AffirmTrail is self-service documentation software based on user-supplied answers. It is not legal advice, not a C3PAO assessment, and not consulting. AffirmTrail never submits assessments or affirmations to SPRS on your behalf. Your Affirming Official remains solely responsible for the accuracy of any SPRS entry under applicable law, including the False Claims Act. TRNSFRM is a separate Cleveland and Columbus, Ohio cybersecurity and compliance partner (https://trnsfrm.tech).
Scope the systems before collecting screenshots
FAR 52.204-21 protects covered contractor information systems that process, store or transmit FCI. In a small shop, that can include office email, purchasing files, workstations and shop-floor devices depending on the information they handle. Inventory the actual workflow instead of assuming only the server room matters.
The evidence examples below are starting points, not an official assessment procedure or a guarantee of MET status. Match them to the current assessment objectives and the real system boundary. Keep sensitive artifacts in your own controlled repository and use the vault to record locations and explanations.
1. Limit system access to authorized users (AC.L1-b.1.i)
Current authorized-user list, approved account requests, terminated-user removal records and system access reviews.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
2. Limit access to permitted transactions and functions (AC.L1-b.1.ii)
Role matrix and permission screenshots showing that operators, purchasing staff and administrators receive only approved functions.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
3. Verify and control connections to external systems (AC.L1-b.1.iii)
Approved external connection inventory, remote access settings, vendor access approvals and documented restrictions on unmanaged devices.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
4. Control information posted on publicly accessible systems (AC.L1-b.1.iv)
Public website publication approvals and a review log showing that FCI is not posted to public systems.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
5. Identify users, processes, and devices (IA.L1-b.1.v)
Named user accounts, device inventory and service-account register linked to responsible owners.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
6. Authenticate users, processes, and devices (IA.L1-b.1.vi)
Authentication configuration, password policy, account activation approvals and evidence that access requires identity verification.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
7. Sanitize or destroy media containing FCI before disposal (MP.L1-b.1.vii)
Media disposal procedure, sanitization records and certificates of destruction for retired drives or printed FCI.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
8. Limit physical access to systems and equipment (PE.L1-b.1.viii)
Physical access list, locked-room inspection and documented access restrictions for servers, workstations and network equipment.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
9. Escort visitors, keep logs, and control physical access devices (PE.L1-b.1.ix)
Visitor sign-in records, escort assignments and key or badge issuance/revocation logs.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
10. Monitor and protect communications at system boundaries (SC.L1-b.1.x)
Firewall rule review, boundary diagram and logs demonstrating protected external connections and monitored communications.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
11. Separate publicly accessible subnetworks (SC.L1-b.1.xi)
Network diagram and configuration showing public-facing systems are separated from internal systems holding FCI.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
12. Identify, report, and correct system flaws timely (SI.L1-b.1.xii)
Patch inventory, vulnerability or flaw tickets, correction deadlines and records of completed remediation.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
13. Provide malicious code protection (SI.L1-b.1.xiii)
Endpoint protection deployment report showing coverage on systems at appropriate locations.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
14. Update malicious code protection mechanisms (SI.L1-b.1.xiv)
Protection engine and signature update settings, update logs and exceptions investigated by a responsible owner.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
15. Perform periodic and real-time scans (SI.L1-b.1.xv)
Scheduled scan settings, recent scan results and real-time scanning settings for files from external sources.
Assign a responsible owner, record the implementation as it actually operates and date the evidence review. If the safeguard is missing or only planned, keep the finding NOT MET or In Review until implementation and verification are complete. Do not paste secrets or FCI into a public support request.
Turn the checklist into an annual binder
Link each safeguard to its evidence, owner and implementation notes. Review changes in personnel, systems, providers and facility access before the annual assessment. A prior screenshot does not demonstrate that today’s accounts or devices are properly controlled.
Level 1 is binary and has no POA&M-based conditional status. Retain supporting artifacts for six years from the CMMC Status Date. The authorized official remains responsible for the annual affirmation in SPRS; AffirmTrail never makes that submission. If CUI is involved, stop and evaluate the Level 2 path instead.
Frequently asked questions
Are there 15 requirements in the FAR clause?
Yes. FAR 52.204-21(b)(1)(i) through (xv) lists 15 basic safeguarding requirements.
Is writing a policy enough to mark MET?
No. The safeguard must be implemented and supported by evidence satisfying applicable objectives.
Can a machine shop use Level 1 for CUI drawings?
No. Handling CUI requires analysis of Level 2 and the applicable contract requirements.