CMMC 2.0 Compliance Checklist

Q: What is the difference between CMMC Level 1 and Level 2?

Level 1 covers contractors that handle only Federal Contract Information (FCI). It requires 15 basic safeguarding requirements and is met through annual self-assessment, with no outside assessor. Level 2 covers contractors that handle Controlled Unclassified Information (CUI). It requires all 110 controls from NIST SP 800-171 Revision 2, and for most contracts an authorized third-party assessor (C3PAO) has to verify your implementation. The trigger is the data category in your contract: FCI points to Level 1, while a DFARS 252.204-7012 clause and CUI point to Level 2.

Q: How many controls are in CMMC Level 2?

CMMC Level 2 requires all 110 controls from NIST SP 800-171 Revision 2, organized into 14 control families covering access control, authentication, audit and accountability, configuration management, incident response, system and information integrity, and more. Each control carries a scoring weight under the DoD's NIST SP 800-171 Assessment Methodology, and your score is submitted to the Supplier Performance Risk System (SPRS).

Q: Do I need a C3PAO to get CMMC certified?

For most Level 2 contracts, yes. A C3PAO is a Certified Third-Party Assessor Organization authorized to perform the formal CMMC Level 2 assessment. A subset of Level 2 contracts allow self-assessment, so check your specific contract, but assume third-party assessment unless it clearly says otherwise. Level 1 does not require a C3PAO; it is self-assessed. One firm cannot both prepare you and assess you, so your readiness consultant and your assessor must be different organizations.

Q: How long does it take to become CMMC compliant?

It depends on your scope and how mature your IT already is. A Level 1 effort is light and can often be done in a few weeks because most of the work is policy and basic hygiene. A full Level 2 readiness effort commonly runs several months from kickoff to assessor-ready, and longer if you are building CUI handling from scratch or your scope is large. The biggest accelerant is containing CUI in a defined enclave so you do not have to harden your entire company.

Q: What documents does a CMMC assessment require?

The two central documents are the System Security Plan (SSP), which describes your in-scope environment and how each control is implemented, and the Plan of Action and Milestones (POA&M), which tracks controls not yet fully met along with owners and target dates. Around those you need an evidence package: policies and procedures mapped to each control family, configuration records, training records, and logs showing controls operating over time. Assessors also interview the people who run the controls, so documentation and operational reality have to match.

Q: Does CMMC 2.0 apply to subcontractors?

Yes. CMMC requirements flow down from the prime contractor to subcontractors based on the type of information being shared. If a prime passes you CUI, you generally need to meet the Level 2 requirements for the systems that handle it; if they pass only FCI, Level 1 may apply. If you are unsure what data category you are receiving, ask the prime or the contracting officer in writing before you scope your effort.

CMMC 2.0 Compliance Checklist for DoD ContractorsIf your company holds a Department of Defense contract, or wants to win one, the acronym CMMC will follow you through every new award and renewal. CMMC 2.0 (Cybersecurity Maturity Model Certification) is the DoD's way of verifying that contractors actually protect the government information they handle, instead of just promising they do. The final rule is in effect, and the certification requirement is being phased into DoD solicitations on a multi-year schedule. The reality for most contractors is simple: no certification at the required level, no contract.The problem is that CMMC reads like it was written for security engineers, not for the founder, IT lead, or contracts officer who has to make it happen. This CMMC 2.0 compliance checklist breaks the work into the order you should actually do it, in plain language. By the end you will know which level applies to you, what the 110 controls really ask for, which documents an assessor will demand, and where contractors most often stall. Use it to scope your effort honestly before you spend a dollar on tooling or assessors.Step 1: Confirm which CMMC level applies to youStep 2: Define your scope and map where CUI livesStep 3: Run a gap assessment against the 110 controlsStep 4: Produce the documents an assessor will demandStep 5: Remediate, then prepare for assessmentCommon mistakes that derail CMMC effortsCommon questions

What is the difference between CMMC Level 1 and Level 2?

How many controls are in CMMC Level 2?

Do I need a C3PAO to get CMMC certified?

How long does it take to become CMMC compliant?

What documents does a CMMC assessment require?

Does CMMC 2.0 apply to subcontractors?

Related service

cmmc-readiness