b.1.xii (3.14.1) | Yes / No | |
| (xiii) | Anti-malware protection runs in the right places. | SI.L1-b.1.xiii (3.14.2) | Yes / No | |
| (xiv) | Anti-malware updates are installed when released. | SI.L1-b.1.xiv (3.14.4) | Yes / No | |
| (xv) | Systems get periodic scans, and files from outside sources are scanned when downloaded, opened, or run. | SI.L1-b.1.xv (3.14.5) | Yes / No |
Requirement count: 15 (AC 4, IA 2, MP 1, PE 2, SC 2, SI 4). The number in parentheses is the matching NIST SP 800-171 Rev 2 requirement. Circle or highlight your answer in the "Met?" column.
This checklist is a planning aid. Your annual self-assessment and SPRS affirmation are your company's own representations to the government.
Sources
- DoW CIO, About CMMC
- FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems
- 32 CFR 170.15, CMMC Level 1 self-assessment and affirmation requirements (eCFR)
Your next step
If this self-check turned up a few No answers or empty evidence cells, I'd start with the written side. Our Complete CMMC Level 1 Policy Pack gives you 12 written policies plus an SSPP template for $299, so you have documents to point to as you work through the table. You can see what's included on our CMMC Level 1 Policy Packs page. The pack has no separate System and Communications Protection policy, so document rows (x) and (xi) with your firewall settings and network diagram.
If your company also handles Controlled Unclassified Information (CUI) and is working toward NIST SP 800-171, our free SPRS calculator can help you estimate that score.
Questions about a specific row? Contact us.
About the Author
The TalonPoint Security team brings 30 years of cybersecurity expertise with CISM and CISSP certifications. As a practicing Chief Information Officer, our founder implements the security policies and compliance frameworks we write about. TalonPoint Security was founded to make professional CMMC compliance accessible to small and medium-sized defense contractors.