CMMC Readiness Checklist: Levels, Scoping, SSP, POA&M, and Assessments

The Cybersecurity Maturity Model Certification (CMMC) program is how the Department of Defense verifies that contractors protect the information they handle. If you’re in the defense industrial base, or want to be, CMMC requirements will show up in your contracts and your primes’ expectations.

The good news: CMMC doesn’t invent a brand-new set of controls. It builds on requirements that have applied to many contractors for years. The work is in scoping correctly, implementing the controls, documenting them, and being able to prove it.

This guide is general information, not legal advice. Confirm your specific obligations with your contracting officer, prime contractor, or qualified counsel.

The three CMMC 2.0 levels

CMMC 2.0 has three levels. The level you need depends on the type of information you handle and what your contract requires.

Most small and mid-sized contractors will land at Level 1 or Level 2. Level 3 applies to a much smaller group of programs.

Step 1: Understand what information you handle

Scoping starts with the data. Get this wrong and you’ll either under-protect sensitive information or spend far more than necessary protecting systems that don’t need it.

Federal Contract Information (FCI)

FCI is information provided by or generated for the government under a contract that isn’t intended for public release. If you hold a DoD contract, you almost certainly have FCI, even if it’s just contract details and correspondence.

Controlled Unclassified Information (CUI)

CUI is information that law, regulation, or government-wide policy requires to be safeguarded. In the defense context, it often includes controlled technical information such as drawings, specifications, and technical data. CUI should be marked, and your contract will typically include the DFARS clauses that govern it.

Scoping checklist

• Identify every contract and the DFARS and FAR clauses it contains
• Determine whether you receive or create CUI, or only FCI
• Trace how FCI and CUI enter the organization (email, portals, file transfer, physical media)
• Map where it’s stored, processed, and transmitted
• Identify the people, systems, and locations that touch it
• Identify security protection assets (firewalls, identity systems, monitoring tools) that protect in-scope systems
• Identify external service providers, including cloud services, that store or process CUI
• Consider whether an isolated enclave could shrink the scope

A smaller, well-defined CUI environment is usually easier to secure, document, and assess than an entire company network.

Step 2: Implement the controls

Level 1 essentials

The FAR 52.204-21 requirements cover fundamentals, including:

• Limiting system access to authorized users and devices
• Verifying the identity of users before granting access
• Controlling physical access to systems and facilities
• Sanitizing or destroying media before disposal
• Protecting system boundaries
• Applying security updates in a timely way
• Providing malware protection and keeping it updated

Level 2 control families

NIST SP 800-171 organizes its 110 requirements into 14 families:

• Access Control
• Awareness and Training
• Audit and Accountability
• Configuration Management
• Identification and Authentication
• Incident Response
• Maintenance
• Media Protection
• Personnel Security
• Physical Protection
• Risk Assessment
• Security Assessment
• System and Communications Protection
• System and Information Integrity

Several requirements tend to take the most effort for smaller organizations: multi-factor authentication, audit logging and review, FIPS-validated encryption for CUI, configuration baselines, and incident response capability. Start planning those early.

Cloud and service providers

If a cloud service stores or processes CUI, it needs to meet the applicable federal requirements, which typically means FedRAMP Moderate authorization or equivalency. Managed service providers that support in-scope systems can also fall within your assessment scope. Ask every provider how they support your CMMC obligations and get their responsibilities documented.

Step 3: Write the System Security Plan (SSP)

The SSP is the central document for Level 2. It describes your in-scope environment and explains how each requirement is implemented. An assessor will read it before looking at anything else.

A useful SSP includes:

• A clear description of the system boundary and in-scope assets
• Network diagrams and data flow diagrams for CUI
• An implementation statement for every requirement, written specifically for your environment
• The people and roles responsible for each area
• References to supporting policies, procedures, and evidence
• A record of when it was last reviewed and updated

Avoid boilerplate. An SSP copied from a template that doesn’t match your actual environment creates more risk than it removes.

Step 4: Track gaps with a Plan of Action and Milestones (POA&M)

A POA&M lists requirements that aren’t yet fully met, along with the planned fix, the responsible person, and target milestones.

• Every unmet requirement is listed
• Each item has a specific remediation action
• Each item has an owner and a milestone
• The POA&M is reviewed and updated regularly

Be aware that CMMC limits which requirements may remain on a POA&M at the time of assessment and requires those items to be closed within a defined period. Some requirements must be fully met and can’t be deferred. Check the current program rules before relying on a POA&M to carry open items through an assessment.

Step 5: Calculate and submit your SPRS score

Contractors subject to the DFARS assessment requirements calculate a score using the DoD Assessment Methodology and submit it to the Supplier Performance Risk System (SPRS). The methodology starts from a maximum score and subtracts weighted values for each requirement that isn’t implemented.

• Perform an honest self-assessment against all 110 NIST SP 800-171 requirements
• Calculate the score using the DoD Assessment Methodology
• Make sure the score is consistent with your SSP and POA&M
• Submit and keep the score current in SPRS

Accuracy matters. Submitting a score that overstates your actual implementation can create legal and contractual exposure.

Step 6: Prepare for the right kind of assessment

Self-assessment

Level 1, and some Level 2 contracts, allow a self-assessment. A senior company official must affirm compliance. Treat this as seriously as an outside audit: the affirmation is a formal representation to the government.

C3PAO assessment

Many Level 2 contracts will require a certification assessment by a CMMC Third-Party Assessment Organization (C3PAO). Assessors examine documents, interview staff, and test controls. Expect them to ask for evidence for each requirement, not just a policy statement.

Assessment readiness checklist

• Scope is defined and documented
• SSP is complete and accurate
• POA&M items are limited to what program rules allow
• Evidence is organized by requirement (screenshots, logs, configurations, records)
• Staff know their roles and can explain how controls work
• External service provider responsibilities are documented
• A mock assessment or readiness review has been completed

Common mistakes

• Treating the whole company as in scope when a smaller enclave would work
• Buying tools before scoping and documenting
• Writing an SSP that describes the environment you want, not the one you have
• Assuming a cloud provider handles compliance on your behalf
• Leaving evidence collection until the week before an assessment

How we can help

We help defense contractors scope their environments, close control gaps, write SSPs and POA&Ms, and get ready for assessment. If you’re not sure where you stand, we can start with a readiness review and give you a prioritized plan.