CMMC Level 1 readiness scorecard

Does every person who uses company computers or email have their own named account, and are accounts shut off promptly when someone leaves?

Do regular employees use standard (non-admin) accounts, with admin rights limited to the one or two people who need them?

Do you have rules for using personal phones, home computers, or outside cloud services (personal Gmail, Dropbox) with contract information?

Is a specific person responsible for reviewing what goes on your website and social media so contract details never get posted publicly?

Could you produce, today, a current list of every user account and every computer or device that touches contract information?

Does every account require a real password, and have the factory-default passwords on routers, printers, and cameras been changed?

When old computers, hard drives, USB sticks, or printed contract documents are thrown away or reused, are they wiped or shredded first?

Are offices, network closets, and computers holding contract information behind locked doors or otherwise restricted to authorized staff?

Are visitors signed in and escorted, and do you keep track of who has keys, badges, or door codes?

Is your internet connection protected by a business-grade firewall that you or your IT provider actually manage, rather than the ISP's default box?

Is guest Wi-Fi (and anything the public can reach, like a hosted web server) kept separate from the network your business computers use?

Are Windows/macOS, applications, and network equipment updated on a regular schedule (automatic updates or a monthly patch routine)?

Does every company computer have antivirus / anti-malware (for example Microsoft Defender) turned on?

Does that antivirus update itself automatically, and would anyone notice if it stopped?

Is antivirus set to scan files in real time (downloads, email attachments, USB drives) and to run periodic full scans?