cmmc compliance checklist
A CMMC compliance checklist starts with one decision: which contract information reaches your people, systems, and production areas? Get that boundary wrong, and your team may spend time securing equipment that does not need to handle the information, or miss systems that do. For manufacturers, scope comes before the control list.
Key Takeaways
- Determine your scope before anything else, because only systems and people that touch covered contract information belong inside the assessment boundary.
- Getting the scope wrong either wastes effort securing machines that never handle the data or leaves controllers and workstations that do handle it unaccounted for.
- Phased progress works better than a big-bang project: confirm scope first, then apply controls, then complete your SPRS score submission.
- Plant realities such as legacy controllers and flat networks make early scoping conversations with both IT and operations essential.
- A documented checklist keeps your compliance work auditable and ties each control back to a system you have already confirmed is in scope.
The CMMC final rule, 32 CFR Part 170, took effect December 16, 2024. Trace contract requirements and information flows, then decide which level applies before planning changes to office IT or plant networks.
First, Decide What You Are Actually Protecting: FCI, CUI, and Your CMMC Level
Identify whether your company receives Federal Contract Information (FCI), Controlled Unclassified Information (CUI), or both, then confirm the required CMMC level in contract language. FCI is government contract information that is not intended for public release. CUI is information requiring safeguarding under applicable laws, regulations, or government-wide policy. CUI can include technical data or manufacturing details, so the label depends on the contract and data, not the part’s appearance.
FCI vs. CUI: The Two Words That Determine Everything Else
These categories lead to different assessment expectations. Level 1 covers FCI and requires 15 practices with an annual self-assessment. Level 2 covers CUI and aligns to the 110 security requirements in NIST SP 800-171, the National Institute of Standards and Technology publication that sets requirements for protecting controlled information.
| Information or level | What it means for your plant | Assessment direction |
|---|---|---|
| FCI, Level 1 | Basic contract information is protected in the systems and processes that handle it. | 15 practices, annual self-assessment |
| CUI, Level 2 | Controlled information needs defined safeguards wherever it is stored, processed, or transmitted. | 110 NIST SP 800-171 requirements; certification assessment every three years |
| Level 3 | Additional protection applies to selected higher-risk programs. | Requirements and assessment depend on the program and solicitation |
Does a Manufacturer Making Non-Defense Parts Need CMMC?
The part alone does not settle the question. A manufacturer making commercial components may still receive covered information through a defense contract or subcontract. Check the solicitation, award documents, and information provided by the prime contractor. If the contract does not require CMMC and your company does not handle covered information, the requirement may not apply, but confirm that interpretation with the contracting party.
Level 1 vs. Level 2 vs. Level 3: What Each Demands of Your Plant
Level 1 focuses on basic safeguarding of FCI. Level 2 requires a broader, documented security program for CUI. Level 3 adds requirements for certain higher-priority programs. The Department of Defense is introducing Level 2 and Level 3 requirements through a phased rollout, so verify the solicitation language rather than planning from assumptions about a future award.
How Contract Flow-Down Clauses Tell You Your Level
Review the clauses in your contract, including DFARS 252.204-7012, 7019, 7020, and 7021, and check what your prime contractor flows down. Ask which data is covered, where it may be handled, and what assessment is required. IT Compliance Support can help organize compliance work around the stated requirements, but confirm contract interpretation with your contracting chain or a qualified CMMC advisor.
Phase One: Scope the Boundary So CUI Never Touches the Plant Floor
Why Enclave Scoping Beats Enterprise-Wide Scoping for Most Manufacturers
If CUI reaches a shared file server, engineering workstation, or production system, more of your environment may fall within the assessment boundary. An enclave is a defined set of people, devices, applications, and network connections approved to handle CUI. Keeping information within a limited enclave can reduce disruption to production systems, but only when separation works in practice and data does not spill into other workflows.
Mapping Your Asset Inventory: Office IT, MES, ERP, and Legacy OT
Trace information from receipt to use, storage, and disposal. Record who accesses it and which devices or services support that work. Include office laptops, file storage, engineering workstations, email, Enterprise Resource Planning (ERP) systems, Manufacturing Execution Systems (MES), and Operational Technology (OT), the hardware and software that monitor or control production. Note whether each system stores CUI, connects to an in-scope device, or has no role in that flow.
Keeping Machine Controllers and Unsupported Equipment Out of Scope
A legacy Programmable Logic Controller (PLC) may run an unsupported operating system and have no business need to process contract data. That does not automatically put it outside scope: network connections and shared services matter. Document why equipment is excluded, who can reach it, and what prevents CUI from entering it. Validate the boundary decision rather than labeling inconvenient assets out of scope.
OT Segmentation: What Changes and What Stays Exactly As It Is
Segmentation separates network traffic so devices handling CUI do not share unrestricted access with plant controllers. A properly planned change can leave a machine’s program and operating sequence untouched while limiting which systems can communicate with it. Your controls team should review the design and test communications before changes reach production. Mapping dependencies and scheduling safe tests takes time.
A workable scoping sequence is:
- Confirm contract clauses and identify CUI and FCI.
- Trace where covered information enters, moves, and is stored.
- List connected systems, users, service accounts, and network paths.
- Define the enclave and document excluded plant assets with the reason for exclusion.
- Validate segmentation and access rules with operations before implementation.
IT Compliance Support can support documentation and alignment of security practices with the defined boundary. Keep CUI outside the plant-floor boundary only when the actual data path, access controls, and network design support that decision.
Phase Two: Work the 110 NIST SP 800-171 Controls With an Ownership Map
A 110-control list is hard to act on until each requirement has an owner, evidence, and a defined place in your environment. For Level 2, use NIST SP 800-171 as the control baseline, then assign responsibility based on who operates the system and can prove the work. Your internal team, a managed IT/OT provider, and a CMMC Registered Practitioner (RP) consultant may all contribute, but accountability cannot disappear between them.
The 14 Control Families at a Glance
The 110 requirements are grouped into 14 families. Family names organize the work, but do not determine whether a requirement applies to a specific system. Tie each requirement to the boundary, systems, people, and processes established during scoping.
- Access Control; Awareness and Training; Audit and Accountability
- Configuration Management; Identification and Authentication; Incident Response
- Maintenance; Media Protection; Personnel Security
- Physical Protection; Risk Assessment; Security Assessment
- System and Communications Protection; System and Information Integrity
For a manufacturer, access control might involve who can reach CUI files, while configuration management may cover approved changes to in-scope workstations. Evidence should reflect your actual environment.
Ownership Mapping: Internal, Managed IT/OT Provider, or CMMC RP Consultant
Assign one accountable owner to every requirement, then name contributors. Your staff own business decisions, personnel processes, and approval of production changes. A qualified IT/OT provider may operate technical controls and produce operational records. A CMMC RP can help interpret assessment expectations and organize readiness work, but does not replace your organization’s responsibility or conduct the certification assessment.
| Work area | Likely accountable party | Evidence to confirm |
|---|---|---|
| Access approvals and personnel decisions | Internal leadership or designated process owner | Approved access requests, role assignments, and review records |
| Technical safeguards and routine operations | Internal IT, managed IT/OT provider, or both | Configuration records, monitoring logs, and service documentation |
| Readiness interpretation and assessment planning | Internal program lead with CMMC RP support as needed | Control mappings, documented gaps, and assessment preparation records |
What to Hand Your MSP: Evidence Artifacts That Double as Everyday IT Outputs
Ask your provider for evidence tied to the in-scope boundary, not generic policy templates. Routine IT records can support assessment preparation when they show what happened, when, and which systems were involved. IT Compliance Support can help organize customer-driven compliance alignment, but your team still needs to validate that records match practice.
Useful evidence often comes from ordinary operations:
- Access lists, approval records, and account removal tickets
- Endpoint inventories, configuration baselines, and change records
- Patch status, vulnerability findings, and remediation notes
- Security alerts, incident tickets, and response documentation
- Backup records, recovery tests, and maintenance logs
Gap Assessment and Building a POA&M That Assessors Accept
Assess each applicable requirement against evidence and actual operation. Record the gap, affected system, risk, owner, planned correction, and target date. A Plan of Action and Milestones (POA&M) documents eligible deficiencies and planned remediation. It is not a substitute for implementing requirements, and not every unmet requirement can be deferred. Confirm current CMMC rules for which findings may remain on a POA&M and any deadlines before relying on one for assessment.
Start with a controlled gap register: validate the boundary, assign owners, capture evidence, and prioritize remediation that affects CUI protection or assessment eligibility. This turns a CMMC compliance checklist into a work plan instead of an unowned spreadsheet.
Phase Three: SSP, SPRS Score, and C3PAO Assessment Prep
Assessment readiness depends on whether your documents describe the same systems and safeguards an assessor can observe. The System Security Plan (SSP), score submission, and assessment evidence should share one consistent boundary and control story. Build them from verified operations, not planned changes that have not reached production.
Writing a System Security Plan That Describes Reality, Not Intent
Your SSP should explain the environment that handles CUI, the boundary, system connections, implemented safeguards, and responsible roles. Identify where each control operates and how it is carried out. If a policy says access is reviewed but no review records exist, the document describes intent rather than demonstrated practice. Keep diagrams, asset records, procedures, and control explanations aligned as changes are approved and completed.
How Your SPRS Score Is Calculated and When to Post It
The Supplier Performance Risk System (SPRS) score begins at 110 and subtracts weighted deductions for unmet requirements under NIST SP 800-171. Requirements tied to CUI flow-down and multifactor authentication can carry significant deductions, so use the applicable scoring methodology rather than treating every gap as equal. Submit a score that reflects the assessed state and keep its supporting rationale available. Confirm submission timing and contract obligations with your contracting chain, especially where DFARS clauses apply.
Choosing a C3PAO and Preparing Your Team for Assessment Day
Level 2 certification requires assessment by a Certified Third-Party Assessment Organization (C3PAO) every three years. Verify that the organization is authorized, confirm scope and scheduling expectations, and agree on how evidence will be reviewed. System owners should be ready to explain procedures and show current records. Production leads should know how assessment activity will be coordinated around shift schedules and restricted maintenance windows.
Use a readiness review to check that each control has an owner, evidence, and a clear explanation. IT Compliance Support can assist with documentation and preparation, while your organization remains responsible for accurate claims and operational compliance.
A Realistic 90-Day, 6-Month, and 12-Month Timeline With Cost Ranges
No reliable cost or schedule fits every manufacturer. Scope, current safeguards, number of in-scope systems, remediation needs, and assessment availability all affect the plan. Treat these checkpoints as planning stages, not certification promises:
- First 90 days: confirm scope, assign owners, assess gaps, and identify remediation priorities.
- By six months: complete planned technical and procedural work where dependencies and production scheduling allow, then test evidence consistency.
- By 12 months: continue unresolved remediation, validate sustained operation, and schedule assessment when the organization is ready.
Request cost estimates based on documented scope and specific deliverables, including assessment fees, consulting, technical changes, and staff time. A disciplined plan reduces surprises, but the boundary and gaps determine the work.
What Breaks After Certification: Affirmations, Evidence Freshness, and Change Management
Certification does not freeze your plant’s systems or close out compliance responsibilities. New contract awards, staffing changes, equipment moves, and network updates can change the environment described in your assessment. Keep accountable owners, current evidence, and actual operations aligned. IT Compliance Support can help organize ongoing work, but your organization remains accountable for its compliance status.
Annual Senior Official Affirmation and New Contract Awards
A senior official must affirm compliance annually and with each new contract award. Treat each affirmation as a management decision supported by current information, not a calendar task completed without review. Before signing, confirm that documented scope matches systems and practices in operation, and evaluate open remediation items against applicable requirements.
When a new award arrives, review its clauses and information needs before accepting the work. A new flow-down requirement or data type can affect your boundary, responsibilities, and readiness. Involve the contract owner, compliance lead, and technical owners in that review.
Keeping Evidence Fresh Across Multi-Site Plants
Evidence can go stale when sites use different procedures or local teams make changes without updating shared records. A central inventory should identify each in-scope location, system owner, approved process, and evidence source. Site leads can confirm that access reviews, training records, configuration records, and incident procedures reflect current practice at their facility.
Set a review cadence that fits your operating rhythm, and assign an owner to record each change. IT Compliance Support includes automated tracking, real-time dashboards, and change logs, alongside audit-ready documentation and version control. Use those records to spot gaps between sites before assessment preparation begins.
Change Management: When a New Machine or Move Threatens Your Boundary
A new machine, engineering workstation, plant move, or network connection can change which systems communicate with the CUI environment. Before installation or relocation, have operations and IT check data flows, access paths, shared services, and network rules. Document whether the change affects the assessed boundary, then update relevant diagrams and procedures after approval.
Do not assume a machine remains outside scope because it does not store CUI. Connectivity and supporting services matter. Planning the review before commissioning gives your team time to test communications without turning a production change into an urgent compliance problem.
Frequently Asked Questions
What is CMMC compliance?
CMMC compliance is the Department of Defense's Cybersecurity Maturity Model Certification, a program that verifies defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The final rule, 32 CFR Part 170, took effect December 16, 2024. Your required level depends on the contract, not the part you make.
When is CMMC compliance required?
CMMC compliance is required when a defense contract or subcontract includes CMMC language and your company handles FCI or CUI. Check the solicitation, award documents, and what the prime contractor flows down. If your contract does not require it and you do not touch covered information, it may not apply, but confirm that with your contracting chain.
What are the CMMC compliance levels?
The CMMC compliance levels are Level 1, Level 2, and Level 3. Level 1 covers FCI with 15 practices and an annual self-assessment. Level 2 covers CUI with the 110 requirements in NIST SP 800-171 and a certification assessment every three years. Level 3 adds protections for selected higher-risk programs.
Does a manufacturer making non-defense parts need CMMC?
A manufacturer making commercial parts may still need CMMC if a defense contract sends covered information to your systems. The part alone does not settle the question. Review the contract clauses and what your prime flows down, and confirm the interpretation with the contracting party before planning any changes.
How do I prepare for a CMMC assessment?
Prepare for a CMMC assessment by scoping first: confirm your contract clauses, trace where FCI and CUI enter, move, and get stored, then define a limited enclave for that data. Document why plant equipment is excluded, and validate segmentation with your controls team before implementation touches production.
Why does enclave scoping matter for CMMC compliance?
Enclave scoping limits CMMC assessment to a defined set of people, devices, and systems approved to handle CUI, instead of your whole plant network. That keeps machine controllers and legacy OT out of the boundary where possible. It only works when separation holds in practice and data does not spill into other workflows.
Can legacy machine controllers stay out of my CMMC scope?
Legacy machine controllers can stay out of CMMC scope, but only with a validated boundary decision. Network connections and shared services matter, so a PLC running an unsupported operating system is not automatically excluded. Document why the equipment is excluded, who can reach it, and what prevents CUI from entering it.