A useful CMMC assessment preparation checklist starts with three things: confirm the CMMC level actually required, lock the assessment scope, and prove each applicable requirement with evidence that matches what your systems and people really do. Do not begin by polishing policies. A beautifully formatted policy cannot rescue a control that is missing, mis-scoped, or impossible to demonstrate.
Open the practical working record to document this decision with evidence and an accountable owner.
There is also an important 2026 wrinkle. As of September 2026, the Department has suspended the planned transition to CMMC Phase II, originally scheduled for November 10, 2026, while Phase I self-assessment requirements remain in place. Check the current CMMC program status before assuming that an older implementation calendar or a sales proposal describes what your contract requires today.
Your first practical action is therefore simple: pull the solicitation, contract, relevant flow-down clauses, current SPRS information, System Security Plan, asset inventory, and network diagram into one working folder. Those documents tell you whether you are preparing for the correct assessment and whether everyone is talking about the same environment.
Table of Contents
CMMC Assessment Preparation Checklist at a Glance
The checklist below is ordered by dependency. Scope comes before evidence; evidence comes before rehearsal. Reversing that sequence creates the compliance equivalent of labeling moving boxes before deciding which house you are moving into.
| Preparation Step | What You Should Have | Failure Signal |
|---|---|---|
| Confirm requirement | Contract or solicitation requirement, required CMMC level, assessment path | Team assumes Level 2 certification without checking contractual language |
| Define scope | CUI and FCI data flows, asset inventory, network diagram, external service inventory | No one can agree where CUI enters, resides, or leaves |
| Map requirements | Requirement-to-owner and requirement-to-evidence matrix | Controls are assigned to documents rather than responsible people and systems |
| Validate implementation | Evidence from documents, configurations, interviews, and tests | Policy says one thing while the system does another |
| Remediate gaps | Closed findings or properly managed permitted POA&Ms | Known technical gaps remain because the policy was updated instead |
| Reconcile documentation | Current SSP, diagrams, policies, procedures, inventories | Hostnames, tools, owners, or boundaries conflict across documents |
| Prepare personnel | Control owners who can accurately explain normal operations | Only the compliance consultant understands the evidence |
| Check administration | SPRS access, identifiers, affirming official, required submissions | Technical work is ready but no one owns the submission |
| Run a mock assessment | Timed evidence retrieval and representative demonstrations | Evidence exists but cannot be found or explained efficiently |
Confirm Which CMMC Assessment You Are Preparing For
The decision hinge is not simply “Are we CMMC compliant?” It is which CMMC status and assessment method applies to the contractor information systems supporting the contract.
Under the current Phase I posture, Level 1 uses an annual self-assessment and affirmation for the applicable basic safeguarding requirements. Level 2 addresses protection of CUI using the CMMC requirements based on NIST SP 800-171 Revision 2, with Phase I Level 2 self-assessment requirements remaining in effect. The planned expansion into Phase II requirements was suspended in July 2026.
This matters because preparing for an eventual C3PAO assessment and satisfying a currently required self-assessment are related but not identical business events. A company can sensibly build evidence to a third-party-assessment standard without claiming that its current contract requires third-party certification.
Before doing anything expensive, verify these points:
- Which contracts and subcontracts involve FCI or CUI?
- What CMMC level appears in the applicable solicitation or contract requirement?
- Which information systems will support performance of that work?
- Is the current requirement a self-assessment or another assessment type?
- Which subcontractors receive information that creates flow-down obligations?
- What CMMC status and affirmation information must be current in SPRS?
The current acquisition rules describe how CMMC requirements interact with contract award and contractor information systems. Review the current DFARS CMMC provisions rather than relying solely on an old presentation or vendor checklist.
Freeze the Assessment Scope Before Collecting Evidence
A weak scope can make good security controls nearly impossible to assess. The preparation team should be able to trace where protected information enters the organization, which assets process or protect it, where it is stored, how it moves, which people access it, and which external services participate.
For Level 2 preparation, the official CMMC scoping guidance requires considerably more discipline than simply drawing a box around an “IT network.” Relevant categories can include CUI assets, security protection assets, contractor risk-managed assets, specialized assets, and external services depending on their role.
Build a CUI data-flow view first
Start with information, not hardware. Pick representative CUI and follow it from receipt or creation through processing, storage, transmission, backup, printing, collaboration, and eventual disposal.
- Email and secure messaging
- Endpoints and virtual desktops
- File shares and document platforms
- Cloud applications
- Engineering or manufacturing systems
- Remote-access paths
- Backup services
- Security monitoring infrastructure
- Removable media where permitted
- Paper records and physical work areas
A common scoping failure is discovering during preparation that an apparently harmless SaaS product, backup repository, administrative workstation, or security service touches the assessed environment in a way nobody documented.
Reconcile the asset inventory and network diagram
Your asset inventory and network diagram should describe the same world. If the diagram contains a security platform that the inventory omits, or the inventory lists a CUI workstation that appears nowhere in the architecture, investigate the discrepancy rather than cosmetically editing one document.
The Department maintains the current CMMC scoping and assessment documentation. Use those materials as the reference point when deciding which assets belong in the assessment scope.
Build an Evidence Matrix for the Requirements
The fastest way to expose false readiness is to ask a slightly uncomfortable question for every requirement: What would we show if an assessor asked us to prove this right now?
Create one row per applicable requirement or assessment objective and record the owner, implementation location, expected evidence, evidence freshness, and any unresolved issue. This converts “we think we do that” into something testable.
| Evidence Field | Question to Answer |
|---|---|
| Requirement | What security outcome must be demonstrated? |
| Owner | Who operates or is accountable for the control? |
| System or process | Where is the requirement implemented? |
| Document evidence | Which SSP section, policy, procedure, ticket, record, or report supports it? |
| Technical evidence | Which configuration, console, log, setting, or system behavior demonstrates it? |
| Interview owner | Who can explain how it operates in normal work? |
| Validation | Has somebody independently checked the evidence against reality? |
| Gap | What remains incomplete, inconsistent, or unverified? |
Do not make screenshots your entire evidence strategy. A screenshot can establish that a setting appeared on a screen at one moment; it may not establish coverage, process consistency, ownership, or whether the configuration produces the intended outcome.
Validate Controls Through Examine, Interview, and Test
CMMC assessment preparation should test implementation, not merely documentation. The assessment methodology draws on approaches that include examining evidence, interviewing relevant personnel, and testing mechanisms or activities.
That creates a useful three-way consistency check:
- Examine: Does the SSP, policy, configuration record, log, ticket, or other artifact support the claimed implementation?
- Interview: Can the person responsible explain what actually happens, including exceptions?
- Test: Where appropriate, does the mechanism behave the way the organization says it behaves?
Suppose a procedure states that inactive accounts are disabled. The evidence question is not merely whether that sentence exists. Preparation should determine who identifies inactive accounts, how frequently the process runs, which identity systems are covered, how exceptions are handled, and whether representative records or technical behavior support the claim.
The current CMMC program still uses NIST SP 800-171 Revision 2 for Level 2 assessment purposes even though NIST has published Revision 3. The Department has indicated that incorporating Revision 3 into CMMC requires future rulemaking. NIST maintains its SP 800-171 CUI resources for organizations that need to distinguish the publications.
Find Documentation-to-Reality Gaps Before an Assessor Does
The most troublesome assessment gaps are often contradictions rather than total absence. A control may exist, yet its policy, SSP description, inventory, administrator explanation, and live configuration tell five slightly different stories.
Run a reconciliation pass across at least these artifacts:
- System Security Plan
- Network and data-flow diagrams
- Asset inventory
- User and privileged-access inventories
- Policies and operating procedures
- External service provider inventory
- Cloud service documentation
- Vulnerability and patch-management records
- Security event and logging configurations
- Training records
- Incident-response procedures and exercises
- Media-management records
- Physical-access processes
- Configuration-management records
Pay particular attention to names and boundaries. A service called one thing in the SSP, another in the network diagram, and a third by its administrators creates unnecessary ambiguity even when the security control itself works.
Prioritize Gaps by Assessment Impact, Not by Document Convenience
When the readiness review exposes dozens of issues, resist the temptation to close the easiest paperwork findings first merely because they make the tracker turn green. Prioritize gaps that represent missing security requirements, uncertain scope, absent evidence, or contradictions that could invalidate multiple claims.
Use four remediation buckets
- Missing implementation: the required security behavior is not operating.
- Incomplete coverage: the control exists but does not cover every relevant asset, account, location, or workflow.
- Evidence failure: the control may operate, but the organization cannot demonstrate it reliably.
- Documentation mismatch: implementation and formal documentation disagree.
This classification also prevents an expensive mistake: hiring writers to repair what is actually an engineering problem.
CMMC permits POA&Ms only under defined circumstances, and Level 1 does not permit them. Current Phase I guidance allows limited Level 2 POA&M use with required closeout. Treat a POA&M as a controlled exception mechanism, not as a general parking lot for unfinished security work.
Prepare the People Who Actually Operate the Controls
A technically mature environment can still produce a miserable assessment if every answer has to travel through one compliance manager. Control owners should understand the claim being made about their process and be able to demonstrate ordinary operation without memorizing regulatory prose.
Interview preparation should therefore sound more like operational review than exam coaching:
- Show how a new employee receives access.
- Explain how privileged access is approved and removed.
- Show how vulnerabilities become remediation work.
- Explain what happens after a security alert.
- Show how configuration changes are authorized.
- Explain how backups are protected.
- Show how security training completion is tracked.
- Explain what happens when a device leaves service.
If the documented process and the employee’s description diverge, investigate. Do not coach the employee to recite the document. The mismatch is the finding you wanted the rehearsal to uncover.
Run a Mock Assessment That Forces Evidence Retrieval
A mock assessment becomes useful when it creates friction. Select requirements across different control families and ask the team to produce supporting artifacts, identify the owner, explain the implementation, and demonstrate representative technical behavior where appropriate.
Measure retrieval quality rather than merely checking whether a file exists. Evidence that takes hours to locate, requires an absent employee, or cannot be tied to the assessed asset is operationally fragile.
Red, yellow, and green readiness test
| Status | Meaning | Next Action |
|---|---|---|
| Green | Implementation, documentation, owner explanation, and evidence agree | Keep evidence current and sample again before assessment |
| Yellow | Control likely operates but evidence, coverage, or documentation is uncertain | Resolve the uncertainty and retest |
| Red | Requirement is missing, contradicted, or cannot be demonstrated | Assign remediation ownership before assessment |
Do not calculate readiness simply by counting green rows. One red issue affecting identity infrastructure, CUI boundaries, or shared services can be more consequential than several minor documentation corrections.
Check SPRS, Affirmation, and Assessment Administration Early
Assessment preparation is partly technical and partly administrative. Current CMMC rules connect assessment status, contractor information systems, SPRS entries, and affirmation of continuous compliance.
Before the assessment window becomes tight, identify:
- Who has the necessary organizational access to SPRS?
- Who owns submission and verification of assessment information?
- Who is the affirming official?
- Which contractor information systems correspond to the relevant CMMC status?
- Are identifiers and organization information consistent across records?
- Who will verify that required entries appear correctly after submission?
A technically complete assessment can still become a contract problem if the required status or affirmation is not properly maintained where the contracting process expects to find it.
Decide What to Handle Internally and What Justifies Paid Help
CMMC preparation does not automatically require buying a compliance platform or hiring a consultant. Spending becomes justified when the unresolved problem is expertise, scale, independent validation, or preparation for an assessment your internal team cannot credibly simulate.
| Approach | Usually Makes Sense When | Watch For |
|---|---|---|
| Internal / DIY | Scope is small, internal security expertise is strong, and documentation is manageable | Blind spots caused by assessing your own assumptions |
| Compliance software | Evidence mapping, ownership, recurring collection, and workflow scale are becoming difficult | Paying for dashboards that do not solve missing controls |
| Consultant | Scoping, interpretation, remediation planning, or independent readiness review exceeds internal expertise | Consultants creating documents the technical team cannot defend |
| Assessment provider | A qualifying independent certification assessment is actually required | Confusing readiness consulting with the independent assessment itself |
If outside help appears necessary, separate remediation work from the cost of the formal assessment. The CMMC consultant cost guide explains what consulting work may add to the budget, while the CMMC Level 2 assessment cost guide focuses on the assessment-side cost structure.
For a broader budget that includes technology, remediation, internal labor, and recurring work rather than only an assessor invoice, use the CMMC compliance cost model.
What to Ask a CMMC Readiness Provider Before Paying
If you hire help, buy a defined outcome rather than a fog bank labeled “CMMC readiness.” Ask the provider to describe exactly what will be reviewed, what deliverables you will own, and what remains your responsibility.
- Will you validate assessment scope and CUI data flows?
- Will you review the SSP, inventory, diagrams, and technical implementation together?
- Will you map evidence to specific CMMC assessment objectives?
- Will you perform interviews and representative technical validation?
- Will findings distinguish missing controls from missing documentation?
- What remediation work is excluded?
- Will you provide a prioritized gap register rather than only a maturity score?
- How do you handle confidential technical evidence?
- Who performs the work, and are any portions subcontracted?
- What support is included after the readiness review?
A colorful readiness score without traceable findings is thin evidence. Before purchasing, request a sanitized sample deliverable or a sufficiently detailed methodology showing how findings connect to requirements, evidence, and remediation ownership.
Frequently Asked Questions
Should we still prepare for a C3PAO assessment while CMMC Phase II is suspended?
That depends on your contracts and business plans. The July 2026 suspension paused Phase II requirements, not the underlying need to protect applicable FCI and CUI or the Phase I self-assessment requirements. An organization expecting future contracts that could require independent certification may reasonably build stronger evidence now, but it should not represent a future possibility as a current contractual requirement.
Should we prepare against NIST SP 800-171 Revision 2 or Revision 3?
For current CMMC Level 2 purposes, the program continues to use the 110 security requirements based on NIST SP 800-171 Revision 2. NIST itself has published Revision 3, but the Department has stated that incorporating Revision 3 into CMMC requires future rulemaking. Do not silently substitute one revision for the other in your assessment evidence matrix.
Can a strong policy satisfy a CMMC requirement if the technical control is incomplete?
No document can create an implementation that does not exist. Policies and procedures may support assessment evidence, but preparation should verify that the relevant mechanisms, activities, and people actually produce the required security outcome.
How early should we involve technical control owners?
Before the evidence package is considered complete. Administrators, engineers, HR personnel, physical-security staff, and other process owners can expose stale documentation and unrealistic claims much earlier than a compliance-only review.
Does completing this checklist prove CMMC compliance?
No. A preparation checklist is a readiness tool. CMMC status depends on the applicable assessment process, required results, submissions, affirmations, and other program conditions. Treat the checklist as a way to find problems before the formal verification point, not as a substitute for it.
What to Do Before the Assessment
Spend the next 15 minutes on one requirement you currently believe is satisfied. Do not choose your best one.
- Identify the system or process implementing it.
- Find the SSP or procedural statement describing it.
- Name the employee who owns the activity.
- Retrieve one piece of current operational evidence.
- Confirm that the evidence applies to the actual assessment scope.
- Ask the owner to explain the process without reading the policy.
If all six pieces agree, you have the beginning of defensible assessment evidence. If they disagree, you have found something more valuable than another checklist item marked complete: a gap while there is still time to fix it.
Last reviewed: 2026-10
CMMC assessment rehearsal log
Use this when: you are a team preparing evidence retrieval and control demonstrations for a defined assessment scope. Copy the table into your working notes and replace the prompts with a dated response. Keep unresolved items visible rather than filling them with a default assumption.
| Decision field | What to record | Your evidence / owner / next check |
|---|---|---|
| Requirement sample | Choose one applicable requirement and its assessment objectives. | To complete |
| Evidence retrieval | Record artifact location, responsible operator and retrieval time. | To complete |
| Demonstration | Write what the operator can show and which objective it addresses. | To complete |
| Open gap | Assign a correction owner and a date for another rehearsal. | To complete |
How to use the result: Rehearse one requirement with its actual operator before adding more documents. Mark each row confirmed, provisional or unresolved, and link the source that supports the status. Keep a reviewer and review date beside decisions that affect spending, deployment or external claims.
This is an editorial working aid. Complete it with your own scope, source documents and responsible reviewers; the completed table alone does not establish compliance or acceptance.
Worksheet change record — October 20, 2026
Added this cmmc assessment rehearsal log with four article-specific working fields, evidence ownership and a next action. The article’s existing source notes retain their own review dates. This addition does not represent a new verification of every statement or a newly executed lab test.