Free Operator's Brief · Security & CMMC
You're not too small to be a target. You're just easier.
Attackers and the Department of Defense now ask mid-market suppliers the same question: can you show your controls work? 88% of breaches at smaller firms involved ransomware (Verizon DBIR, 2025), and CMMC requirements began phasing into DoD contracts on November 10, 2025. This CMMC compliance checklist shows where you stand in two minutes.
The ten-point self-check
Score yourself honestly. An assessor will.
Yes = 2 · Partly = 1 · No = 0. Nothing is saved or sent.
01Scope
We can name every system, person, and vendor that stores, processes, or transmits CUI.
02Identity
MFA is enforced for remote, privileged, and network access to systems in scope.
03Documentation
A current System Security Plan describes how each of the 110 NIST SP 800-171 requirements is met.
04SPRS
Our SPRS score is submitted, current, and backed by evidence we could show an assessor.
05Gaps
Open gaps sit on a POA&M with an owner and a target date.
06Endpoints
Laptops and servers in scope are encrypted, patched on a schedule, and centrally managed.
07Logging
Security logs are collected, reviewed, and retained, not just switched on.
08Incidents
Our incident plan has been exercised, and we know how to report a cyber incident to DoD within 72 hours.
09Recovery
We have restored from backup in the last quarter, not just confirmed backups ran.
10Supply chain
Subcontractors, MSPs, and cloud services that touch CUI meet the requirements we flow down to them.
0/10 answered. Your score and what it usually means appear here.
Why "easier" is the real risk
Size doesn't hide you. Weak controls find you.
Automated attacks don't check headcount. They look for an unpatched VPN, a reused password, or an account without MFA. A 120-person machine shop with CUI on a shared drive is easier to reach than its prime, and often connected to it.
| Level | Applies to | Requirements | How it's assessed |
|---|---|---|---|
| Level 1 | Federal Contract Information | 15 basic safeguarding requirements (FAR 52.204-21) | Annual self-assessment and affirmation |
| Level 2 | Controlled Unclassified Information | 110 requirements, NIST SP 800-171 Rev. 2 | Self-assessment or certified third party (C3PAO) every three years, depending on the contract |
| Level 3 | Highest-priority CUI programs | Level 2 plus selected NIST SP 800-172 requirements | Government assessment (DIBCAC) |
Readiness is not certification.
A readiness review tells you where you stand. Only a self-assessment you can defend, a C3PAO, or DIBCAC, depending on your level, produces a CMMC status. Be wary of anyone who promises certification or a fixed timeline before scoping your environment.
Download the CMMC checklist
Asset 01 · Infographic
CMMC readiness at a glance
One page: the ten checks, the key numbers, and the readiness-versus-certification line. Built to share with your leadership team.
Share or download
02 · Operator's Report
The CMMC Readiness Checklist
Four-page printable PDF: why smaller suppliers get targeted, the three levels, the scored checklist, and next steps. No email required.
CORE12 · AN OPERATOR'S BRIEF
THE CMMC READINESS CHECKLIST · 2026
You're not too small to be a target.
You're just easier.
88%
SMB breaches with ransomware
110
Level 2 requirements
10
checks, two minutes
Find out where you stand before a prime asks.
01 · See
Quantify security, compliance, and downtime exposure with the IT Risk Report.
02 · Scope
Map where CUI lives. Shrinking scope is often the cheapest control you will buy.
03 · Close
Work the POA&M: identity, endpoint, logging, and recovery, with evidence attached.
04 · Assess
Self-assess or engage a C3PAO as your contract requires. We prepare you; the assessor decides.
Ask in your next leadership meeting
- If a prime asked for our SPRS score and evidence this week, who would answer, and with what?
- Which of our vendors can see CUI, and have we checked their controls?
- When did we last restore from backup, and how long did it take?
See it before an assessor does
Get your IT Risk Report.
Your security, compliance, and downtime exposure on your own inputs, plus the three risks most likely costing you now.
Run the IT Risk Report2 min · no cost · no sales call
Related Questions
What is on a CMMC compliance checklist?
For Level 2, the checklist is the 110 requirements in NIST SP 800-171 Rev. 2. A practical self-check starts with ten areas: CUI scope, MFA, a current System Security Plan, a defensible SPRS score, a POA&M for open gaps, endpoint management, logging, incident reporting, tested recovery, and supply-chain flow-down.
Is a readiness checklist the same as CMMC certification?
No. A checklist or readiness review shows where you stand. CMMC status comes from a self-assessment you can defend, a C3PAO assessment, or a DIBCAC assessment, depending on the level your contract requires.
When does CMMC apply to DoD contracts?
The DFARS CMMC acquisition rule took effect on November 10, 2025, and CMMC requirements are being added to solicitations in phases. The required level is stated in each contract.
Sources: Verizon 2025 DBIR; 32 CFR Part 170; DFARS CMMC acquisition rule (effective Nov 10, 2025); DFARS 252.204-7012; NIST SP 800-171 Rev. 2. Not legal advice.