CMMC Readiness Checklist

• Confirm whether your contracts include FCI, CUI, or neither.
• List every contract clause that drives a security requirement (DFARS, FAR, agency-specific).
• Define and write down your system boundary, including cloud services.
• Inventory every device, account, and application that touches in-scope data.
• Identify where in-scope data is stored, processed, and transmitted.
• Assign a named owner for the security program.
• Draft or update your System Security Plan.
• Create a POA&M for every control that is not fully implemented.
• Turn on multi-factor authentication for email, remote access, and administrative accounts.
• Document your access-control and account-review process.
• Confirm backups exist, are protected, and have been restored in a test.
• Complete annual security awareness training for everyone in scope.
• Document your incident response plan and the reporting timeline you must meet.
• Collect and label evidence for each control claim.
• Run a self-assessment and record the score and date.
• Schedule a review cadence for the plan, controls, and evidence.

Progress is saved in this browser only. It is not a compliance record.

Earn a Certificate of Training Completion

Complete every section, acknowledge, and pass the knowledge check.

This certificate recognizes completion of educational training material only. It is not a professional certification, accreditation, license, compliance assessment, audit result, or attestation of compliance with any law, regulation, or contract requirement. ComplianceAnvil is not a certification authority, accreditation body, assessor, or law firm.

Put this into practice

Resources tell you what good looks like. A Program Pack does the work with you — generated documentation, tracked controls, training, and evidence in one workspace.