CMMC Level 1 (Foundational)
The Cybersecurity Maturity Model Certification (CMMC) Level 1 covers the 17 "basic safeguarding" practices for Federal Contract Information (FCI). Gadriel Code contributes evidence for roughly half; the rest are procedural.
Related: Compliance overview · Cyber Insurance Readiness.
At a glance
| Property | Value |
|---|---|
| Slug | cmmc-level-1 |
| Aliases | cmmc, cmmc-l1 |
| Controls | 17 |
| Manual-only | 9 |
| Machine-assessable | 8 |
| Direct mapping key | (none — structural gap) |
IMPORTANT
ComplianceMapping has no cmmc key, so direct (Tier-1) mapping is not
possible. Predicated controls rely on rule_id_patterns and pillar
fallback tiers, plus manual review.
Generating the report
bashgadriel code report --compliance cmmc-level-1
Outputs: .security/compliance/cmmc-level-1.{md,typ,pdf}.
What Gadriel evaluates
The predicated half touches the practices tied to source-code behavior:
- AC (Access Control) — authN/authZ, information flow.
- IA (Identification & Authentication) — user identification, credential handling.
- MP (Media Protection) — data-handling patterns in code.
- SC (System & Communications Protection) — transport security, boundary protection.
- SI (System & Information Integrity) — flaw remediation, malicious-code protection surfaces.
Procedural practices (physical security, personnel, audit-and-accountability policy) render as NOT ASSESSABLE.