Blue Heron Digital Services, LLC · IT, cloud, and security

CMMC Level 1 readiness

A free self-check of the 15 basic safeguarding requirements for federal contract information. This is readiness help, not a certification or an assessment, and not legal advice. No government affiliation. Blue Heron is not a C3PAO or certified CMMC assessor. The result is an estimate, not a guarantee.

Is system access limited to authorized users, processes, and devices?
Is access limited to the transactions each person is allowed to do?
Do you control connections to external systems?
Is information on public systems controlled?
Can you identify users, processes, and devices?
Do you verify those identities before granting access?
Is media with federal contract information wiped or destroyed before disposal or reuse?
Is physical access to systems and equipment limited to authorized people?
Are visitors escorted, with physical access logged and access devices controlled?
Are communications monitored and protected at the network boundary?
Are public-facing components separated from the internal network?
Are system flaws identified, reported, and corrected in a timely way?
Is there protection from malicious code?
Are malicious-code protections updated when new releases are available?
Do you scan systems periodically and scan files from outside as they arrive?