CMMC Compliance CheckCMMC compliance checklist
The steps below follow 32 CFR Part 170. Work through them in order; the free self-check on this site covers step 4 and step 5.
1. Confirm the level
- Find the CMMC level and assessment type in the solicitation or contract (DFARS 252.204-7021).
- FCI only: Level 1. Any CUI: Level 2 (self or C3PAO, as the contract says).
- Check what your primes require of you: the clause flows down to subcontractors handling the same information.
2. Scope the assessment
- List the systems, people and facilities that process, store or transmit FCI or CUI (32 CFR 170.19, CMMC scoping).
- For Level 2, sort assets into CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and out-of-scope assets.
- Draw the boundary on a network diagram. A smaller enclave is often cheaper to assess than the whole company.
3. Write the System Security Plan
- Describe the boundary, the environment and how each requirement is met (NIST 3.12.4).
- Without a current SSP a Level 2 assessment can't be completed, and the SSP can never go on a POA&M (32 CFR 170.21, POA&M requirements).
4. Assess every requirement
- Use the NIST SP 800-171A objectives (NIST SP 800-171A (assessment objectives)). A requirement is met only when every objective is.
- Evidence must be final: drafts and unapproved policies don't count (32 CFR 170.24, CMMC Scoring Methodology).
- Level 1: 15 requirements. Level 2: 110.
5. Score it and plan the gaps
- Level 2: 110 minus the value of each requirement not met (how the SPRS score works).
- A Conditional status needs at least 88 and only POA&M-eligible gaps (POA&M rules).
- Level 1: all requirements met, no POA&M.
6. Enter SPRS and affirm
- Enter the level, date, scope, CAGE codes and result (and the Level 2 score) in SPRS (32 CFR 170.15, Level 1 self-assessment, 32 CFR 170.16, Level 2 self-assessment).
- A senior official affirms compliance at each assessment and every year after (32 CFR 170.22, affirmation).
7. Keep it current
- Close any POA&M within 180 days and re-assess the closed items.
- Level 1: re-assess every year. Level 2: every three years, with annual affirmations in between.