CMMC Level 1 self-assessment: what are the 15 requirements of FAR 52.204-21?

CMMC Level 1 is composed of the 15 security requirements listed in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. These requirements are numbered (i) through (xv) within the clause itself. They include things like limiting information system access to authorized users, controlling information posted on publicly accessible information systems, and ensuring physical protection of information systems. Other requirements cover media sanitization, system monitoring, and identifying and reporting malicious content. You also need to address periodically updating malware protection, conducting system backups, and managing system and network connections. The remaining items focus on identifying system users, requiring multi-factor authentication for remote access, and promptly reporting cyber incidents. Understanding these 15 points is the first step in preparing for a CMMC Level 1 self-assessment.