A practical starting point
Make compliance work understandable.
Use this learning path to move from unfamiliar terminology to a documented preparation process.
Editorial orientation · updated October 29, 2026. Confirm requirements against your contracts and the official assessment and scoping guides.
01
Understand the language
Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) have different safeguarding needs. Identify the information you receive, create, store, and share. Ask your contracting contact when markings or obligations are unclear.
Your next step: Make a list of your contracts, information types, and points of contact.
02
Confirm your required path
CMMC has different levels and assessment paths. Confirm the level and assessment type required by your applicable contracts. This site supports preparation for Levels 1 and 2; it does not determine your contractual obligations.
Your next step: Record your confirmed level, assessment path, and target date.
03
Define the boundary
Scope is the environment being assessed. Describe systems, people, locations, information flows, and external providers. Use the official scoping guide for your level before deciding which assets belong inside or outside the boundary.
Your next step: Draft your boundary and document who is responsible for each shared service.
04
Review objectives, not just titles
A requirement can contain several assessment objectives. Review each objective and record what is implemented, what is missing, and what still needs investigation. A completed checklist is not proof that the underlying safeguard works.
Your next step: Review one requirement, then record its implementation and gaps.
05
Connect evidence to implementation
Evidence should support the actual implementation: for example, an approved procedure, configuration record, or documented review. Identify what the artifact demonstrates and who maintains it. Keep evidence in your approved repository and record a reference here.
Your next step: For each objective, identify relevant evidence and a review date.
06
Resolve gaps and keep records current
Assign gaps to people with dates and track the work through completion. Remediation tasks are not automatically an eligible formal Plan of Action and Milestones (POA&M). Revisit scope, responsibilities, and evidence when your environment changes.
Your next step: Assign your next three actions and schedule a scope review.