A CMMC compliance checklist has two tracks: Level 1 (17 basic safeguarding practices, annual self-assessment, for Federal Contract Information) and Level 2 (all 110 NIST SP 800-171 controls, SPRS score plus possible C3PAO assessment, for Controlled Unclassified Information). The practical work falls into six phases: scope, gap-assess, plan, remediate, document, and assess.
This checklist reflects 32 CFR 170 requirements and the current program status — even with CMMC Phase II timelines under review, DFARS 252.204-7012/7019/7020 obligations apply today (see what the suspension actually changed).
Step 0 — Determine your level
Handle only FCI (contract data not intended for public release)? Level 1. Handle CUI — export-controlled drawings, ITAR data, DFARS-marked technical data? Level 2. Unsure which data you hold, or whether an enclave could shrink your scope? That single decision typically changes total cost by 40-60% — our cost & roadmap planner asks the five questions that settle it.
CMMC Level 1 checklist — the 17 practices
| ID | Level 1 practice |
|---|---|
| 3.1.1 | Limit system access to authorized users |
| 3.1.2 | Limit access to permitted transactions and functions |
| 3.1.20 | Verify and control connections to external systems |
| 3.1.22 | Control CUI posted on publicly accessible systems |
| 3.5.1 | Identify system users and devices |
| 3.5.2 | Authenticate users, processes and devices |
| 3.8.3 | Sanitize or destroy media before disposal |
| 3.10.1 | Limit physical access to authorized individuals |
| 3.10.3 | Escort and monitor visitors |
| 3.10.4 | Keep physical access audit logs |
| 3.10.5 | Control physical access devices |
| 3.13.1 | Monitor and protect communications at boundaries |
| 3.13.5 | Public-access subnetworks separated from internal |
| 3.14.1 | Identify, report and correct system flaws |
| 3.14.2 | Malicious code protection at designated locations |
| 3.14.4 | Update malicious code protection mechanisms |
| 3.14.5 | Periodic and real-time system scans |
For each practice you need: it implemented, someone accountable, and an annual affirmation in SPRS by a senior official. No score is submitted for Level 1.
CMMC Level 2 checklist — six phases
Phase 1: Scope (weeks 1-2)
Inventory where CUI lives, flows, and is stored; diagram it; decide enclave vs whole-enterprise; identify external providers (cloud must meet FedRAMP Moderate equivalency for CUI; ITAR needs US-persons controls — see the full controls list for what applies in scope).
Phase 2: Gap assessment (weeks 2-4)
Score all 110 controls honestly against the DoD methodology — fully implemented or not, with partial credit only on 3.5.3 (MFA) and 3.13.11 (FIPS). Use the free SPRS calculator to get your real number before anyone else does.
Phase 3: Plan & budget (weeks 4-6)
Turn gaps into a POA&M with owners and dates. Budget honestly: assessment is only 25-40% of total cost; the rest is remediation, tooling, and documentation. Benchmarks by company size are in the CMMC Cost Index.
Phase 4: Remediate (months 2-8)
Highest-weight controls first (the 5-pointers), then MFA everywhere, FIPS-validated encryption, logging/SIEM, incident response runbooks, and access reviews. This is where a 24/7 SOC and managed hardening matter most.
Phase 5: Document (parallel)
System Security Plan (mandatory — no SSP, no SPRS submission), policies mapped to the 14 families, evidence per control (screenshots, configs, tickets), shared-responsibility matrix for every provider.
Phase 6: Assess & submit
Submit your self-assessment score to SPRS; keep affirmations current. If your contracts will require certification, book a C3PAO early — see what a C3PAO is and what assessments cost.
Frequently asked questions
Can I do CMMC compliance myself?
Level 1 usually yes. Level 2 is realistic in-house only if you have dedicated security staff; most SMBs use outside help for the gap assessment, SSP, and hardest technical controls, then keep operations internal.
How long does CMMC Level 2 take?
Typically 6-12 months from first gap assessment to assessment-ready for an SMB, driven mostly by remediation scope and whether you build an enclave.
Does the CMMC suspension mean I can stop?
No. The DFARS clauses in your current contracts still require NIST 800-171 implementation and a current SPRS score. Primes are still screening on it.
What does CMMC compliance cost?
From roughly $2-8k (Level 1, 10 users) to $190-330k first-year (ITAR enterprise). A 25-user Level 2 enclave lands near $90k all-in. Full breakdown in the cost guide.
Assess all 110 controls in your browser.Build your cost & roadmap →
Enclave vs enterprise, budget, dates.Book a fixed-fee gap analysis →
Evidence-level review, 30-50% below US rates.
ITSECOPS runs CMMC readiness for US and international defense suppliers. Informational, not legal advice.