CMMC Level 1Readiness check

Do only authorized users, processes and devices have access to systems that hold federal contract information (FCI)?

Is each user limited to the functions and transactions they are permitted to perform?

Do you verify, control and limit connections to and use of outside systems?

Do you control what FCI is posted or processed on publicly accessible systems, such as your website?

Does every user, process and device have a unique identity?

Do you verify those identities, for example with passwords or multi-factor authentication, before granting access?

Do you sanitize or destroy media that holds FCI before it is disposed of or reused?

Is physical access to systems, equipment and work areas limited to authorized people?

Do you escort visitors, monitor their activity, keep physical access logs and manage keys and badges?

Do you monitor, control and protect communications at your network boundaries, for example with a firewall?

Are publicly accessible systems separated from your internal network?

Do you identify, report and fix system flaws in a timely way, including regular patching?

Is malicious code protection, such as antivirus, in place where it is needed?

Is malicious code protection kept up to date?

Do you run periodic system scans and scan files from outside sources as they are downloaded, opened or executed?