Toolkit
CMMC readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Any defence contractor or subcontractor in the US defence industrial base that processes, stores or transmits Federal Contract Information or Controlled Unclassified Information on contractor systems.
Scope
- Flows down to subcontractors at the level appropriate to the information they actually handle
- Level 1 covers Federal Contract Information; Level 2 covers Controlled Unclassified Information (CUI); Level 3 covers CUI on higher-priority programmes
- Phase 2 third-party certification is currently suspended pending review, but Phase 1 self-assessment and the underlying DFARS 252.204-7012 duties remain in force
Key requirements
- Identify every contract, system and location that touches Federal Contract Information or CUI
- Meet the 15 basic safeguarding requirements of FAR 52.204-21 for Level 1
- Meet the 110 security requirements of NIST SP 800-171 Rev. 2 for Level 2
- Write a system security plan describing the assessment boundary and how each requirement is met
- Self-assess, post the score to SPRS, and have a senior official affirm it annually
- Consider an enclave to limit how far CUI spreads across the network
- Use FedRAMP Moderate (or equivalent) cloud services for anything touching CUI
Evidence to gather
- System security plan and network/data-flow diagrams
- Asset inventory with scoping categories
- Policies and procedures for each of the 14 NIST SP 800-171 families
- SPRS score and the senior official's affirmation
- Incident response records, including DFARS reporting
- Plan of action and milestones for open items
Common gaps
- Assuming the Phase 2 suspension means CUI protection itself is optional — it isn't
- Letting CUI spread across the whole corporate network instead of scoping it down
- A system security plan that describes controls that aren't actually implemented
- Affirming a score the organisation can't actually support with evidence
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full CMMC guide, the official text, or a qualified adviser.