CMMC Level 1 & 2 Compliance Guide: Endpoint Security & Access Control

Level 1 focuses on foundational cyber hygiene controls—primarily access control, basic system protection, and physical safeguards. Level 2 includes all Level 1 practices plus more advanced controls aligned to NIST 800-171, emphasizing audit logging, continuous monitoring, endpoint security, and stronger access control measures.

CMMC Level 1 applies to any contractor that processes or stores Federal Contract Information (FCI), regardless of company size. It includes 15 practices that must be demonstrated and documented for DoD eligibility.

Level 2 adds 93 practices from NIST 800-171, including audit logging, monitoring, device control, access management, system hardening, and incident response documentation. These apply to organizations handling Controlled Unclassified Information (CUI).

Endpoint security reduces unauthorized access, data leakage, malware damage, and insider threats. CMMC Level 1 & 2 explicitly require contractors to manage unauthorized connections, restrict removable media, enforce access control, and monitor system activities—all of which depend on securing endpoints.

CurrentWare provides endpoint security, web filtering, data loss prevention, and user activity monitoring that support core CMMC practices, including removable media control (AccessPatrol), web filtering and content restriction (BrowseControl), user activity monitoring and auditing (BrowseReporter), and endpoint power management and device visibility (enPowerManager). These tools help enforce access control, restrict unauthorized devices, maintain logs, and demonstrate compliance.

AccessPatrol reinforces multiple controls related to removable media and device access, including AC.L1-3.1.20 (control connections of removable media and external devices), MP.L2-3.8.x (media protection and usage restrictions), and SC.L2-3.13.x (system/control boundary protections). It prevents unauthorized USB storage use, limits file transfers, and provides activity logs.

BrowseControl helps meet requirements around limiting access to unsafe or unauthorized websites and cloud applications. It contributes to AC.L1-3.1.5 (limit access to authorized users, processes, and devices), SC.L1-3.13.5 (restrict external system connections), and CM.L2-3.4.x (system configuration and enforcement). It ensures users cannot access risky domains or unapproved cloud storage.

BrowseReporter provides detailed activity logs for endpoints, including websites, applications, bandwidth usage, and user activity timelines. This supports AU.L2-3.3.x audit logging requirements, CM.L2 configuration and activity monitoring, and IR.L2 incident response detection. Log retention helps demonstrate continuous monitoring during assessments.

Yes. AccessPatrol enforces granular policies to block USB storage, monitor device usage, allow approved devices only, and maintain logs of all device connections. This directly supports CMMC Level 1 & 2 media protection practices.

CMMC does not mandate employee surveillance, but it requires contractors to maintain audit logs, detect unauthorized activity, verify access control adherence, and monitor system usage. Tools like BrowseReporter help satisfy these logging and auditing requirements while supporting least-privilege principles.

CurrentWare’s reporting features provide historical logs, device usage reports, endpoint activity audits, and policy configuration details. These artifacts help demonstrate how access control, media restrictions, and monitoring practices are enforced across your environment.

Yes. Many small and mid-size contractors can meet Levels 1 and 2 using commercially available endpoint security, access control, and monitoring solutions. CurrentWare’s lightweight deployment and central console simplify compliance for small teams with limited IT resources.

Not necessarily. CMMC requires controlling device access, not universally banning it. Contractors must limit removable media to authorized devices and maintain oversight. AccessPatrol enables policy-based control so organizations can allow approved media while blocking risky devices.

Implement centralized device control, enforce consistent access policies, maintain detailed audit logs, and continuously monitor endpoint activity. CurrentWare’s platform automates much of this work and generates the documentation auditors request during evaluations.