How to Prepare for CMMC: Gap Assessment, Checklist, and Assessment Readiness

To prepare for CMMC, work through seven steps in order:

Confirm which level your contracts require.
Define the scope of systems, people, and providers that handle FCI or CUI.
Run an honest gap assessment against every requirement.
Remediate gaps, starting with those that can’t go on a POA&M.
Document everything in a System Security Plan.
Train your people.
Verify readiness before you post a score in SPRS or schedule an assessment.

Status, October 2026: Phase 1 self-assessments are in force. Mandatory C3PAO assessments (Phase 2) are suspended pending a DoW review. The preparation steps are the same either way. See where CMMC stands now.

Step 1: Confirm what your contracts require

Start with the paperwork, not the technology.

Read your contracts and target solicitations. Look for DFARS 252.204-7021, which names the CMMC level and assessment type, and for 252.204-7012, -7019, and -7020.
Identify the information you handle. FCI alone means Level 1. CUI means Level 2, or Level 3 for designated programs.
Ask when unsure. Your contracting officer, or your prime for subcontracts, can confirm the level and whether specific information is CUI.

See who needs CMMC and CMMC requirements by level.

Step 2: Define your CMMC scope

Scope decides how much of your organization has to meet every requirement, so it drives cost more than any other decision.

Map the data flow. Trace where FCI and CUI enter, where they are stored and processed, who touches them, and where they leave, including email, file shares, and endpoints.
Categorize assets. 32 CFR Part 170 sorts Level 2 assets into five categories, each treated differently in an assessment: CUI assets; Security Protection Assets (the tools that protect CUI); Contractor Risk Managed Assets; Specialized Assets; and out-of-scope assets.
Include your service providers. MSPs, MSSPs, and cloud services that handle CUI or Security Protection Data are in scope. Cloud services that store CUI must meet FedRAMP Moderate or an equivalent standard.
Decide on an enclave. If CUI touches only part of the business, isolating it in a dedicated enclave can shrink scope and cost dramatically.

The DoD CMMC Scoping Guide for your level is the authoritative reference for this step.

Step 3: Run a CMMC gap assessment

A CMMC gap assessment, also called a gap analysis or readiness assessment, measures your current environment against every requirement for your level. It produces:

A requirement-by-requirement status. Each of the 110 Level 2 requirements is evaluated at the level of its assessment objectives (320 in total) and marked met, not met, or partially met.
A realistic score, calculated the way an assessor would, so you know your true SPRS number.
A prioritized gap list, which becomes your remediation plan and your draft POA&M.

How to do it well: assess objectives, not just requirements; a requirement with one unmet objective is not met. Collect evidence as you go; if you can’t show it, you can’t claim it. Score conservatively; an optimistic gap assessment only moves the surprise to the real assessment.

Who should run it: your internal team, or an independent advisor such as a Registered Practitioner Organization. Do not use the C3PAO you plan to have certify you. CMMC’s conflict-of-interest rules bar a C3PAO from assessing an organization it provided consulting services to within the preceding three years.

Step 4: Remediate in the right order

Not all gaps are equal. At Level 2, requirements are weighted 5, 3, or 1 points, and generally only 1-point requirements can sit on a POA&M. Prioritize like this:

Requirements that can never be on a POA&M, including every 3- and 5-point requirement and the System Security Plan.
Big-ticket technical controls with long lead times, such as multifactor authentication, FIPS-validated encryption, centralized logging, and a FedRAMP Moderate-equivalent cloud environment for CUI.
Remaining 1-point gaps. Close as many as possible before assessment; plan the rest as POA&M items you can close within 180 days.

Remediation is usually the longest phase. For planning ranges, see CMMC cost and timeline.

Step 5: Document your program

Assessors evaluate what you document and then verify that it’s true. You’ll need:

A System Security Plan (SSP) describing your boundary, environment, and how each requirement is implemented. Write it from the real environment, not a template.
Policies and procedures for each requirement family.
A POA&M for any remaining eligible gaps.
A customer responsibility matrix for every service provider, showing who performs each control.
An evidence library, organized by requirement, with screenshots, configurations, logs, and records.

Step 6: Train your people

Awareness and Training is one of the 14 NIST SP 800-171 families. At Level 2 it requires general security awareness training for everyone who uses in-scope systems, role-based training for people with security responsibilities, and awareness of insider-threat indicators. Assessors also interview staff, so the people who run your controls must be able to explain them.

Step 7: Verify readiness, then report or schedule

Before you post a score or book an assessment, run your gap assessment again against the finished environment. Then take the path your contract requires:

Self-assessment (Level 1, or Level 2 where specified): score every requirement, post the result in SPRS, and have a senior official affirm it. Treat it with the same rigor as a third-party assessment, because it is a representation to the government.
C3PAO certification (Level 2 where specified): choose an authorized C3PAO from the Cyber AB Marketplace and schedule early, because assessor availability varies. See how CMMC works.

CMMC C3PAO Level Checklist

For what most often goes wrong, see 10 common CMMC mistakes.

How long preparation takes

It depends on scope and starting point. A contractor already close to NIST SP 800-171 can be ready in a few months. One starting from scratch should plan for a year or more. The cost and timeline page has a phase-by-phase planning model and DoD’s cost estimates.

Frequently asked questions

What is a CMMC gap assessment?

A CMMC gap assessment measures your current environment against every requirement and assessment objective for your CMMC level. It produces a requirement-by-requirement status, a realistic score, and a prioritized list of gaps to remediate. It is an internal or advisory exercise, not an official CMMC assessment, and it does not result in certification.

Who can perform a CMMC gap assessment?

Your own team can, or an independent advisor such as a Registered Practitioner Organization. The C3PAO you plan to use for certification should not, because CMMC conflict-of-interest rules bar a C3PAO from assessing an organization it provided consulting services to within the preceding three years. Use separate firms for readiness and certification.

What is the difference between a gap assessment and a CMMC assessment?

A gap assessment is a preparation tool that finds what is missing so you can fix it. A CMMC assessment is the formal evaluation that determines your status: a self-assessment posted to SPRS, a certification assessment by a C3PAO, or a DIBCAC assessment at Level 3. Only the formal assessment produces a CMMC status.

How do I prepare for a CMMC audit?

Confirm your required level, define and document your scope, run a gap assessment, remediate gaps that cannot go on a POA&M, complete your System Security Plan and evidence, train staff who will be interviewed, and verify readiness with a final self-check before posting a score or scheduling a C3PAO.

What documents do I need for a CMMC assessment?

At Level 2, you need a System Security Plan, policies and procedures for each requirement family, an asset inventory and network diagrams for your scope, a POA&M for any eligible open items, responsibility matrices for service providers, and evidence showing each requirement’s assessment objectives are met.

Can a company prepare for CMMC on its own?

Yes. Many contractors prepare internally using NIST SP 800-171, NIST SP 800-171A, and DoD’s CMMC assessment and scoping guides. Outside advisors can speed the process or fill skill gaps. Either way, the contractor remains responsible for its compliance and for the accuracy of its SPRS score and affirmation.

Work with RSI Security

RSI Security offers CMMC gap assessments and readiness support as advisory engagements. Separately, as a Cyber AB-authorized C3PAO, it performs independent CMMC Level 2 assessments. To protect assessor independence, RSI Security does not assess any organization it has advised on CMMC. Choose the path that fits where you are.

Request a CMMC gap assessment · Schedule a CMMC Level 2 assessment