cyberhusky
For defense contractors, subcontractors, and compliance teams, the Cybersecurity Maturity Model Certification (CMMC) is no longer something to leave until the last minute. If your business wants to qualify for federal contracts, you need to understand what CMMC requires and where your current security gaps are.
In this CMMC checklist, we’ll help you prepare for certification, avoid the cost of being unprepared, and work through the key requirements step by step. Keep reading to learn what CMMC compliance involves and how to get your organization ready before an assessment.
A lot. But we’ll make it as easy as possible to understand. CMMC compliance requirements protect two categories of sensitive government information:
What specific controls do you need to meet? It depends on which type of data you handle and what your contract demands. Before you can build a meaningful CMMC checklist, you need to answer three foundational questions.
FCI is any information provided by or generated for the government under a contract that is not intended for public release. CUI is a broader, more sensitive category that includes:
If your systems touch CUI, your CMMC compliance checklist becomes significantly more demanding, requiring you to meet NIST SP 800-171 controls at a minimum.
You’ll want to review your:
Look for language referencing CUI categories, distribution statements (such as Distribution B through F on technical documents) or explicit mentions of DFARS clause 252.204-7012. That clause is your clearest signal that CUI is in play and that CMMC Level 2 or higher likely applies.
Your business may need varying degrees of compliance, such as:
Before going through your CMMC checklist, verify the level required in your contract.
Scoping is the single most impactful step in your CMMC certification checklist. Your assessment boundary defines which systems, networks and users are in scope. Every system inside that boundary must comply. Every system outside it does not.
The goal?
Define boundaries before your assessment begins, not after. Poorly scoped environments inflate cost, extend assessment timelines and introduce findings that could have been avoided.
You know what your contract demands. Now what? Assessment is the next part of your CMMC checklist. Your requirements will vary based on the respective level. For example:
Contractors at this level perform an annual self-assessment against the 17 FAR practices and submit their score to the Supplier Performance Risk System (SPRS). No third-party assessor is required. A senior company official must affirm the accuracy of the submission. Documentation, while not formally reviewed, should still exist in case of a DoD audit.
Some Level 2 contractors can self-assess and submit to SPRS, similar to Level 1. Contracts that involve programs with higher sensitivity or critical national security information will undergo a third-party assessment.
CMMC compliance checklist items at Level 2 include:
CMMC certification requirements at this level involve a government-led assessment conducted by the Defense Contract Management Agency (DCMA). These assessments are reserved for contractors supporting the most sensitive DoD programs.
Does Level 3 apply to you?
Expect a rigorous review of your implementation of NIST SP 800-172 enhanced security requirements on top of the full NIST SP 800-171 baseline. Third-party readiness assistance is strongly recommended before a Level 3 assessment.
Inaccurate or incomplete data maps are a common cause of CMMC failure. You must view mapping as both organizational or technical, and requiring the help of:
Our cybersecurity services can also help you prepare for mapping your data properly.
Start with the obvious places:
CUI often ends up in Google Workspace, Microsoft Teams and SharePoint. Formal processes and governance are necessary for all of these data points. If left uncontrolled, all of these are weak points in your potential assessment.
CUI also flows outside of contractor control, often when it’s passed to other parties, such as:
Flow-down clauses are found in your prime contract and are something to pay close attention to when signing. You may need to add the external parties to your assessment scope so that you all remain compliant.
Add the reduction of scope to your CMMC checklist before you acquire new tools. Vulnerability management includes assessing any new software or solutions before purchasing them. If they do not fit where CUI lives, it will only add to your overall scope.
Define your scope. Systematic reviews of your controls will help you when it comes time to run a CMMC self-assessment or C3PAO assessment. Three areas to focus on:
Your CMMC checklist should include:
Assessors will verify MFA, so be sure it’s in place throughout the organization.
Vulnerability management (Practice Family SI and RA) is another high-finding area. Before your assessment, conduct a vulnerability scan using an authenticated scanner against all in-scope systems. Remediate critical and high findings. Document your patch cadence and show that it is consistently followed.
Vulnerabilities that you fail to patch are automatically found and flagged.
Can’t patch certain issues due to operational constraints? Add it to your POA&M.
Documentation is where many technically capable organizations fail their CMMC assessment. Write your policies and procedures to reflect what actually happens in your environment. If your patch cycle is 30 days, document 30 days, not 7. If your incident response team is two people, document two people. Aspirational documentation that does not match observed practice creates findings and damages your credibility with the assessor.
An assessment is an evidence review. Use your CMMC checklist to organize evidence by control domain.
Your SSP is the single most important document in your CMMC preparation. It describes your system boundary, the users and roles within it, the technologies in use and how each of the 110 NIST SP 800-171 controls is implemented.
The SSP must be:
Assessors will use it as a roadmap. At a minimum, your CMMC checklist should include:
For each control, prepare supporting evidence in advance. Common evidence types include:
Organize this evidence by control number.
Every CMMC compliance checklist should include:
Close any of these items before your assessment. Every open issue remains a potential finding that can impact your contract.
Unfortunately, there’s no straightforward answer to costs on this – or any – CMMC checklist. You have to factor in C3PAO fees that can be $20,000 – $100,000, but then there are remediation costs and others that compound on top of them.
Most assessment failures and delays trace back to a handful of predictable mistakes. If you are building your CMMC checklist and CMMC compliance checklist, use this section as a warning list.
CMMC certification is not a point-in-time checkbox. It is a continuous compliance posture. Assessors evaluate whether your controls are implemented and operational, not whether they were configured once and never touched again. Organizations that treat their CMMC audit checklist as a sprint to certification rather than an ongoing operational discipline typically encounter findings related to:
These are all controls that require regular attention to remain in compliance.
A CMMC checklist started 18 months before your first assessment is far more valuable than one started 60 days before.
Broken processes cannot be eliminated with technology. Invest in scope, documentation and process first before buying more tools.
At Cyber Husky, we help contractors and businesses meet CMMC security requirements. Our team will run a full readiness check and help you rectify issues before your assessment so that they’re not held against you.
What can you do now? Take action. A CMMC checklist is only useful when execution takes place. Work with any stakeholders that you can and go down the list to tick off each box.
It depends. Your CMMC compliance requirements will vary:
We’ll be more than happy to discuss all of these options with you.
Scoping. CUI environment implementation and documentation. Your CMMC compliance checklist will also include:
Our team can help verify your CMMC security requirements.
Prices vary based on the level you’re required to meet. Our CMMC compliance services have a pricing structure that varies depending on the size of the environment and complexity. Ongoing compliance also adds to the total cost.
Working through our CMMC certification checklist, it’s clear that the differences are:
Every subsequent level adds to the requirements for handling sensitive data.
Yes. Arguably, a CMMC audit checklist is best for these companies if they plan on being part of the supply chain. Subcontracts will include all of the requirements that need to be met and if they apply to your organization.
SPRS submission is part of any CMMC checklist because it’s a requirement for any DoD contractors. Why? As a contractor, you’ll need to submit your self-assessment scores. You also need to verify that the scores are accurate.
Yes, of course. Our managed IT services help you work through a CMMC cybersecurity checklist and ensure your readiness. But the MSP cannot take the burden off of their clients completely.
Jump to section
