CMMC Readiness Check

Have you identified every system that stores, processes, or transmits Controlled Unclassified Information (CUI) or Federal Contract Information (FCI)?

Scoping determines which CMMC level and which of the 110 requirements apply to your company.

Do you have a written System Security Plan (SSP) describing your network, systems, and how CUI is protected?

An SSP is required for Level 2 and can never be waived with a POA&M (CA.L2-3.12.4).

If any cloud service (email, file storage, backup) handles CUI, is it FedRAMP Moderate authorized or an approved equivalent?

DoD requires cloud providers touching CUI to meet the FedRAMP Moderate baseline or a validated equivalent.

Do your prime contract or subcontract terms state whether you only handle FCI, or also handle CUI?

FCI-only companies need Level 1 (the 15 FAR 52.204-21 requirements); any CUI handling triggers Level 2 (110 NIST SP 800-171 requirements).

Do you limit system access to only the employees, contractors, and devices that need it for their job?

Basic access control is required for FCI (FAR 52.204-21(b)(1)(i)) and for CUI (AC.L1-3.1.1).

Do you require multi-factor authentication (password plus a phone app, token, or key) for remote and administrator access?

MFA (requirement 3.5.3) is a 5-point item in the DoD scoring method and cannot be skipped.

Does every employee log in with their own unique username, never a shared or generic login?

Unique identification (IA.L1-3.5.1) lets you trace every action on CUI systems to one person.

Do you control and monitor connections from outside your network, such as remote workers, home computers, or vendor VPNs?

External connections (AC.L2-3.1.20) can never be POA&M'd; it must be fully in place to pass.

Do you keep logs of who accessed sensitive systems, and review those logs regularly for unusual activity?

Audit logging (requirement 3.3.1) is how you detect and prove what happened during an incident.

Do you have a process for approving and tracking changes to computer settings, patches, and new software?

Configuration management (requirement 3.4.1) stops unauthorized or risky changes from opening security gaps.

Is CUI encrypted with FIPS-validated encryption whenever it is stored on a device or sent over a network?

FIPS-validated cryptography (3.13.11) is a heavily weighted item, though the one 5-point control that may still be POA&M'd.

Do all computers and servers run anti-malware or antivirus software that updates itself automatically?

Malicious code protection (FAR 52.204-21(b)(1)(xiii)-(xiv)) blocks common ransomware and virus entry points.

Do you track USB drives, backup media, and other removable storage containing CUI, and wipe or destroy it before disposal?

Media protection (3.8.1, 3.8.3) prevents sensitive data from leaving on a lost or discarded device.

Do you have a written plan for detecting, reporting, and recovering from a cybersecurity incident?

An incident response plan (requirement 3.6.1) turns a breach into a managed event instead of chaos.

If CUI were exposed in a breach, could you report it to the Department of Defense within 72 hours?

DFARS 252.204-7012(c) requires rapid reporting to DIBNet; missing the window is itself a compliance failure.

Do you control physical access to your office, server room, or any area where CUI is stored, using locks or badges?

Physical access control (FAR 52.204-21(b)(1)(viii)) is required even at Level 1 and keeps unauthorized people out.

Do you log visitors and escort them while they are in areas containing CUI or sensitive systems?

Visitor escort and physical access logs (3.10.3, 3.10.4) can never be POA&M'd for Level 2 Conditional status.

Do you screen new employees before granting CUI access, and cut off access the same day someone leaves?

Personnel security (3.9.1, 3.9.2) closes the most common insider-risk window: former employees.

Do you train employees at least once a year on phishing, password safety, and handling sensitive information?

Security awareness training (3.2.1) is required, and it is one of the simplest controls to put in place and prove.

Have you assessed the risks and vulnerabilities to the systems that handle your CUI or FCI?

Risk assessment (3.11.1) is the basis for prioritizing which security gaps to fix first.

Have you completed and scored a full self-assessment against every required NIST SP 800-171 practice in the last 3 years?

A current assessment (3.12.1) is required, and a CMMC Level 2 self-assessment must be repeated at least every three years.

For any requirement you have not fully met, do you have a written Plan of Action & Milestones (POA&M) with target dates?

A POA&M is allowed for most Level 2 gaps only above an 80% score and never for 6 named requirements.

Have you submitted your current NIST SP 800-171 self-assessment score to the Supplier Performance Risk System (SPRS)?

An SPRS score is a condition of contract award under the CMMC acquisition rule; no score, no award.

Do you submit an annual affirmation in SPRS confirming that you still meet your CMMC requirements?

A senior official must affirm compliance after every assessment and every year after that.

Do your subcontracts require any subcontractor who will see CUI to meet the same CMMC/NIST SP 800-171 requirements?

Flow-down (DFARS 252.204-7012(m)) makes you responsible for your supply chain's cyber posture, not just your own.