Does CMMC Level 1 have 15 or 17 requirements?

Short Answer

CMMC Level 1 has 15 requirements, 59 assessment objectives, and 6 domains. The 15 come from FAR 52.204-21(b)(1). The 17 comes from the NIST SP 800-171 mapping, where one requirement splits into three, and from a superseded 2021 DoD guide that listed 17 practices.

Where the 17 comes from

The CMMC rule maps each Level 1 requirement to NIST SP 800-171A in 32 CFR 170.15(c)(1)(ii), Table 2. One requirement, PE.L1-b.1.ix, on visitors, physical access logs, and access devices, maps to three NIST numbers, so 15 requirements line up with 17 NIST numbers.

The superseded CMMC Self-Assessment Guide, Level 1, Version 2.0 of December 2021 also organized Level 1 as 17 practices. The current DoD CMMC Assessment Guide, Level 1, Version 2.13 of September 2024 lists 15 requirements. The requirement count is 15.

The full breakdown

15 requirements from FAR 52.204-21(b)(1), broken into 59 assessment objectives from NIST SP 800-171A, organized under 6 domains. The domains are Access Control, Identification and Authentication, Media Protection, Physical Protection, System and Communications Protection, and System and Information Integrity.

A note on clause numbers

As of October 2026, 32 CFR 170.14(c)(2) still defines the Level 1 requirements by reference to FAR 52.204-21(b)(1)(i) through (xv), so that is the citation used here. Under the DoD class deviations for the FAR overhaul, effective February 1, 2026, a DoD solicitation may show the same 15 items as FAR 52.240-93, Basic Safeguarding of Covered Contractor Information Systems. The DFARS CMMC clauses keep their numbers, 252.204-7021 and 252.204-7025.