CMMC Compliance Checklist (On-Page, No Fake Downloads)

Universal Programme Checklist

• [ ] Contracts inventoried for FCI vs CUI and designated CMMC level
• [ ] Assessment boundary documented (assets, users, ESPs)
• [ ] SSP current and mapped to applicable requirements
• [ ] Roles assigned: affirming official, system owners, IR lead
• [ ] DFARS 252.204-7012 incident path tested (72-hour DoD reporting clock)
• [ ] Subcontractor / MSP flow-down status known

Level 1 Additions (15 FAR 52.204-21)

• [ ] All 15 basic safeguarding requirements assessed as MET (no POA&M path)
• [ ] Self-assessment evidence retained
• [ ] Affirmation submitted per programme / contract instructions

Level 2 Additions (110 Requirements)

• [ ] All 14 domains covered (AC, AT, AU, CM, IA, IR, MA, MP, PE, PS, RA, CA, SC, SI)
• [ ] SPRS score entered (max 110) with methodology notes
• [ ] Annual affirmation calendar set; assessment on 3-year cycle
• [ ] If Conditional: score ≥ 88/110, criticals MET per §170.21, POA&M closeout ≤ 180 days
• [ ] Logging / SIEM review procedures for AU family evidenced

Level 3 Gate (When Designated)

• [ ] Valid Level 2 C3PAO prerequisite
• [ ] 24 selected NIST SP 800-172 (Feb 2021) requirements implemented
• [ ] Ready for DCMA DIBCAC assessment

How CyberSilo Helps

• Turn this checklist into living CSA tasks and evidence links
• ThreatHawk for AU/SI operational proof

Frequently Asked Questions

Is there an Excel download on this page?

No. This is an on-page checklist. Export from your GRC/CSA tool if you need a spreadsheet.

Can Level 1 items be on a POA&M?

No. POA&M is not allowed for Level 1.

What is the Conditional Level 2 minimum score?

80% of max — 88 of 110 — plus critical requirements MET per §170.21, then close POA&Ms within 180 days.

Related CMMC Resources

CMMC hub · Assessment process · SPRS · POA&M · DFARS 7012 IR