Ask how many requirements CMMC Level 1 has and you will get two confident answers. The rule, the Level 1 Assessment Guide and the Scoping Guide say fifteen. The CCP exam outline, the older CMMC model documents and most training courses say seventeen. Both are right, because they count the same safeguards two different ways, and the difference is one paragraph of the FAR clause that NIST wrote as three requirements. This article sets out the fifteen, the seventeen, the table in the rule that joins them, and the identifiers you will meet for each on the exam.
Fifteen: the FAR clause
CMMC Level 1 is FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. The rule says so in its model section: "CMMC Levels 1–3 utilize the safeguarding requirements and security requirements specified in 48 CFR 52.204–21 (for Level 1)", and its definition of the Level 1 requirements points at "48 CFR 52.204–21(b)(1)(i) through (xv)". The clause's paragraph (b)(1) lists fifteen numbered safeguards, (i) to (xv), that "The Contractor shall apply" to protect covered contractor information systems. Fifteen paragraphs, fifteen requirements.
The Level 1 Assessment Guide numbers its requirements after those paragraphs, in the rule's identifier format DD.L#-REQ, where DD is the domain and REQ is the source's own number. So the first safeguard, paragraph (b)(1)(i), is AC.L1-b.1.i, Authorized Access Control; the ninth, (b)(1)(ix), is PE.L1-b.1.ix, Manage Visitors & Physical Access; the fifteenth, (b)(1)(xv), is SI.L1-b.1.xv, System & File Scanning.
Seventeen: the NIST numbering
NIST SP 800-171 covers the same ground in its own requirements, numbered 3.1.1, 3.1.2 and so on by family. When the CMMC model was first written, Level 1 was expressed in NIST's numbers, and the exam outline still is: Domain 4 lists the practices as AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L1-3.1.22, IA.L1-3.5.1, IA.L1-3.5.2, MP.L1-3.8.3, PE.L1-3.10.1, PE.L1-3.10.3, PE.L1-3.10.4, PE.L1-3.10.5, SC.L1-3.13.1, SC.L1-3.13.5, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4 and SI.L1-3.14.5. That is seventeen.
The extra two come from one FAR paragraph. Safeguard (ix) reads: "Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices." NIST wrote those three phrases as three requirements, 3.10.3, 3.10.4 and 3.10.5, and the outline follows NIST. The rule's mapping table carries a footnote on exactly this: the clause's requirements were broken apart by phrase when NIST SP 800-171 Revision 2 was developed.
The table that joins them
The rule needs both numberings, because a Level 1 self-assessment uses NIST's assessment objectives: it "must be performed using the objectives defined in NIST SP 800–171A Jun2018" for "the security requirement that maps to the CMMC Level 1 security requirement", and "In any case where an objective addresses CUI, FCI should be substituted for CUI in the objective." The map is Table 2 to section 170.15, reproduced here with the names the Level 1 guide and the outline give each requirement.
| FAR paragraph | Level 1 guide | NIST SP 800-171A | Exam outline |
|---|---|---|---|
| (b)(1)(i) | AC.L1-b.1.i Authorized Access Control | 3.1.1 | AC.L1-3.1.1 Authorized Access Control |
| (b)(1)(ii) | AC.L1-b.1.ii Transaction & Function Control | 3.1.2 | AC.L1-3.1.2 Transaction and Function Control |
| (b)(1)(iii) | AC.L1-b.1.iii External Connections | 3.1.20 | AC.L1-3.1.20 External Connections |
| (b)(1)(iv) | AC.L1-b.1.iv Control Public Information | 3.1.22 | AC.L1-3.1.22 Control Public Information |
| (b)(1)(v) | IA.L1-b.1.v Identification | 3.5.1 | IA.L1-3.5.1 Identification |
| (b)(1)(vi) | IA.L1-b.1.vi Authentication | 3.5.2 | IA.L1-3.5.2 Authentication |
| (b)(1)(vii) | MP.L1-b.1.vii Media Disposal | 3.8.3 | MP.L1-3.8.3 Media Disposal |
| (b)(1)(viii) | PE.L1-b.1.viii Limit Physical Access | 3.10.1 | PE.L1-3.10.1 Limit Physical Access |
| (b)(1)(ix), first phrase | PE.L1-b.1.ix Manage Visitors & Physical Access | 3.10.3 | PE.L1-3.10.3 Escort Visitors |
| (b)(1)(ix), second phrase | PE.L1-b.1.ix Manage Visitors & Physical Access | 3.10.4 | PE.L1-3.10.4 Physical Access Logs |
| (b)(1)(ix), third phrase | PE.L1-b.1.ix Manage Visitors & Physical Access | 3.10.5 | PE.L1-3.10.5 Manage Physical Access |
| (b)(1)(x) | SC.L1-b.1.x Boundary Protection | 3.13.1 | SC.L1-3.13.1 Boundary Protection |
| (b)(1)(xi) | SC.L1-b.1.xi Public-Access System Separation | 3.13.5 | SC.L1-3.13.5 Public-Access System Separation |
| (b)(1)(xii) | SI.L1-b.1.xii Flaw Remediation | 3.14.1 | SI.L1-3.14.1 Flaw Remediation |
| (b)(1)(xiii) | SI.L1-b.1.xiii Malicious Code Protection | 3.14.2 | SI.L1-3.14.2 Malicious Code Protection |
| (b)(1)(xiv) | SI.L1-b.1.xiv Update Malicious Code Protection | 3.14.4 | SI.L1-3.14.4 Update Malicious Code Protection |
| (b)(1)(xv) | SI.L1-b.1.xv System & File Scanning | 3.14.5 | SI.L1-3.14.5 System and File Scanning |
Six of the fourteen domains hold Level 1 requirements: Access Control, Identification and Authentication, Media Protection, Physical Protection, System and Communications Protection, and System and Information Integrity. The other eight begin at Level 2.
What the exam does with it
The outline's Domain 4 task is explicit that the Level 1 practices are the floor of the exam: "At a minimum CCP candidate must be evaluated on CMMC L1 Practices during CCP exam." Those practices are listed by their NIST numbers, so expect AC.L1-3.1.1 in a stem. But the document you study them from, the Level 1 Assessment Guide, prints AC.L1-b.1.i, and a question built on the guide's words may use it. Learn both columns of the table, and learn the one place they are not one to one: a question about escorting visitors, physical access logs or physical access devices is about PE.L1-b.1.ix in the guide and about three different practices in the outline.
The count matters in two other ways on the exam. First, the Level 1 self-assessment is "scored as MET or NOT MET in their entirety": one NOT MET requirement, whichever count you use, fails the whole thing, and no POA&M is allowed at Level 1. Second, the rule's Level 1 scoping and the rule's Level 1 procedures speak of fifteen, so a question that asks what the rule or the guide says gets fifteen, and a question about the outline or the model's practices gets seventeen.
Study them one at a time
The seventeen practices are the center of the exam, and each has its own lesson on this site, in the outline's order: AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L1-3.1.22, IA.L1-3.5.1, IA.L1-3.5.2, MP.L1-3.8.3, PE.L1-3.10.1, PE.L1-3.10.3, PE.L1-3.10.4, PE.L1-3.10.5, SC.L1-3.13.1, SC.L1-3.13.5, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4 and SI.L1-3.14.5. Each lesson gives the requirement's statement, its objectives, its methods and objects, and a question set in the exam's format. The six domains puts them in the context of the whole outline.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.