CMMC Level 1 Checklist: Prepare for 2026 Compliance
If you're a Department of Defense contractor, there's a good chance CMMC language is already showing up in contracts, subcontractor flow-downs, or prime contractor questionnaires. That usually starts the same way. An operations leader asks whether the company is “already compliant,” IT starts hunting for policies and screenshots, and someone realizes Federal Contract Information sits in more places than anyone expected. CMMC Level 1 is the entry point. It applies to organizations handling Federal Contract Information, and the official Department of Defense assessment guide defines it around 15 basic safeguarding requirements drawn from FAR 52.204-21 in the DoD CMMC Level 1 Assessment Guide. It isn't a broad governance exercise. It's a focused, practical baseline. A useful CMMC Level 1 checklist shouldn't just restate every practice. It should help a contractor close the gaps that most often create trouble during self-assessment and annual affirmation. The seven controls below do that. They center on access, identity, physical security, network boundaries, patching, malware protection, and media disposal. Each section uses a compliance-in-a-box approach. What to do. What good evidence looks like. How to verify it. What usually goes wrong. For small and midsize contractors, that's the difference between saying controls exist and being prepared to prove they work. 1. AC.1.001 Limit Information System Access to Authorized Users Access control fails in ordinary ways. A former employee still has Microsoft 365 access. A shared workstation auto-logs in. A vendor remote support account never expires. Those aren't exotic security failures. They're everyday admin shortcuts that turn into Level 1 findings. For this control, the organization needs to define who may access systems that store, process, or transmit FCI, then enforce that access. In plain language, not everyone gets a key to every door. An estimator may need access to a contract folder, but not to accounting systems. A help desk technician may need temporary admin rights, but not standing access to sensitive file shares. What done right looks like Strong evidence is usually simple and operational: Named user access lists: A current roster of authorized users for systems with FCI. Role-based permissions: Microsoft 365 groups, Active Directory security groups, or line-of-business system roles aligned to job function. Joiner mover leaver process: HR and IT records showing access is granted, changed, and removed in a controlled way. Restricted remote access: VPN, remote support, and admin portals limited to approved users. A manufacturer bidding on DoD work might keep FCI in SharePoint, Outlook, and an ERP system. Done right, the contract manager, estimator, and approved program staff can access those locations. The warehouse supervisor doesn't have that access unless there's a business need. Practical rule: If the company can't explain why a person has access to FCI, that access probably shouldn't exist. Verification should include a real access review, not a policy-only review. Pull a user list from Microsoft 365, file servers, firewall VPN users, and any business application that touches FCI. Then compare that list to current staff and job responsibilities. Organizations that want a stronger operational model can also borrow from established access control best practices and pair logical access with physical controls such as Wisenet Security access control solutions. Common mistakes are predictable. Shared folders open to “Everyone.” Old admin accounts. Contractors left active after a project ends. Access requests approved in email but never documented anywhere central. 2. IA.1.076 Identify Information System Users Accountability starts with one rule. Every action on a system should trace back to a specific user, process, or device. When that chain breaks, investigation becomes guesswork. Shared accounts are the usual problem. A team uses one login for a production workstation. A generic mailbox has direct sign-in rights. A field laptop is passed around under the same local account. That may feel convenient, but it defeats traceability. Compliance in a practical environment What works is unique identity everywhere FCI touches the environment. In most small organizations, that means each employee has an individual Microsoft 365 or Active Directory account, individual VPN access, and an individual login for line-of-business applications. If a service account exists, it should have a documented purpose, limited scope, and controlled credentials. Evidence should make that uniqueness obvious: Directory records: Active Directory, Entra ID, Google Workspace, or application user lists showing named accounts. System logs: Sign-in logs tied to individual accounts. Account standards: A naming convention and documented process for creating and disabling accounts. No shared credentials for critical systems: Especially email, file storage, VPN, and admin platforms. A practical test helps. Ask three questions. Can the company tell who accessed a contract file? Can it tell which account logged into the firewall? Can it identify which technician used remote admin tools on a server? If the answer is “not really,” this control isn't mature enough. When a team says, “Everyone uses the same account, but we trust each other,” that's not identity management. That's a blind spot. A common exception involves shared inboxes like contracts@ or bids@. Those can still work if users access them through their own named account and not with a shared password. The system should still record who did what. The trade-off is convenience versus accountability. Level 1 clearly favors accountability. If a process depends on shared credentials, that process needs redesign. 3. PE.1.131 Limit Physical Access to Systems A locked server room still matters. So does a reception process, badge control, and a clean way to secure laptops in offices and branch locations. Physical security gets overlooked because many teams think “cyber” only means software. Level 1 doesn't make that mistake. An organization needs to restrict physical access to systems that handle FCI. In a small office, that may mean locking networking gear in a closet, placing servers in a badge-controlled room, securing file cabinets containing printed contract documents, and making sure visitors aren't left wandering near workstations. Evidence that actually holds up Good evidence usually includes: Door controls: Badge access, keys, or coded locks for server rooms and telecom closets. Visitor procedures: Sign-in sheets, escorts, and reception practices.