CMMC First-Steps Checklist

What this checklist is

This checklist is a worksheet. It helps a team organize its first steps toward a CMMC requirement. Use it to assign owners, record where evidence lives, note open questions, and set target dates.

This checklist is not a control assessment. It does not score any NIST SP 800-171 requirement. It does not replace the System Security Plan (SSP), a self-assessment in the Supplier Performance Risk System (SPRS), or an assessor's decision. The companion guide, Getting Started with CMMC, explains each term.

Print the page, or copy each table into your own document.
Write one owner in each row. A row with no owner stays open.
Record the location of the evidence, not the evidence itself. Do not paste Controlled Unclassified Information (CUI) into the worksheet.
Write the open question when you do not know the answer. Ask your contracting officer or prime contractor, and keep the written reply.
Review the worksheet on a set date. Update the dates.

1. Contract review

Task	Owner	Evidence location	Open question	Target date
List each active contract and solicitation with the Department of War (DoW) or a prime contractor.
Find DFARS 252.204-7025 in each solicitation. Record the CMMC level in paragraph (b)(1).
Find DFARS 252.204-7021 in each contract. Record the level in paragraph (d)(1).
Find DFARS 252.204-7012 in each contract. Note that it applies with or without a CMMC level.
Find FAR 52.204-21 or FAR 52.240-93 in each contract. Both clauses set the same 15 basic safeguarding requirements for FCI.
For subcontracts, record the flow-down terms from the prime contractor.
If the level is not clear, ask the contracting officer or the prime contractor. File the written reply.
Record the current CMMC program status and the date you checked it. See the status section of the guide.

2. Data identification

Task	Owner	Evidence location	Open question	Target date
List the information that each contract provides to you or that you create for the Government.
Decide which information is Federal Contract Information (FCI). Record the reason.
Decide which information is CUI. Record the marking, the category, and the contract reference.
Record the information that is neither FCI nor CUI, such as information that the Government provides to the public, or simple transactional information.
Record who sends the information to you and how it arrives.
Record where each type of information goes after you receive it, through disposal.

3. Scope

Task	Owner	Evidence location	Open question	Target date
Draw the data flow for FCI and for CUI. Include email, file shares, cloud services, backups, printers, and paper.
List each information system that processes, stores, or transmits FCI or CUI.
For Level 2, sort each asset into one category from 32 CFR 170.19: CUI Asset, Security Protection Asset, Contractor Risk Managed Asset, Specialized Asset, or Out-of-Scope Asset.
List each external service provider that processes, stores, or transmits FCI or CUI. Record its role and its own compliance evidence.
Record the boundary of each system. Draw the network diagram.
Decide whether a smaller scope is possible, for example a separate enclave for CUI. Record the decision.

4. Inventory

Task	Owner	Evidence location	Open question	Target date
List each device in scope: computers, mobile devices, servers, and network equipment.
List each user account and each service account in scope. Mark the accounts with administrative access.
List each cloud service and each application in scope.
Compare the device list against the directory and the device management records. Record the differences.
Compare the account list against the current employee and contractor list. Record the accounts that belong to inactive identities.
Set the interval for the next inventory update.

5. Ownership

Task	Owner	Evidence location	Open question	Target date
Name the person who leads the CMMC effort.
Name the Affirming Official who will affirm in SPRS.
Name an owner for each system in scope.
Name an owner for each external service provider relationship.
Name an owner for each NIST SP 800-171 requirement family, such as access control or configuration management.
Decide who approves changes to systems in scope. Record the approval path.

6. Evidence collection

Task	Owner	Evidence location	Open question	Target date
Decide where evidence will live. Use one location that the team can find and that keeps a history.
For each requirement, record the evidence type: policy, configuration, record, screenshot, log, or report.
Collect evidence in final form. Replace drafts with approved versions.
Record the date, the source system, and the collector for each piece of evidence.
Set a refresh interval for evidence that changes, such as access lists and device inventories.
Plan to keep assessment artifacts for six years.

7. Remediation

Task	Owner	Evidence location	Open question	Target date
Plan the self-assessment against the NIST SP 800-171A objectives. Record where the team will keep the findings.
Make a remediation list for each gap. Give each item an owner and a date.
Mark this list as an internal list. It is not a CMMC Plan of Action and Milestones (POA&M) until it meets 32 CFR 170.21.
Decide which fixes need an approval. Record the approval before the change.
After each fix, collect follow-up evidence that shows the result.
Review the remediation list at a set interval. Close the items with evidence.

8. Documentation

Task	Owner	Evidence location	Open question	Target date
Write or update the System Security Plan (SSP). Level 2 requires it. For Level 1, the DoW recommends it.
Write or update the policies and procedures that the requirements expect.
Write the scope statement and attach the network diagram and the asset inventory.
Record the shared responsibility for each external service provider.
Keep a change record for each documented change in scope.
Set a review date for each document.

9. Assessment and reporting

Task	Owner	Evidence location	Open question	Target date
Confirm the assessment type that your contract names: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC).
Confirm that the current program status allows that type. See the status section of the guide.
Confirm access to SPRS and the Procurement Integrated Enterprise Environment (PIEE) for the Affirming Official.
For a Level 2 self-assessment, score the results with the CMMC Scoring Methodology in 32 CFR 170.24. For Level 1, there is no score, and each of the 15 requirements must be MET. Enter the results in SPRS.
Submit the affirmation after the assessment. Record the CMMC Status Date and the CMMC unique identifier (UID).
If a POA&M applies, record the closeout deadline of 180 days from the Conditional status date.

10. Recurring review

Task	Owner	Evidence location	Open question	Target date
Set the date for the next annual affirmation.
Set the date for the next assessment: every year at Level 1, every three years at Level 2 and Level 3.
Set the interval for access reviews, inventory updates, and evidence refresh.
Set a date to check the official CMMC page for program changes.
Set a date to review new contracts and solicitations for new requirements.
Record the lessons from the last review. Update this worksheet.

Terms on this page

CMMC: Cybersecurity Maturity Model Certification.
FCI: Federal Contract Information.
CUI: Controlled Unclassified Information.
SSP: System Security Plan.
POA&M: Plan of Action and Milestones.
SPRS: Supplier Performance Risk System.
C3PAO: CMMC Third-Party Assessment Organization.
DIBCAC: Defense Industrial Base Cybersecurity Assessment Center, part of the Defense Contract Management Agency (DCMA).
PIEE: Procurement Integrated Enterprise Environment, the portal that gives access to SPRS.

Next step

Read Getting Started with CMMC for the explanation of each step. On a Level 2 path, see identity, access, and device evidence in saved reports. Request a Hyphen demo. Hyphen does not certify your organization.

This checklist is general information, not legal advice. Your contract, your data, and your assessment scope determine your path.