CMMC

The Cybersecurity Maturity Model Certification (CMMC) Program ties specific cybersecurity requirements to the type of unclassified information a contractor processes, stores, or transmits, and then validates implementation through an assessment approach defined by the required CMMC level.

CMMC Level 1 Requires 17 Safeguards 15 Controls

The official FAR clause lists 15 safeguards, but CMMC documentation often references 17 practices. Here is why: 

CMMC inherited the DoD’s earlier mapping from the DFARS 252.204-21 “Basic Safeguarding” table, where two of the FAR requirements were split into multiple CMMC practice IDs during modeling. They are not additional requirements—just a structural carryover from the original DoD-to-NIST mapping exercise.