Assessment readiness checklist

Use this checklist before scheduling or entering formal assessment preparation.

Scope

• The contract requirements and required CMMC status are confirmed.
• The CUI boundary is written and matches actual work.
• The asset, account, location, and external-service inventories are current.
• The network and CUI-flow diagrams match the boundary.
• Each in-scope system and service has an accountable owner.

Implementation

• Required safeguards operate across the full documented boundary.
• Exceptions and inherited responsibilities are explicit.
• High-consequence gaps are resolved or have a valid, current disposition.
• Recent changes have passed validation and operational handoff.

Documentation

• The SSP describes the environment as it operates now.
• Policies, procedures, diagrams, inventories, and the SSP agree.
• Each implementation statement names an owner, mechanism, frequency, and evidence.
• Open remediation items have owners and dates.

Evidence and people

• Evidence is current, traceable, minimized, and stored in the controlled repository.
• Every control owner knows which practices and artifacts they must demonstrate.
• Interview answers match the SSP and evidence.
• Leadership understands and supports the submitted representation.

Caution

A checked box is not proof. Confirm each item against the current system, records, and responsible people.