Guide
CMMC readiness checklist for defense contractors.
A working order of operations, not a control list — the practices are published and you can read them. What this covers is the sequence, because doing the right things in the wrong order is the most common and most expensive way a CMMC effort goes long.
1 · Determine the level
- Read DFARS 252.204-7012 / 7019 / 7020 / 7021 and FAR 52.204-21 in your actual contracts.
- Establish whether you receive FCI only, or CUI. The data decides the level.
- Where a flow-down is ambiguous, ask the prime in writing and keep the answer.
- Do not declare a level to a customer before you have verified it.
2 · Scope the CUI boundary
- Trace where CUI actually arrives, rests and leaves — email and shared drives included.
- Decide what is in the assessed boundary and record why each exclusion is valid.
- Consider an encrypted enclave before extending the boundary across the whole company.
- Settle this before buying tooling; the boundary determines what the tooling must cover.
3 · Close the practices
- Assess current state against all 110 practices (or 15 for Level 1) honestly — partial is partial.
- Implement, then document. Documentation written first describes a system that does not exist yet.
- Separate gaps into fix-before-assessment and POA&M-eligible, and check eligibility rather than assuming it.
- Give each practice an owner who can be interviewed about it.
4 · Build the evidence
- Identify the artifact each practice leaves behind — ticket, log, export, signed record.
- Start collecting early: artifacts must be dated across a period, not produced in a week.
- Write the SSP against the real environment, control by control.
- Organize evidence so an assessor can find it without a guided tour.
5 · Score and rehearse
- Calculate the SPRS score and keep the arithmetic, not just the number.
- Run a mock assessment in the real shape — questions asked, evidence requested, people interviewed.
- Fix what the rehearsal finds before booking anything.
6 · Schedule the C3PAO last
- A date set before scope is settled converts a solvable problem into a deadline.
- Select the C3PAO yourself; a preparer should not be steering that choice or taking a fee for it.
- Keep your preparer available through the assessment itself.
Want this checked against your environment?
Tell us what you receive, from whom, and what you have documented so far. You will get back a written view of your level, your boundary, and what to do first.