Your CMMC Compliance Checklist: 11 Steps for Getting Started
If your business isn’t prepared for a Cybersecurity Maturity Model Certification (CMMC) assessment, starting the process today is crucial. The rollout of CMMC as a requirement for new U.S. Department of Defense (DoD) contracts is set to begin around Q3 of 2025. With the average time for achieving compliance taking around 9-12 months, you need to start now to avoid potential delays down the line.
However, the path to CMMC compliance can be riddled with myths and feel over-complicated for many defense contractors. This checklist outlines 11 essential steps to help your organization begin the CMMC certification process. The 11 steps we will discuss in this checklist include:
- Getting Familiar with the CMMC Framework
- Determining the Appropriate CMMC Maturity Level
- Deciding Who’s Responsible for CMMC Compliance
- Assessing Your Data and Determining Your CMMC Compliance Boundary
- Reviewing Your Existing Cybersecurity Frameworks
- Conducting a NIST 800-171A Self-Assessment
- Establishing a System Security Plan (SSP)
- Building a Plan of Action and Milestones (POA&M)
- Implementing Improvements Based on POA&M and Setting a Timeline for Full Compliance
- Conducting a CMMC Self-Assessment
- Choosing a CMMC Third Party Assessor Organization (C3PAO)
1. Get Familiar with the CMMC Framework
The DoD developed the CMMC framework to safeguard Controlled Unclassified Information (CUI) and protect against advanced persistent threats targeting national security. The framework provides cybersecurity standards and processes that DoD contractors and subcontractors must follow.
The CMMC accreditation body ensures compliance by defining multiple levels of CMMC with security practices that increase in complexity. The framework requires risk assessments, maturity modeling, and third-party security assessments to ensure adherence.
2. Determine the Appropriate CMMC Maturity Level for Your Organization
CMMC maturity levels define the requirements for handling sensitive information. CMMC 2.0 consolidated the original five model levels into a more efficient three-tiered system:
- Level 1 (Foundational) – Focused on basic requirements such as access control and authentication, suitable for contractors handling Federal Contract Information (FCI).
- Level 2 (Advanced) – Based on the 110 controls defined in NIST 800-171, designed for organizations handling CUI.
- Level 3 (Expert) – For contractors managing highly sensitive data, requiring advanced practices and government-led evaluations.
Start by identifying the required CMMC level based on the types of information your organization processes.
3. Decide Who’s Responsible for CMMC Compliance for Your Organization
Appointing a compliance lead is key. This service provider or individual should oversee your organization's efforts, ensuring that gap analysis, implementation, and documentation are properly managed. This person must be familiar with the CMMC framework and typically have a fundamental understanding of cybersecurity and IT requirements. Ensuring that there is clear ownership of this responsibility within your organization will help your company maintain a focused approach to achieving compliance; it enables you to keep track of all communications, requirements, and assessments and ensures continuous monitoring of security practices.
4. Assess Your Data and Determine Your CMMC Compliance Boundary
There’s a reason your business needs to be CMMC compliant. To start, evaluate where and how your organization handles CUI or FCI. Pinpointing your organization’s compliance boundary—the areas where sensitive data is stored or processed—simplifies the gap analysis and ensures a focused approach to compliance.
Determine which systems or networks your business uses that interact with this information, and which ones you need to focus on to meet CMMC compliance. Understanding the CUI your business is in contact with helps set your compliance boundary and assists with accurately scoping the necessary cybersecurity measures.
5. Review Your Existing Cybersecurity Frameworks to Determine Where to Start
You might have already adhered to security controls or achieved compliance before transitioning from CMMC 1.0 to CMMC 2.0. However, since some guidelines have changed, don’t assume that what worked before will work now. For example, prior compliance with NIST 800-171 or DFARS controls can provide a strong foundation. Ensure historical solutions meet the updated requirements of CMMC 2.0.
Take the time to reevaluate your cybersecurity frameworks and practices to ensure they align with the new CMMC 2.0 requirements. Identify existing controls and processes that meet the current standards and pinpoint any areas that need enhancement.
6. Conduct a NIST 800-171A Self-Assessment to Identify Gaps
Perform a self-assessment based on NIST SP 800-171A Rev2, which outlines methods and procedures for evaluating the implementation of security requirements. Although NIST 800-171 and CMMC are complementary standards, they differ in compliance requirements: NIST 800-171 compliance can be achieved through self-assessment, whereas CMMC requires a third-party audit for certification. By completing the NIST 800-171 self-assessment first, you can identify gaps in your current cybersecurity practices in relation to CMMC requirements.
7. Establish a System Security Plan (SSP)
Your System Security Plan (SSP) is a comprehensive document detailing your security policies, controls, and measures. This key step helps outline your organization’s efforts to protect information integrity and meet CMMC requirements.
To stay on track for CMMC compliance, develop your business SSP plan to formally document your organization’s cybersecurity practices, policies, and procedures. The SSP should detail how your organization implements the required CMMC practices and controls so you have a detailed account and comprehensive overview of your cybersecurity framework.
8. Build a Plan of Action and Milestones (POA&M)
Create a Plan of Action and Milestones (POA&M) to address any gaps identified during your self-assessment. A POA&M outlines the steps needed to achieve full compliance in your organization. If your organization struggles to meet specific security controls, a POA&M can help identify these gaps and outline the necessary technologies or procedures to address them. Use this tool to streamline improvement timelines and progress monitoring.
9. Implement Improvements Based on POA&M and Set a Timeline for Full CMMC Compliance
Assess your organization’s progress toward CMMC compliance and establish a realistic timeline for achieving full certification. Address priorities outlined in your POA&M and incorporate remediation plans to fix security shortfalls. Consider factors such as the complexity of the required controls, resource availability, and contractual deadlines. You might also consider partnering with a Registered Provider Organization (RPO), which can help with various performance metrics and assist you through the compliance process.
10. Conduct a CMMC Self-Assessment
Perform a CMMC self-assessment to verify that your organization meets the required practices and processes for your targeted maturity level. A mock assessment should simulate the official CMMC evaluation, focusing on evidence collection, auditor Q&A, and policy walkthroughs. Use it to test both your cybersecurity posture and your team's readiness to present it.
Thoroughly evaluate your current practices and identify specific vulnerabilities (if there are any) before undergoing the official assessment. This approach ensures that your company will be well-prepared for future evaluations and increases your likelihood of achieving the desired certification level.
You can also assess your compliance posture with our CMMC readiness questionnaire.
11. Choose a CMMC Third Party Assessor Organization (C3PAO)
For organizations falling into CMMC level 2, you will select a Certified Third-Party Assessor Organization (C3PAO) for your official CMMC assessment. The C3PAO will evaluate your organization’s compliance with the CMMC requirements and issue a certification based on your demonstrated cybersecurity practices. Choosing a reputable and experienced C3PAO is crucial for a successful assessment.
Reach CMMC Compliance with ISI
Achieving CMMC compliance is a complex but essential process for organizations that handle sensitive information and work with the DoD. Following the 11 steps above and getting familiar with the CMMC framework will make your path to CMMC compliance much easier.
At IsI, we understand the challenges of CMMC compliance and are here to support you every step of the way. Regardless of where you are in your compliance journey, our expertise can help you navigate the complexities of CMMC to achieve and maintain compliance. Contact us today to learn more about how we can help you achieve CMMC certification.
FAQs About CMMC Compliance
What Are the CMMC Levels and Their Requirements?
CMMC includes several maturity levels, each with specific cybersecurity requirements:
CMMC Level 1 – Foundational
Level 1 focuses on basic cybersecurity practices, including 17 essential controls like access control and physical security measures. This level requires an annual self-assessment and affirmation, establishing a baseline for organizations handling less sensitive federal contract information (FCI).
CMMC Level 2 – Advanced
Level 2 includes all Level 1 practices and expands to implement all 110 security controls from NIST SP 800-171. It requires more advanced measures like incident response and risk management, with triennial assessments and annual affirmations, suitable for handling CUI.
CMMC Level 3 – Expert
Level 3, the highest level, involves comprehensive cybersecurity practices, including those from Levels 1 and 2, plus additional controls from NIST SP 800-172. This level requires continuous monitoring, advanced threat detection, and multi-year government-led assessments. This level is ideal for contractors dealing with highly sensitive information.
What are the Costs of CMMC Compliance?
While there is no fixed cost for CMMC compliance, the road to becoming compliant can become costly. These costs stem from an organization’s size, maturity level, and the complexity of required cybersecurity controls. For example, a company looking to comply with Level 3 will likely have to spend more money to meet technology standards than those looking to obtain Level 1. Expect these additional fees from cybersecurity implementation costs, consultants, and third-party assessment organizations.
How Long is CMMC Certification Good For?
The CMMC certification is valid for three years. Level 1 requires annual self-assessments, while Levels 2 and 3 require reassessments every three years.
Do Subcontractors Need to Be CMMC Compliant?
Yes, subcontractors within the defense industrial base (DIB) who handle CUI or FCI must also achieve CMMC compliance. Any organizations that receive DoD contracts or subcontracts from a prime contractor are impacted by flow-down requirements: they must adhere to the same level of compliance as the original contractor.
