CMMC Level 1
Domain AC: Access Control
Identify and control who and what has access to your systems.
- Authorized Access Control: Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
- Transaction & Function Control: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- External Connections: Verify and control/limit connections to and use of external systems.
- Control Public Information: Control information posted or processed on publicly accessible systems.
Domain IA: Identification and Authentication
Closely tied to Access Control, this Domain contains practices to ensure that only the person assigned to a user account is the one using it.
Domain MP: Media Protection
Safeguard data stored on removable media, such as a USB drive, or even on paper.
Domain PE: Physical Protection
You must protect physical access to your facility and data, as a breach of physical security can be used to quickly override logical security practices.
- Limit Physical Access: Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
- Escort Visitors: Escort visitors and monitor visitor activity.
- Physical Access Logs: Maintain audit logs of physical access.
- Manage Physical Access: Control and manage physical access devices.
Domain SC: System and Communications Protection
Secure your network boundaries and communications.
- Boundary Protection: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- Public-Access System Separation: Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
Domain SI: System and Information Integrity
Protect your network from malicious code execution by applying security patches in a timely manner and using anti-malware software.
- Flaw Remediation: Identify, report, and correct system flaws in a timely manner.
- Malicious Code Protection: Provide protection from malicious code at designated locations within organizational systems.
- Update Malicious Code Protection: Update malicious code protection mechanisms when new releases are available.
- System & File Scanning: Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.