CMMC Readiness Guide
Updated:
September 28, 2026
Cybersecurity Maturity Model Certification (CMMC) readiness means preparing to demonstrate that your organization meets the security requirements and assessment type specified in its defense contracts.
For contractors and subcontractors handling sensitive defense information, preparation involves defining assessment scope, implementing required safeguards, and maintaining evidence that those safeguards work. Assessment obligations vary with the required CMMC level and contract terms.
Failing to meet applicable CMMC requirements can prevent an organization from receiving covered Department of Defense (DoD) contracts. Limited staff, IT modernization projects, and competing budgets can make preparation difficult, particularly when security gaps require changes across systems and processes.
This guide explains readiness under CMMC 2.0, the actions to prioritize for your required level, and common mistakes that delay assessments. It covers scope, documentation, remediation, and ongoing compliance so your team can organize preparation around clear responsibilities.
Let’s dive right in!
A Brief Overview of CMMC 2.0
CMMC 2.0 is the Department of Defense’s framework for verifying cybersecurity safeguards across the Defense Industrial Base. It replaces the original five-level model with three levels based on existing federal requirements.
Level 1 covers Federal Contract Information and requires 15 safeguarding requirements from FAR 52.204-21. Contractors complete annual self-assessments and affirm continuing compliance.
Level 2 covers Controlled Unclassified Information and requires the 110 security requirements from NIST SP 800-171 Revision 2. Contracts specify either self-assessment or third-party certification assessment every three years, with annual compliance affirmations.
Level 3 adds 24 selected requirements from NIST SP 800-172 to Level 2’s safeguards for designated programs involving critical defense information. Government assessors conduct Level 3 assessments every three years, with annual compliance affirmations required.
CMMC 2.0 removes the original model’s separate process maturity requirements, but compliance still includes policies, personnel, documentation, and technical safeguards. Contractors must follow the CMMC level and assessment type specified in their solicitations and contracts.
CMMC 1.0 vs. CMMC 2.0
CMMC 2.0 reduces the original five levels to three, removes separate process maturity requirements, and changes assessment obligations.
| Category | CMMC 1.0 | CMMC 2.0 |
|---|---|---|
| Model Type | The model has five levels covering security practices and process maturity. | The model has three levels covering security requirements without separate process maturity scoring. |
| Level 1 | Basic Cyber Hygiene includes 17 practices derived from FAR 52.204-21. | Level 1 uses the 15 safeguarding requirements in FAR 52.204-21, previously expressed as 17 practices. |
| Level 2 | Intermediate Cyber Hygiene includes 72 practices and serves as a transition toward Level 3. | Level 2 uses 110 requirements from NIST SP 800-171 Revision 2, removing the original Level 3’s 20 additional practices. |
| Level 3 | Good Cyber Hygiene includes 130 practices: 110 from NIST SP 800-171 and 20 additional practices. | Level 3 adds 24 selected requirements from NIST SP 800-172 to Level 2’s requirements. It is not directly equivalent to the original Level 5. |
| Levels 4 and 5 | These levels include 156 and 171 practices, respectively, with additional process maturity requirements and advanced threat protections. | These numbered levels are removed. Advanced threat protections are addressed through the revised Level 3. |
| Assessment Type | The model calls for third-party certification at every level. | Level 1 uses self-assessment. Level 2 uses self-assessment or third-party assessment according to contract requirements. Level 3 uses government assessment. |
| Focus | Assessments cover implemented safeguards and institutionalized processes. | Assessments verify applicable safeguards, including technical controls, policies, documentation, and personnel practices. |
CMMC Complicance From Bright Defense
Steps to Achieve CMMC Readiness
These ten steps help organizations prepare for the CMMC level and assessment type required by their contracts:
Step 1: Understand CMMC Level 1 Requirements:
CMMC Level 1 requires implementation of the 15 basic safeguarding requirements in FAR 52.204-21 to protect Federal Contract Information (FCI). Contractors must assess their implementation annually and submit an affirmation of continuing compliance.
Bright Defense supports readiness through gap analysis, remediation, and assessment preparation. Reviewing applicable CMMC controls helps organizations determine which safeguards need attention and what evidence supports their implementation.
Organizations can get started with CMMC readiness through a review of the systems that process, store, or transmit FCI. The following 15 requirements summarize the Level 1 safeguards.
15 CMMC Level 1 Safeguarding Requirements
- Limit system access. Permit access only to authorized users, processes acting on their behalf, and devices.
- Restrict permitted activities. Limit users to the transactions and functions they are authorized to perform.
- Control external system connections. Verify connections to external systems and control or limit their use.
- Control publicly accessible information. Control information posted or processed on publicly accessible systems.
- Establish user and device identities. Determine the identities of system users, processes acting on their behalf, and devices.
- Authenticate access. Verify those identities before granting access to organizational systems.
- Sanitize or destroy media. Sanitize or destroy media containing FCI before disposal or reuse.
- Restrict physical access. Allow only authorized individuals to physically access systems, equipment, and operating environments.
- Manage physical access safeguards. Escort visitors, monitor visitor activity, maintain physical access logs, and control physical access devices.
- Protect communications boundaries. Monitor, control, and protect communications at external boundaries and key internal boundaries.
- Separate public-facing components. Place publicly accessible system components on subnetworks physically or logically separated from internal networks.
- Correct system flaws. Find, report, and correct information and system flaws promptly.
- Protect against malicious code. Provide malicious code protection at appropriate locations within organizational systems.
- Update malicious code protection. Update protection mechanisms when new releases become available.
- Scan systems and external files. Perform periodic system scans and real-time scans of external files as they are downloaded, opened, or executed.
These safeguards establish baseline protection for FCI. Organizations should maintain evidence that each applicable requirement is implemented and remains effective.
Step 2: Prepare your Employees
Employee preparation supports CMMC readiness through leadership commitment, clear responsibilities, and security training. Owners, directors, and executive leaders should support the program and provide resources for implementation.
Employees should understand what CMMC means for their work and how to follow applicable policies and procedures. For Level 2, training must cover security risks, assigned security duties, and recognizing and reporting potential insider threats.
Organizations should provide regular refresher training, retain completion records, and give employees access to practical guidance and a designated contact for security questions.
Step 3: Implement a System Security Plan (SSP)
A System Security Plan (SSP) is required for CMMC Levels 2 and 3 and documents how your organization implements applicable security requirements. It describes system boundaries, the operating environment, and connections to other systems.
The SSP must remain current and accurately reflect implemented safeguards. Remediation actions and deadlines belong in a Plan of Action and Milestones (POA&M), subject to CMMC restrictions. An up-to-date SSP helps employees and assessors understand your security approach and the systems covered by the assessment.
Step 4: Put Protections in Place for Controlled Unclassified Information (CUI)
CMMC Levels 2 and 3 require safeguards for systems that process, store, or transmit Controlled Unclassified Information (CUI), along with relevant security protection assets.
These safeguards include documented procedures, physical access restrictions, and technical controls such as access management, encryption, and system monitoring. Organizations should implement applicable requirements across their assessment scope and retain evidence showing that protections operate effectively.
Step 5: Documentation and Policies
Documentation and policies support CMMC readiness through clear responsibilities, consistent procedures, and evidence of implemented safeguards. They should accurately describe how your organization meets applicable security requirements and provide practical guidance for employees.
Useful records include approved policies, operating procedures, training records, access reviews, and system configurations. Organizations should map supporting evidence to applicable assessment objectives so assessors can evaluate implementation.
Those objectives already contain determination statements; organizations do not create replacement statements. Assessment evidence must be final, and policies submitted as evidence must be approved.
Assign document owners, maintain version histories, and update records when systems, responsibilities, or procedures change. Annual policy reviews and employee acknowledgments are useful governance practices, but their required frequency and coverage depend on applicable requirements and organizational policies.
Documentation should reflect actual operations and help employees maintain consistent safeguards during personnel changes or system upgrades.
Step 6: Seeking External Assistance
External assistance can help organizations address gaps in expertise, staffing, or assessment preparation. CMMC consultants can review your assessment scope, evaluate implemented safeguards, support remediation, and organize evidence against applicable requirements.
Choose professionals with experience relevant to your required level and technology environment, and agree on responsibilities, deliverables, and access to sensitive information.
Formal third-party assessments serve a different purpose: authorized or accredited CMMC Third-Party Assessment Organizations (C3PAOs) evaluate compliance for Level 2 certification. These assessors must follow conflict-of-interest rules that protect their independence.
A readiness review helps prepare for that evaluation but does not confer certification. Your organization remains responsible for implementing safeguards, maintaining evidence, and meeting ongoing compliance obligations.
Step 7: Put Vendor Risk Management into Practice
Vendor risk management supports CMMC readiness through reviews of third-party access, security responsibilities, and applicable contractual requirements. Subcontractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) must meet the CMMC requirements passed down through their contracts.
External service providers may fall within your assessment scope, depending on their services and the information they handle. Organizations should document shared responsibilities, verify applicable compliance status, and reassess vendors when services, access, or security conditions change.
Step 8: Implementing Required Practices
CMMC readiness requires implementation of the safeguards applicable to your required level. Level 1 includes 15 safeguarding requirements from FAR 52.204-21. The following five areas organize those requirements into practical implementation activities.
A. Access Control and User Authentication
Restrict system access to authorized users, processes, and devices. Verify their identities before granting access, and limit permitted transactions and functions according to assigned responsibilities.
Review permissions when employees change roles or leave, and control connections to external systems.
B. Physical Security Measures
Limit physical access to systems, equipment, and operating environments to authorized individuals. Use appropriate safeguards, such as locked rooms or controlled entry.
Escort visitors, monitor their activity, maintain physical access logs, and manage keys, badges, or other access devices.
C. System Maintenance and Protection
Find, report, and correct system flaws promptly. Deploy malicious code protection where appropriate and update it when new releases become available. Perform periodic system scans and scan files from external sources as they are downloaded, opened, or executed.
D. Monitoring and Reporting
Monitor, control, and protect communications at external and key internal network boundaries. Separate publicly accessible system components from internal networks.
Level 1 requires physical access logs and reporting of system flaws; broader system audit logging, session locks, and incident reporting are addressed through Level 2 requirements and applicable contract clauses.
E. Data Handling and Disposal
Control information posted or processed on publicly accessible systems to prevent unauthorized disclosure of Federal Contract Information (FCI). Sanitize or destroy media containing FCI before disposal or reuse.
Document disposal activities so your organization can demonstrate that the required safeguards are implemented.
Step 9: Preparing for the CMMC Audit
Preparing for a CMMC assessment requires evidence that your organization implements the safeguards applicable to its required level. Under CMMC 2.0, Level 1 requires annual self-assessment, while Level 2 requires self-assessment or third-party certification assessment according to contract requirements. Government assessors conduct Level 3 assessments. The Department of Defense retains authority to investigate compliance; the CMMC Accreditation Body does not conduct random contractor audits.
For Level 1, the following five actions support assessment preparation:
Submit results and affirmation. Record assessment results in the Supplier Performance Risk System (SPRS) and have the designated senior official affirm continuing compliance. Repeat the Level 1 assessment and affirmation annually.
Define the assessment scope. Determine which systems process, store, or transmit Federal Contract Information (FCI), applying the Level 1 scoping rules.
Evaluate all 15 safeguarding requirements. Use the applicable assessment objectives to check implementation through documentation, interviews, and testing.
Correct unmet requirements. Address deficiencies before claiming Level 1 compliance. Level 1 does not permit a Plan of Action and Milestones (POA&M) for conditional status.
Organize supporting evidence. Retain relevant records, configurations, and other assessment artifacts for six years from the CMMC Status Date. A mock assessment can help expose missing evidence or implementation gaps.
Step 10: Continuous Monitoring
Continuous monitoring supports CMMC readiness through regular checks that applicable safeguards remain effective. Organizations should address weaknesses, update evidence, and maintain compliance between assessments.
A senior official must affirm continuing compliance annually. Bright Defense offers ongoing continuous compliance services for CMMC Levels 1 and 2.
About Bright Defense:
Bright Defense provides CMMC readiness and continuous compliance services for organizations preparing for Level 1 and Level 2 assessments. Its CISSP- and CISA-certified experts support gap analysis, risk assessments, policy development, remediation, and assessment preparation.
These services help your team understand applicable requirements, address security weaknesses, and maintain documentation that reflects implemented safeguards.
Bright Defense offers security awareness training, compliance automation, and virtual Chief Information Security Officer (vCISO) services to support ongoing security responsibilities. From initial preparation to continued compliance, the team helps your organization build and maintain its security program.
Contact Bright Defense to discuss your CMMC readiness needs.
