CMMC Compliance Checklist

What CMMC is and why it exists

CMMC is the Department of Defense's framework for verifying that companies in the Defense Industrial Base (DIB) protect sensitive government information. It exists because self-attestation alone proved unreliable: contractors certified compliance they hadn't actually achieved, and adversaries exploited the gap by targeting smaller, less-defended suppliers.

CMMC 2.0 ties assessment rigor to the sensitivity of the information you handle. Lower-risk work allows self-assessment; work involving CUI critical to national security requires an independent, third-party assessment. The goal is a verifiable, consistent baseline across every tier of the supply chain.

Who needs to comply

If any of the following is true, CMMC almost certainly applies to you:

• You are a prime contractor or subcontractor anywhere in the DoD supply chain.
• Your contracts include DFARS 252.204-7012 (safeguarding covered defense information and cyber incident reporting).
• You receive, store, process, or transmit Federal Contract Information (FCI) — information not intended for public release, provided under a contract.
• You handle Controlled Unclassified Information (CUI) — the higher-sensitivity category that triggers Level 2 or above.
• You have submitted, or are required to submit, a NIST SP 800-171 self-assessment score to the Supplier Performance Risk System (SPRS) under DFARS 252.204-7019 and 7020.

The three CMMC levels

CMMC 2.0 has three levels. Determine which one your contracts require before assessing anything — the level defines the control set and who assesses you.

• Level 1 (Foundational): 17 practices protecting FCI, based on the 15 basic safeguarding requirements in FAR 52.204-21. Annual self-assessment and annual affirmation in SPRS.
• Level 2 (Advanced): 110 practices aligned with NIST SP 800-171 Rev 2, protecting CUI. Either a self-assessment or a triennial third-party assessment by a Certified Third-Party Assessment Organization (C3PAO), depending on the contract.
• Level 3 (Expert): the Level 2 controls plus a subset of NIST SP 800-172 enhancements, assessed by the government (DIBCAC). Reserved for the highest-priority programs.
• Not sure which applies? Most DIB companies handling CUI are targeting Level 2. Confirm with your contracting officer rather than guessing.

Before you start: scope your environment

Scoping is where most CMMC efforts succeed or fail. Narrow, well-defined scope reduces cost and risk; a vague boundary drags your whole company into the assessment.

• Identify exactly where FCI and CUI are received, stored, processed, and transmitted — including email, file shares, endpoints, cloud tenants, and backups.
• Define the assessment boundary and separate in-scope systems from out-of-scope ones, using network segmentation where practical.
• Categorize assets: CUI assets, Security Protection Assets, Contractor Risk Managed Assets, and Out-of-Scope Assets.
• Write your System Security Plan (SSP) — a required artifact describing your boundary, systems, and how each control is met.
• Stand up a Plan of Action and Milestones (POA&M) to track open gaps with owners and dates.
• Confirm your current NIST SP 800-171 score in SPRS and how it was calculated (start at 110, subtract weighted points per unmet control).

Access Control (AC)

Limit system access to authorized users, processes, and devices — and to the functions they're permitted to perform.

• Are accounts unique per user, with role-based permissions following least privilege?
• Is privileged (admin) access separated from day-to-day accounts and tightly limited?
• Do you control and log remote access, and route it through managed, encrypted channels?
• Is CUI flow controlled between systems, and is access to it restricted on a need-to-know basis?
• Are session locks, automatic logoff, and control of mobile/portable devices enforced?

Awareness and Training (AT)

Make sure the people using your systems understand the risks and their responsibilities.

• Do all users receive security awareness training aligned to their roles?
• Are staff trained to recognize and report phishing, social engineering, and insider-threat indicators?
• Do privileged users and security staff get role-specific training beyond the baseline?
• Is training completion tracked and refreshed on a defined schedule?

Audit and Accountability (AU)

Create and retain the logs you need to detect, investigate, and prove what happened.

• Are audit logs generated across systems that handle CUI, capturing the events you'd need in an investigation?
• Can every logged action be traced to a specific user (individual accountability)?
• Are logs protected from unauthorized access, modification, and deletion?
• Is time synchronized across systems so events can be correlated?
• Are logs reviewed regularly, with alerting on the events that matter, and retained per requirements?

Configuration Management (CM)

Establish and maintain secure baselines for your systems, and control changes to them.

• Do you maintain documented, secure baseline configurations for hardware and software?
• Are changes reviewed, approved, and tracked through a change-control process?
• Do you enforce least-functionality — disabling unnecessary ports, protocols, services, and software?
• Do you maintain an inventory of authorized software and restrict or block unauthorized applications?
• Are security-relevant settings enforced and monitored for drift?

Identification and Authentication (IA)

Verify the identity of users and devices before granting access.

• Is multi-factor authentication enforced for privileged accounts and for network/remote access?
• Are password/authenticator policies (complexity, reuse, storage) enforced and cryptographically protected?
• Are shared or generic accounts eliminated, or tightly controlled where unavoidable?
• Are devices identified and authenticated before connecting to in-scope systems?
• Are temporary and default credentials changed before systems go into use?

Incident Response (IR)

Be ready to detect, respond to, and report incidents — including the DoD's 72-hour reporting obligation.

• Do you have a documented incident response plan with defined roles and escalation paths?
• Can you report cyber incidents to DoD within 72 hours as required by DFARS 252.204-7012?
• Do you test the plan (for example, tabletop exercises) and update it from lessons learned?
• Are detection and monitoring in place to identify incidents in the first place?
• Is there a process to preserve evidence and support forensic analysis after an incident?

Maintenance (MA)

Perform system maintenance in a controlled way that doesn't create new exposure.

• Is maintenance — including remote maintenance — scheduled, controlled, and logged?
• Are maintenance tools and media checked for malicious code before use?
• Is media sanitized of CUI before equipment leaves your control for repair or disposal?
• Are maintenance personnel supervised, and their access appropriately restricted?

Media Protection (MP)

Protect CUI on digital and physical media, in use, in storage, and in disposal.

• Is media containing CUI marked, and access to it limited to authorized users?
• Is CUI encrypted on portable devices and removable media?
• Is media sanitized or destroyed before disposal or reuse, using approved methods?
• Is the use of removable media controlled, and prohibited where it isn't needed?
• Is CUI protected during transport outside controlled areas?

Personnel Security (PS)

Manage the risk that comes with the people who have access to your systems.

• Are individuals screened before being granted access to systems containing CUI?
• Is access promptly revoked on termination or role change (same-day for departures)?
• Are CUI systems and information protected during personnel transfers and reassignments?

Physical Protection (PE)

Control physical access to the systems, equipment, and environments that hold CUI.

• Is physical access to facilities and equipment limited to authorized individuals?
• Are visitors escorted, logged, and their activity monitored?
• Are physical access devices (keys, badges) managed and audited?
• Is CUI protected at alternate and remote work sites, including home offices?

Risk Assessment (RA)

Understand your risks and vulnerabilities so you can prioritize the right fixes.

• Do you assess risk to operations and assets from systems that handle CUI, on a defined cadence?
• Do you scan for vulnerabilities regularly and when new ones are announced?
• Are identified vulnerabilities remediated based on risk, and tracked to closure?
• Do risk assessments inform your POA&M and security roadmap?

Security Assessment (CA)

Verify that your controls actually work, and manage the gaps that remain.

• Do you periodically assess your security controls to confirm they're effective?
• Is your System Security Plan current and reflective of the real environment?
• Is your POA&M actively managed, with realistic milestones and owners?
• Do you monitor controls on an ongoing basis rather than only at assessment time?

System and Communications Protection (SC)

Protect information in transit and at the boundaries of your systems.

• Is CUI encrypted in transit using FIPS-validated cryptography?
• Are network boundaries monitored and controlled, with a deny-by-default posture at perimeters?
• Is your network architected to separate CUI systems from general-purpose and public-facing ones?
• Are cryptographic keys managed securely, and mobile code and collaboration tools controlled?
• Is CUI encrypted at rest where required?

System and Information Integrity (SI)

Find and fix flaws, and detect malicious activity, in a timely way.

• Are flaws and vulnerabilities identified and patched within defined timeframes?
• Is malicious-code protection deployed, updated, and monitored across endpoints?
• Do you monitor systems and network traffic for attacks and indicators of compromise?
• Do you act on security alerts and advisories relevant to your environment?
• Is 24/7 monitoring in place, or is there a gap outside business hours?

Common gaps we see

In first-time CMMC readiness reviews, the same shortfalls come up again and again:

• No clear CUI boundary — the whole company is treated as in-scope, ballooning cost and effort.
• MFA deployed for email but not for all remote and privileged access.
• Logging enabled but never reviewed — no monitoring, no alerting, no one watching after hours.
• An SSP that describes an idealized environment, not the one that actually exists.
• A POA&M that hasn't been touched since it was created.
• Encryption in place, but not FIPS-validated where the requirement demands it.

From checklist to certification

Working through this checklist tells you roughly where you stand. Turning that into a defensible assessment result means closing gaps in a deliberate order, generating the evidence assessors expect, and keeping the controls operating — not just implemented once.

One Circle Solutions helps defense contractors get there: a scoped gap assessment against NIST SP 800-171, a prioritized remediation roadmap, the monitoring and logging the framework assumes you run, and support through the assessment itself. If you'd rather not navigate CMMC alone, that's exactly the work we do.