CMMC 2.0 Level 1 (Foundational)
Version: CMMC 2.0 (32 CFR Part 170, effective 2024-12-16)
The DoD Cybersecurity Maturity Model Certification level for contractors that handle only Federal Contract Information (FCI). Its 15 practices mirror the basic safeguarding requirements of FAR 52.204-21(b)(1) and are met through an annual self-assessment and affirmation.
Where we stand
Controls
70%
Evidence
10%
Policies
10%
10 of 15 clauses mapped to adopted controls
As of (just now)
Percentages are over clauses mapped to at least one adopted control. Unmapped clauses are listed below and never count as passing. A known gap is a clause that applies to us and that no control covers yet.
Clause-by-clause readiness
| Clause | Title | Controls | Evidence | Policies | Last tested |
|---|---|---|---|---|---|
| AC Access Control | |||||
| AC.L1-b.1.i | Authorized Access Control Controls: IAM-05, IAM-07, IAM-09 | Not passing | Not current | Not approved | (29 d ago) |
| AC.L1-b.1.ii | Transaction and Function Control Controls: IAM-04, IAM-05 | Passing | Not current | Not approved | (29 d ago) |
| AC.L1-b.1.iii | External Connections Controls: VEND-03 | Passing | Not current | Not approved | Not yet |
| AC.L1-b.1.iv | Control Public Information Controls: DATA-01 | Passing | Not current | Not approved | Not yet |
| IA Identification and Authentication | |||||
| IA.L1-b.1.v | Identification Controls: IAM-01 | Passing | Current | Not approved | (29 d ago) |
| IA.L1-b.1.vi | Authentication Controls: IAM-01, IAM-02, IAM-08 | Not passing | Not current | Not approved | (8 h ago) |
| MP Media Protection | |||||
| MP.L1-b.1.vii | Media Disposal Controls: DATA-05 | Passing | Not current | Not approved | Not yet |
| PE Physical Protection | |||||
| PE.L1-b.1.viii | Limit Physical Access Controls: PHYS-01 | Passing | Not current | Not approved | Not yet |
| PE.L1-b.1.ix | Manage Visitors and Physical Access | Unmapped | Unmapped | Unmapped | Not yet |
| SC System and Communications Protection | |||||
| SC.L1-b.1.x | Boundary Protection Controls: CLOUD-03 | Passing | Not current | Approved | Not yet |
| SC.L1-b.1.xi | Public-Access System Separation | Unmapped | Unmapped | Unmapped | Not yet |
| SI System and Information Integrity | |||||
| SI.L1-b.1.xii | Flaw Remediation Controls: CLOUD-05, IT-03, MON-06 | Not passing | Not current | Not approved | (8 h ago) |
| SI.L1-b.1.xiii | Malicious Code Protection | Unmapped | Unmapped | Unmapped | Not yet |
| SI.L1-b.1.xiv | Update Malicious Code Protection | Unmapped | Unmapped | Unmapped | Not yet |
| SI.L1-b.1.xv | System and File Scanning | Unmapped | Unmapped | Unmapped | Not yet |