Free download · Defense contractors
CMMC Compliance Checklist (Free PDF)
The readiness path to CMMC 2.0 — scoping, the paperwork, the technical controls assessors actually fail people on, and the assessment itself.
CMMC stopped being a someday problem in December 2024, when the program's final rule took effect — and it stopped being a next-year problem in November 2025, when CMMC requirements began appearing in new DoD contracts. Phase 2 of the rollout starts November 2026: third-party certification requirements for Level 2 begin showing up in new solicitations. From a cold start, Level 2 readiness typically takes 12–18 months. If CUI touches your business and you're waiting for the clause to appear in a contract before starting, you're planning to lose that contract.
This checklist is the path, not the whole rulebook — the order of operations that keeps you from paying an assessor to find gaps you could have found yourself.
We ask for your first name and email, then the PDF downloads right here.
What's inside
Scope & level — FCI vs CUI, Level 1 vs Level 2, enclave strategy, FedRAMP/GCC High cloud requirements, and why your MSP is in scope
Documentation — the SSP, an honest SPRS score, POA&M rules, policies across all 14 NIST 800-171 families, and the annual affirmation
Technical controls — MFA, FIPS-validated encryption, least privilege, audit logging, the 72-hour incident clock, media control, patching, training
The assessment — self-assessment vs C3PAO, mock assessments, evidence staging, assessor lead times, and the triennial cycle
Translations — FCI, CUI, SPRS, SSP, C3PAO, POA&M in plain English
The five CMMC mistakes that cost contractors
The checklist
1. Scope & level — decide what you're certifying
Know your level. FCI only → Level 1: 15 practices, annual self-assessment. CUI anywhere → Level 2: all 110 NIST 800-171 requirements, and most contracts require a third-party (C3PAO) assessment. Check your contracts for DFARS 252.204-7012 and CUI markings.
Map your CUI. Inventory where it lives and flows — file shares, email, endpoints, cloud apps, people. You can't scope what you haven't mapped.
Shrink the boundary. An enclave — a small, segmented environment where all CUI lives — is the single biggest cost lever. Certify the enclave, not the whole company.
Check the cloud stack. Cloud services holding CUI must meet FedRAMP Moderate or equivalent. For Microsoft, that conversation is GCC or GCC High — not standard commercial 365, especially with ITAR data.
Count your service providers. MSPs and other external providers touching the CUI environment are in scope — get their shared-responsibility matrix in writing before the assessor asks for it.
2. Documentation — the paper that must exist
System Security Plan (SSP). The master document: your boundary, and how each of the 110 requirements is met. No SSP, no assessment — it's the first artifact anyone asks for.
Honest SPRS score, submitted. Self-assess against the NIST 800-171 scoring methodology (−203 to +110) and post it to SPRS — already required by DFARS 7019/7020, and primes check it.
POA&M discipline. CMMC 2.0 allows a POA&M only for select lower-weight requirements, only above a minimum score (88 of 110 at Level 2), and it must close within 180 days.
Policies across all 14 families. Written, dated policies and procedures for every NIST 800-171 family — access control through system integrity.
A named affirming official. A senior official affirms compliance in SPRS annually — and a false affirmation is False Claims Act territory. They should understand exactly what they're signing.
3. Technical controls — where assessments are lost
MFA on everything that reaches CUI. Network access and all privileged accounts — authenticator or hardware keys, not SMS.
FIPS-validated encryption. CUI at rest and in transit protected by FIPS 140-validated modules — "it's encrypted" fails without the validation certificate numbers to show.
Least privilege, enforced. CUI access on need-to-know, separate admin accounts, session lock, and reviews when roles change.
Audit logging with teeth. Events captured and protected, clocks synced, retention defined — and a human reviewing on a schedule.
Incident response built for the 72-hour clock. DFARS 7012 requires reporting to DoD (DIBNet) within 72 hours — and submitting requires a medium-assurance certificate you must obtain before an incident.
Media and mobile under control. Removable media restricted and encrypted, mobile devices managed, paper CUI locked away.
Vulnerability and patch cadence. Periodic scans, remediation windows, no end-of-life software in the boundary.
Training with records. Security awareness plus insider-threat and CUI-handling training, documented yearly.
4. The assessment — getting certified, and staying certified
Confirm your path in the solicitation. Level 1 and a small subset of Level 2 self-assess; most Level 2 needs a C3PAO. Phase 2 of the rollout (from November 2026) puts certification requirements into new contracts.
Run a mock assessment first. Gap-assess against the NIST 800-171A assessment objectives — roughly 320 of them — before paying a C3PAO to find the same holes.
Stage evidence per objective. The working rule is two artifacts each: the policy that says it happens, and proof that it does — configs, screenshots, logs, tickets.
Book the C3PAO early. Assessor capacity is the bottleneck as Phase 2 demand lands — lead times run months, and primes won't wait.
Budget the triennial cycle. Certification lasts three years with annual affirmations in between — plan for staying compliant, not just getting there.
The five CMMC mistakes that cost contractors
1. Scoping the whole company instead of an enclave
2. A wishful SPRS score — primes and assessors both find out
3. CUI sitting in commercial Microsoft 365 that needed GCC High
4. "Encrypted" without FIPS-validated modules
5. Waiting for the contract clause to start — readiness takes 12–18 months
CMMC FAQ
What are the CMMC 2.0 levels?
Level 1 (Foundational): 15 practices protecting Federal Contract Information, verified by annual self-assessment. Level 2 (Advanced): all 110 NIST SP 800-171 requirements protecting CUI — most contracts require a triennial third-party (C3PAO) assessment, a small subset may self-assess. Level 3 (Expert): adds NIST SP 800-172 requirements, assessed by the government (DIBCAC).
When is CMMC actually required?
The program rule took effect in December 2024, and CMMC began appearing in new DoD contracts in November 2025 under a phased rollout: Phase 1 required self-assessments at award; Phase 2, starting November 2026, adds C3PAO certification requirements for applicable Level 2 contracts; full implementation lands by 2028. In practice, primes are flowing requirements down to subcontractors ahead of the schedule.
Can we use a POA&M instead of meeting every requirement?
Only narrowly. CMMC 2.0 permits a POA&M for select lower-weighted requirements, only if your assessment score is at least 88 of 110 at Level 2, and every POA&M item must close within 180 days or the conditional status lapses.
How long does CMMC Level 2 readiness take?
From a cold start, 12–18 months is typical: scoping and enclave design, closing the technical gaps, writing the documentation, operating the controls long enough to generate evidence, then a mock assessment before the real one. Assessor lead times add months on top — which is why "we'll start when the contract requires it" is a plan to lose the contract.
Do we need Microsoft GCC High?
It depends on the data. Cloud services holding CUI must meet FedRAMP Moderate or equivalent; export-controlled data (ITAR/EAR) pushes you toward GCC High specifically. What's consistently true: standard commercial Microsoft 365 is the wrong home for CUI, and migrating tenants later is far more expensive than scoping correctly up front.
Bidding on work that needs CMMC?
Datastrive runs CMMC gap assessments against all 110 requirements and manages the remediation — enclave design, Microsoft GCC migrations, policies, and evidence collection — as part of our cybersecurity services for Chicago-area contractors. Free initial gap review: we'll tell you your real distance from certifiable, in writing.
Prefer to talk? Call 1-773-863-3868.
More free resources: Small Business Cyber Security Checklist · Incident Response Plan Template · see all free resources
Educational guidance reflecting the CMMC 2.0 program (32 CFR 170 / 48 CFR) as of November 2026 — your solicitation's clauses govern. Not legal advice.