1. Read the contract before determining the CMMC level and assessment type
- Identify FAR 52.204-21 and applicable DFARS 252.204-7012, 7019, 7020, 7021/7025 requirements.
- Confirm whether the organization handles FCI, CUI, or both.
- Confirm the required CMMC level and assessment type in the solicitation, contract, order or prime flow-down.
- Do not assume that CUI automatically means a currently required C3PAO certification; Phase II mandatory C3PAO requirements are suspended.
2. Determine the assessment type
- Level 1 Self: 15 FAR safeguarding requirements, annual self-assessment and annual affirmation, no POA&M.
- Level 2 Self: 110 NIST SP 800-171 Revision 2 security requirements, self-assessment every three years, annual affirmation, limited POA&M rules.
- Level 2 C3PAO: remains in the CMMC regulatory model, but mandatory Phase II implementation is currently suspended.
3. Define scope before selecting broad technology
- Trace where CUI enters, is stored, processed, transmitted and leaves.
- Identify CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and defensible Out-of-Scope Assets.
- Document external service providers that support the CMMC environment.
- Do not license the entire company for a government-oriented environment before determining whether the entire company belongs in scope.
4. Consider a secure enclave where the workflow allows it
A secure CUI enclave can concentrate protected email and file sharing into a smaller set of users and systems. That can reduce unnecessary CMMC assessment scope and cost. PreVeil is one example: it publishes FedRAMP Moderate Equivalency and FIPS 140-3-validated cryptography information and can run alongside Microsoft 365 or Google Workspace. An enclave does not automatically make every other asset out of scope; the boundary must still satisfy 32 CFR 170.19.
5. Assess implementation against each requirement
- Evaluate each applicable requirement and assessment objective against the operating environment.
- Record partially implemented requirements as gaps until all applicable objectives are satisfied.
- Separate implementation gaps from missing or insufficient evidence.
- Record the systems, people and processes responsible for each requirement.
6. Implement requirements before finalizing documentation
- Remediate technical, administrative and operational gaps.
- Ensure recurring practices—logging, monitoring, training, vulnerability management, account reviews and incident response—operate consistently and produce records.
- Use the SSP to describe the implemented environment, not a planned future state.
7. Build final evidence continuously
- Collect dated configuration exports, logs, tickets, training records, review records and other final artifacts.
- Map each requirement to evidence that demonstrates implementation and performance.
- Do not rely on newly created evidence shortly before an assessment to represent a recurring process that has not been operating over time.
8. Use POA&Ms only where the rule allows them
Level 1 does not permit POA&Ms. Level 2 permits limited POA&M use under specified conditions. Conditional status requires eligible open items to be closed through the required closeout assessment within 180 days.
9. Separate the DFARS Basic Assessment from CMMC Level 2 Self
DFARS 252.204-7019/7020 requires a current NIST SP 800-171 DoD Assessment in SPRS for applicable contractor information systems. CMMC Level 2 Self is a separate CMMC assessment status. They share the same Rev. 2 security baseline, but the legal mechanisms and reporting constructs are not identical.
10. Assess, submit and affirm
- For Level 1 Self, conduct the annual self-assessment and required affirmation.
- For Level 2 Self, conduct the self-assessment every three years and maintain the annual affirmation.
- Your organization owns the submission and affirmation. A consultant can support preparation but cannot make the government-facing representation on your behalf.
11. Maintain the assessed environment
CMMC responsibilities continue after the assessment result is submitted. Material changes, new users, new CUI flows, new service providers and architectural changes can affect scope and continuing compliance. Keep the SSP, asset inventory, diagrams, evidence and operating practices current.
12. Prepare for additional review when business or contract risk warrants it
Even when the current contract requires Level 2 Self, evidence suitable for independent review can reduce future preparation effort if a prime, government team or later C3PAO assessment needs to verify the environment. That is different from representing a C3PAO assessment as currently mandatory.
Level 2 Self readiness · Level 2 requirements · CMMC cost · CMMC for small business