CMMC Level 2 Readiness Checklist

1. CUI Scoping & Boundary Definition  

⏹️ Clearly identify where CUI exists in our environment.

⏹️ Understand how CUI flows through systems. 

⏹️ Document which users, roles, and workflows access or handle CUI. 

2. System Security Plan (SSP) Accuracy 

⏹️ Create a current, complete SSP that aligns to all 110 NIST SP 800-171 controls.

⏹️ Identify a clear owner who updates the SSP when systems or processes change.

3. Implemented Security Controls  

⏹️ Limit CUI system access to authorized personnel only.

⏹️ Enforce multifactor authentication (MFA) on all applicable systems.

⏹️ Enable endpoint protection, logging, backup, and monitoring on in-scope systems. 

⏹️ Define configuration standards and ensure systems remain securely configured over time.

4. Evidence Readiness & Organization 

⏹️ Maintain current, organized documentation for each applicable security control.

⏹️ Ensure evidence is verifiable and can be produced quickly when requested by an assessor.

⏹️ Regularly review evidence to confirm it reflects your actual environment and practices.

5. Operationalized Policies 

⏹️ Create security policies and enforce them in daily operations.

⏹️ Demonstrate policy compliance through training records, enforcement actions, and reviews.

⏹️ Regularly review and update policies.

6. Incident Response & Recovery Readiness 

⏹️ Create a documented incident response plan aligned to your environment.

⏹️ Clearly define roles and responsibilities during an incident.

⏹️ Show the ability to recover systems and data within defined timelines.

7. Risk Assessment & Plan of Actions & Milestones (POA&M) 

⏹️ Conduct a formal gap assessment against NIST SP 800-171.

⏹️ Document known gaps in your POA&M with owners, priorities, and achievable timelines.

⏹️ Track and document progress against the POA&M.

8. Organizational Readiness for a C3PAO Audit 

⏹️ Ensure leadership understands that third-party audits are mandatory starting November 10, 2026.

⏹️ Give yourself between 6 and 12 months to prepare for your audit.

⏹️ Plan accordingly around limited C3PAO availability.

⏹️ Prepare to host assessors and efficiently respond to requests.