The 15 Level 1 requirements
- AC.L1-b.1.i — Authorized Access Control (FAR 52.204-21(b)(1)(i); maps to 3.1.1)
- AC.L1-b.1.ii — Access Enforcement (FAR 52.204-21(b)(1)(ii); maps to 3.1.2)
- AC.L1-b.1.iii — External Connections (FAR 52.204-21(b)(1)(iii); maps to 3.1.20)
- AC.L1-b.1.iv — Control Publicly Posted Information (FAR 52.204-21(b)(1)(iv); maps to 3.1.22)
- IA.L1-b.1.v — Identification (FAR 52.204-21(b)(1)(v); maps to 3.5.1)
- IA.L1-b.1.vi — Authentication (FAR 52.204-21(b)(1)(vi); maps to 3.5.2)
- MP.L1-b.1.vii — Media Sanitization (FAR 52.204-21(b)(1)(vii); maps to 3.8.3)
- PE.L1-b.1.viii — Limit Physical Access (FAR 52.204-21(b)(1)(viii); maps to 3.10.1)
- PE.L1-b.1.ix — Visitor Escort, Physical Access Logs & Access Devices (FAR 52.204-21(b)(1)(ix); maps to 3.10.3, 3.10.4, 3.10.5)
- SC.L1-b.1.x — Boundary Protection (FAR 52.204-21(b)(1)(x); maps to 3.13.1)
- SC.L1-b.1.xi — Subnetwork Separation (FAR 52.204-21(b)(1)(xi); maps to 3.13.5)
- SI.L1-b.1.xii — Flaw Remediation (FAR 52.204-21(b)(1)(xii); maps to 3.14.1)
- SI.L1-b.1.xiii — Malicious Code Protection (FAR 52.204-21(b)(1)(xiii); maps to 3.14.2)
- SI.L1-b.1.xiv — Malicious Code Updates (FAR 52.204-21(b)(1)(xiv); maps to 3.14.4)
- SI.L1-b.1.xv — System & File Scanning (FAR 52.204-21(b)(1)(xv); maps to 3.14.5)
How Level 1 is assessed
Level 1 is an annual self-assessment: an affirming official attests that all 15 requirements are met, and the result is submitted in SPRS. There is no POA&M at Level 1 — every requirement must be fully met at the time of attestation.