CMMC 2.0 Compliance Checklist Template

What the CMMC Compliance Checklist Covers

1. 1
   Phase 1

   Phase 1: Contracts, Level & Scope

   6 tasks

   Answers on the first task decide which of Phases 2, 3, 4 and 7 appear.

   • Record the CMMC level each contract requires — from clause 252.204-7021 or the 252.204-7025 notice, including any amendment removing a C3PAO or Level 3 requirement
   • Classify the information each contract involves — FCI only, or CUI as marked by the Government; any CUI means Level 2 at least
   • Categorise every in-scope asset — CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets or Out-of-Scope (32 CFR 170.19)
   • List external service providers — a cloud service holding CUI must meet the FedRAMP requirements in DFARS 252.204-7012; other providers’ services are assessed as part of yours
   • Flow the right level down to subcontractors — Level 1 (Self) for FCI only, at least Level 2 (Self) for CUI (32 CFR 170.23)
   • Name the Affirming Official — the senior representative who will sign every affirmation in SPRS
2. 2
   Phase 2

   Phase 2: Level 1 Self-Assessment

   4 tasks

   Shown only when no CUI is in scope; a Level 2 status already covers Level 1.

   • Assess the 15 Level 1 requirements — using the NIST SP 800-171A objectives, reading FCI wherever an objective says CUI
   • Fix every gap before submitting — Level 1 allows no POA&M, so a single NOT MET means no status
   • Enter the result in SPRS — level, status date, assessment scope, CAGE codes and the compliance result
   • Submit the Level 1 affirmation — then schedule next year’s self-assessment before this one expires
3. 3
   Phase 3

   Phase 3: Level 2 Evidence Base

   6 tasks

   Shown when CUI is in scope.

   • Update the system security plan (3.12.4) — boundary, environment and how each of the 110 requirements is met; without a current SSP an assessment cannot be completed
   • Map evidence to every 800-171A objective — policies, configurations and records in final form, because drafts and working papers do not count
   • Confirm FIPS-validated encryption protects CUI (3.13.11) — non-validated encryption still costs 3 points
   • Confirm multi-factor authentication for all users (3.5.3) — MFA for remote and privileged users only costs 3 points, none costs 5
   • Close the gaps a POA&M cannot hold — any requirement worth more than 1 point (bar non-validated encryption), plus 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5 and 3.12.4
   • Describe enduring exceptions and operational plans of action in the SSP — properly documented, both are assessed as MET
4. 4
   Phase 4

   Phase 4: Level 2 Assessment & SPRS

   5 tasks

   The C3PAO task appears only for Level 2 (C3PAO) or Level 3. The POA&M answer on the scoring task controls Phase 5.

   • Score the assessment under 32 CFR 170.24 — start at 110 and subtract 5, 3 or 1 point for each requirement NOT MET; the score can go negative
   • Test against the conditional threshold — 88 or more with only permitted items on the POA&M gives Conditional status; anything less gives none
   • Engage an authorised C3PAO — chosen from the Cyber AB Marketplace; results go into CMMC eMASS and flow to SPRS
   • Enter the self-assessment in SPRS — score, status date, scope, CAGE codes and POA&M usage, under a CMMC unique identifier per system
   • Submit the affirmation — required at the completion of every assessment, whether the status is Conditional or Final
5. 5
   Phase 5

   Phase 5: POA&M Closeout

   5 tasks

   Shown only when the assessment left requirements NOT MET on a POA&M.

   • Set the deadline at 180 days from the Conditional CMMC Status Date — if the POA&M is not closed by then, the status expires
   • Give each open requirement an owner and a date — review progress weekly rather than in the last month
   • Run the POA&M closeout assessment — covering only the POA&M items, done by you for Level 2 (Self) and by a C3PAO for Level 2 (C3PAO)
   • Update SPRS and submit a new affirmation — an affirmation is required after every closeout
   • Record the Final status date — it sets the date of the next affirmation
6. 6
   Phase 6

   Phase 6: Annual Affirmation

   6 tasks

   Runs every year from the Final CMMC Status Date.

   • Review what changed since the last assessment — new systems, sites, service providers or CUI flows that alter the scope
   • Re-check the requirements that drift — account reviews, patching, audit log review, training records and visitor logs
   • Confirm subcontractors have current affirmations — primes must ensure each one completes and maintains its own
   • Confirm cyber incident reporting works — DFARS 252.204-7012 requires a report to DoD within 72 hours of discovery
   • Submit the annual affirmation in SPRS — for each CMMC unique identifier covered by the contract
   • Diarise the next assessment — Level 1 every year; Level 2 and Level 3 within three years of the status date
7. 7
   Phase 7 — Level 3 Only

   Phase 7: Level 3 (DIBCAC) Preparation

   5 tasks

   Shown only when a contract requires Level 3, which DoD expects to reserve for its most critical programmes.

   • Confirm Final Level 2 (C3PAO) status for the Level 3 scope — DIBCAC will not start a Level 3 assessment without it
   • Implement the 24 selected NIST SP 800-172 requirements — with the DoD-assigned parameters in table 1 to 32 CFR 170.14(c)(4)
   • Stand up a 24/7 security operations centre and a 24-hour response team — 3.6.1e and 3.6.2e, neither of which can go on a POA&M
   • Document the threat-informed risk assessment and supply chain risk plan — also excluded from a Level 3 POA&M
   • Affirm both statuses every year — Level 2 (C3PAO) and Level 3 (DIBCAC), because each assessment checks different requirements