Free CMMC Level 1 self-check

Five quick questions, one for each family of the 15 basic safeguarding requirements in FAR 52.204-21(b)(1). Those 15 requirements are what a CMMC Level 1 (Self) assessment checks under 32 CFR Part 170. It takes about 2 minutes and needs no sign-up.

Educational only. This is not a CMMC assessment. It doesn't score you against the official assessment objectives and can't tell you whether you meet Level 1. BidDesk never performs, attests to or submits assessments, and never submits anything to SPRS for you. Your company's own senior official is responsible for the annual self-assessment and affirmation in SPRS. Not legal or compliance advice. Use the official sources: FAR 52.204-21, 32 CFR Part 170 and the DoD CIO CMMC site (Level 1 Scoping and Assessment Guides).

1. Access control

Do you limit who and what can use your company systems, and control what goes public?

Only authorized people, processes and devices can get into systems that hold federal contract information (FCI)
People can only do the tasks they're allowed to do
Connections to outside systems are checked and controlled
Nothing non-public is posted on public websites or social media

2. Identification & authentication

Does every user and device have its own identity, and is it verified before access?

Users, processes and devices are identified (no shared logins)
Identities are authenticated, for example by password, before access is allowed

3. Media & physical protection

Do you protect devices, papers and the office itself?

Drives, laptops and paper with FCI are wiped or destroyed before disposal or reuse
Physical access to systems and work areas is limited to authorized people
Visitors are escorted and their activity watched, physical access is logged, and keys, cards and locks are managed

4. System & communications protection

Is your network edge protected, and are public-facing systems kept separate?

Communications at your network's outer and key inner boundaries are monitored, controlled and protected (for example, a firewall)
Anything public-facing, like a website server, sits on a network separated from your internal systems

5. System & information integrity

Do you patch, run anti-malware and scan?

Flaws are found, reported and fixed on time (updates and patches)
Malware protection runs in the right places and updates when new releases come out
Systems get periodic scans, and files from outside sources are scanned when downloaded, opened or run

BidDesk · [email protected] · We count completions anonymously (answers only, no email or IP). Privacy · Terms