The Complete CMMC Compliance Checklist

The first step is understanding what type of data you handle. If your DoD contracts only involve Federal Contract Information (FCI), you need Level 1. If you handle Controlled Unclassified Information (CUI), you'll need Level 2 — and approximately 95% of contractors handling CUI will need a third-party C3PAO assessment rather than a self-assessment.

Scoping is critical — it determines what systems, people, and processes are subject to CMMC requirements. A well-defined scope can dramatically reduce compliance costs. The CMMC Assessment Scope defines four asset categories: CUI Assets (process/store/transmit CUI), Security Protection Assets (provide security for CUI assets), Contractor Risk Managed Assets (can but don't process CUI), and Specialized Assets (IoT, OT, government-furnished equipment).

A gap assessment compares your current security controls against NIST SP 800-171 requirements (for Level 2). This gives you a clear picture of what's already in place and what needs work. Your SPRS (Supplier Performance Risk System) score is calculated based on this assessment — a perfect score is 110, and you need a minimum of 88 with a POA&M plan to achieve Conditional certification.

The System Security Plan is the cornerstone of your CMMC compliance documentation. It describes your system boundaries, how each of the 110 controls is implemented, who is responsible, and what technologies support each control. A C3PAO assessor will review your SSP first — think of it as the blueprint they use to verify your compliance. It must be thorough, accurate, and current.

This is typically the most time-intensive and costly step. The 110 controls span 14 families: Access Control (22 controls), Awareness & Training (3), Audit & Accountability (9), Configuration Management (9), Identification & Authentication (11), Incident Response (3), Maintenance (6), Media Protection (9), Personnel Security (2), Physical Protection (6), Risk Assessment (3), Security Assessment (4), System & Communications Protection (16), and System & Information Integrity (7). Start with the highest-impact areas first.

CMMC assessors don't just check technical controls — they verify that you have formal policies and procedures governing your security program. Each of the 14 control families should have an associated policy. These documents must be approved by management, communicated to employees, and reviewed at least annually. They should reflect your actual practices, not generic templates.

CMMC requires security awareness training for all users, plus role-based training for personnel with specific security responsibilities. Training must cover CUI identification and handling, phishing awareness, incident reporting procedures, and your organization's specific security policies. Training records must be maintained as evidence for your assessment.

Before your formal assessment, ensure all documentation is current, evidence is organized, and your team is prepared. Select a C3PAO through the CyberAB Marketplace — but plan ahead, as wait times are often 6-12+ months. Consider a mock assessment to identify any remaining gaps. Remember: you need a minimum SPRS score of 88/110, and any controls on POA&M must be closed within 180 days of Conditional certification.