CMMC Level 2 Assessment Readiness Checklist

You're preparing for a CMMC Level 2 assessment, but you're overwhelmed by guidance documents that don't clearly outline what to do before the assessor arrives. This checklist simplifies the process, providing a practical framework your team can execute in the 90 days leading up to your assessment.

Purpose of This Checklist

This checklist ensures your Level 2 assessment preparation is complete and defensible. It doesn't replace implementing NIST SP 800-171 Rev 2 controls; it assumes you've done that. Instead, it helps you prove compliance to a Third-Party Assessment Organization (3PAO) without wasting assessment days on evidence gaps or scope clarification.

The checklist targets three common areas of assessment preparation failure: boundary definition, evidence assembly, and control interpretation consistency. These areas often create the most significant cost and burden, as identified in feedback from the DoD's CMMC request for information.

Prerequisites

Before using this checklist, confirm:

• Your System Security Plan (SSP) is complete and reflects your current CUI environment.
• You've identified all systems and assets that process, store, or transmit Controlled Unclassified Information (CUI).
• You have a designated CMMC point of contact who understands both your technical environment and DFARS 252.204-7012 obligations.
• Your executive leadership has approved the assessment scope and timeline.
• You've selected and contracted with a 3PAO. Current data shows average assessment costs around $47,000 for Level 2.

The Checklist Template

90 Days Before Assessment

Boundary Validation

• Document every system, application, and network segment in your CUI environment.
• Map data flows showing how CUI enters, moves through, and exits your boundary.
• Identify and justify any out-of-scope assets connected to in-scope systems.
• Review contracts and task orders to confirm which systems handle CUI, marking them with contract numbers and CUI categories.
• Document your CUI marking policy and verify it aligns with 32 CFR Part 2002.
• Create a visual network diagram showing security boundaries and trust zones.

Evidence Package Assembly

• Collect configuration exports for all security controls with technical implementations.
• Gather logs demonstrating continuous monitoring over the past 90 days minimum.
• Compile access control lists, user account listings, and role definitions.
• Document encryption implementation, ensuring FIPS 140-2 validation certificates are included.
• Assemble vendor attestations for external service providers and cloud services.
• Create a master evidence index mapping each artifact to specific NIST 800-171 requirements.

Documentation Review

• Update your SSP to reflect any changes since the initial draft.
• Review your Plan of Action and Milestones (POA&M) to confirm timelines are realistic and approved.
• Verify incident response procedures reference your actual tools and team structure.
• Check that configuration management documentation matches current baseline configurations.
• Confirm all policies have current approval signatures and revision dates.

60 Days Before Assessment

Control Implementation Validation

• Test a sample of technical controls (pick 5-7 across different families).
• Verify multi-factor authentication works for all CUI system access points.
• Confirm audit logging captures the events required by AC-2, AU-2, and AU-3.
• Test your backup and recovery procedures and document the results.
• Validate that session locks activate at the timeout period in your SSP.
• Run a Vulnerability Assessment and verify findings match your POA&M.

Personnel Readiness

• Identify which staff will participate in interviews (typically 4-8 people).
• Schedule a dry-run interview session for each participant.
• Prepare talking points for how your team interprets and implements complex controls.
• Document the specialized personnel you've engaged for NIST 800-171 implementation.
• Confirm all personnel with CUI access have completed required security awareness training.

30 Days Before Assessment

Pre-Assessment Coordination

• Confirm assessment dates, location, and logistics with your 3PAO.
• Provide the 3PAO with your SSP and evidence index in advance.
• Schedule blocks for system demonstrations and interviews.
• Set up a secure file transfer method for sensitive evidence.
• Designate a conference room or virtual meeting space for the duration.

Final Evidence Verification

• Spot-check 10 pieces of evidence to confirm they're current and complete.
• Verify that evidence timestamps fall within the assessment scope period.
• Confirm you can access all systems and tools the assessor will need to observe.
• Review your POA&M one more time to ensure completion dates haven't passed.
• Test your screen-sharing and remote access setup if the assessment is virtual.

Customizing the Checklist

Adjust for your environment size: If you're a small business with fewer than 50 employees, you can consolidate personnel interviews. Larger organizations should add checkpoints for coordination across multiple sites or business units.

Tailor evidence requirements: If you're using external service providers or cloud platforms, add checkpoints to verify you have current FedRAMP authorizations and Customer Responsibility Matrix documents from those providers.

Modify timelines: The 90-60-30 day structure assumes you're starting from a substantially complete implementation. If you're still remediating findings or building out controls, adjust these timelines and add interim checkpoints.

Adapt for your POA&M complexity: If you have more than 15 open items in your POA&M, add a dedicated review cycle at the 45-day mark to confirm your remediation progress won't surprise the assessor.

Validation Steps

Before declaring assessment readiness, run this final validation:

1. Evidence completeness test: Pick three NIST 800-171 requirements at random. Can you produce complete evidence for each within 15 minutes? If not, your evidence package needs work.
2. Boundary clarity test: Ask someone outside your immediate team to explain your CUI boundary using only your documentation. If they can't, your SSP needs clarification.
3. Interview readiness test: Have your compliance lead interview two random staff members about their security responsibilities. If they can't articulate basic controls relevant to their role, schedule more training.
4. Timeline realism test: Review your POA&M completion dates. If more than 25% of items are at risk of missing their deadlines, discuss extensions with your 3PAO before the assessment starts.
5. Cost validation: Compare your total preparation costs (personnel time, consultant fees, tool licensing) against the average $47,000 assessment cost. If preparation is significantly exceeding assessment cost, you're likely over-documenting or implementing controls that don't match your risk profile.

The assessment itself is straightforward if your preparation is complete. Most of the burden and cost come from implementing and documenting NIST 800-171 requirements, not from the CMMC verification process. This checklist helps you confirm you're ready to prove what you've already built.