Every CMMC compliance checklist worth following is really a sequence — do the steps out of order and you pay for the same work twice. This is the order we use on client programs and used on our own: CLOUD2E holds CMMC Level 2 as an organization, so this CMMC checklist is the one we actually ran. It tracks the Level 2 requirements as defined in 32 CFR Part 170 and NIST SP 800-171 Rev. 2 — print it, assign names to steps, and it becomes a program.
The checklist
- 1. Scope your CUI. Inventory contracts for DFARS 252.204-7012 and CUI markings, then map where CUI actually enters, lives, and moves — systems, people, locations. Every later dollar depends on this map being honest. (Unsure you even need Level 2? Start with who needs CMMC.)
- 2. Choose enclave or whole-organization scope. A contained CMMC enclave usually shrinks cost, timeline, and assessment surface at once; sometimes the whole org genuinely is the scope. Decide deliberately — it is the biggest lever on the entire list.
- 3. Make the GCC High decision. If ITAR or certain CUI categories live in your collaboration stack, evaluate Microsoft 365 GCC High migration now, not after remediation — tenant moves rearrange everything downstream.
- 4. Gap-assess all 110 requirements, family by family — access control through system integrity — scored objective by objective the way NIST SP 800-171A directs, not control by control.
- 5. Write the SSP against reality. A System Security Plan describing the environment you actually run, not the one a template imagines.
- 6. Build the POA&M under the real rules. Under 32 CFR § 170.21, only designated lower-weight requirements are POA&M-eligible, your score must reach at least 80% of maximum, and items close within 180 days. Plan to that math from day one.
- 7. Compute and post your SPRS score. The DoD methodology, applied honestly — an executive affirms it, and inflated scores are a False Claims Act problem.
- 8. Operate and collect evidence. Access reviews that ran, logs with retention, maintenance records, incident drills — assessors want history, not screenshots from last Tuesday.
- 9. Mock-assess. A dry run with fresh eyes against 800-171A, interviews included — the step that converts surprises into punch-list items. (What the real week feels like: our assessment walkthrough.)
- 10. Schedule your C3PAO early. Calendar capacity is the program bottleneck; pick from the Cyber AB marketplace and book before you feel ready. Budget context: what certification costs.
Running this CMMC compliance checklist as a living program — registries, evidence, POA&M, maintenance — is exactly what our CMMC Tracker does, in your own tenant, free for compliance clients. The wider context for every step is in the complete CMMC certification guide.