CMMC Compliance and Readiness Checklist
This CMMC compliance checklist covers the 30 checks we look at first in a readiness review, grouped into six stages in the order the work has to happen. It is written for Level 2 contractors handling CUI under DFARS 252.204-7012 and NIST SP 800-171 Revision 2. No email address required. Level 1 contractors should start with the 17 Level 1 practices.
A checked box should mean you can explain how the control works and produce evidence that it operates, not that a policy mentions the topic. Where you cannot, that item is your starting point.
1. Contracts and obligations
Everything downstream depends on knowing which clauses you actually hold.
- Every active contract and subcontract has been read for FAR 52.204-21 and DFARS 252.204-7012, 7019, 7020 and 7021.
- You know whether each contract involves FCI, CUI or both.
- Flow-down obligations from each prime are recorded, including any extra security terms.
- A named person owns CMMC and NIST SP 800-171 compliance and has budget authority.
- You have a DoD medium assurance certificate, or a plan to get one, for 72-hour incident reporting.
2. Scope and boundary
A boundary drawn too wide makes compliance unaffordable; too narrow leaves CUI uncontrolled.
- CUI entry points are mapped: email, customer portals, file transfers and physical media.
- Every system that stores, processes or transmits CUI is inventoried.
- Security protection assets (firewalls, EDR, SIEM, identity) are listed separately.
- A data-flow diagram shows how CUI moves and where it comes to rest.
- You have decided between an enclave and a whole-environment approach, with the reason written down.
3. Technical controls
These are the controls that most often fail at objective level.
- Multi-factor authentication covers remote, privileged and network access to in-scope systems (3.5.3).
- Cryptography protecting CUI uses FIPS-validated modules, not just strong algorithms (3.13.11).
- Audit logs are generated, retained, protected and reviewed on a documented cadence (3.3.x).
- Baseline configurations exist for each system type and changes go through a tracked process (3.4.1, 3.4.2).
- Vulnerability scanning runs on a schedule and findings are remediated by risk (3.11.2, 3.14.1).
- Endpoints are managed, encrypted and running current malicious-code protection.
4. Documentation
Assessors test what the documents claim, so the documents must describe reality.
- A System Security Plan describes the boundary and how each of the 110 requirements is implemented (3.12.4).
- Policies and procedures exist for all 14 families and name who performs each activity.
- An incident response plan exists and has been exercised in the last 12 months (3.6.3).
- A risk assessment has been completed on a stated schedule (3.11.1).
- Every gap the SSP describes has a matching POA&M entry.
5. SPRS score and POA&M
The score is a representation to the government, and you are liable for it.
- All 110 requirements have been scored with the DoD Assessment Methodology 5/3/1 weighting.
- The score in SPRS matches the current state of the environment and states its scope.
- Only POA&M-eligible requirements are deferred, and none of the never-deferrable ones are.
- Each POA&M item has an owner, a dated milestone and a closeout plan inside 180 days.
6. Evidence and people
A control that cannot be shown working is scored as not met.
- Evidence is mapped to the 320 assessment objectives in NIST SP 800-171A, not just to requirements.
- Evidence is stored in an approved location without creating uncontrolled copies of CUI.
- Control owners can explain their procedure and produce proof without preparation.
- Staff with CUI access have completed role-based security and CUI-handling training.
- A mock assessment has been run and its findings closed or added to the POA&M.
How to use the results
Count the unchecked items in each stage. Gaps in stages 1 and 2 come first, because every later control depends on knowing what is in scope. Gaps in stage 3 usually carry the most SPRS points; the SPRS score calculator shows how much each one costs. Gaps in stages 4 to 6 are where otherwise well-run environments fail, because the controls exist but nobody wrote them down in a form an assessor can test.
For the documents, start from the CMMC SSP template and the POA&M template. For the scoring rules behind stage 5, see how the SPRS score works.
If more than a handful of items are unchecked, a CMMC gap assessment will score all 110 requirements at objective level and order the fixes by points per unit of effort. A full CMMC readiness assessment adds the SSP, POA&M and evidence package.
Frequently asked questions
What is a CMMC readiness checklist?
A structured list of the things that must be true before you post an SPRS score or face a customer or assessor review: contracts read, scope defined, controls implemented, documents written and evidence mapped. It is a triage tool, not a substitute for an objective-level assessment.
Is this checklist enough to pass a CMMC assessment?
No checklist is. Assessors test 320 objectives beneath the 110 requirements, and a box ticked at requirement level can still fail at objective level. Use the checklist to find where deeper work is needed.
Do I need to give an email address to use it?
No. The full checklist is on this page. Copy it, print it or paste it into your own tracker.
Does this apply to Level 1 as well as Level 2?
It is written for Level 2, where CUI is involved. Level 1 contractors can use stages 1, 2 and the relevant parts of 3, then follow the 17 practices on the Level 1 page.