Free readiness report

01Do you know whether your contracts require CMMC Level 1 or Level 2?

02Have you named one internal person who owns CMMC?

03Have you mapped where CUI is stored, processed and sent?

04Is multi-factor authentication enforced for all users?

05Do you have a written System Security Plan (SSP)?

06Do you have a POA&M tracking open gaps?

07Have you submitted a SPRS score to the DoD?

08Are audit logs collected and reviewed regularly?

09Is CUI encrypted at rest and in transit?

10Do staff complete annual security awareness training?

11Is physical access to CUI areas controlled and logged?

12Do you have a tested incident response plan?

13Are system configurations baselined and change-controlled?

14Is evidence for each control collected and dated?

15Do you run recurring (weekly/monthly) compliance reviews?