The CMMC Phase Checklist

Reviewed October 6, 2026: the planned November 10, 2026 Phase II expansion is suspended. Phase I self-assessment requirements and DFARS safeguarding duties remain. Check your solicitation, contract, and amendments before choosing an assessment path. Sources: official CMMC status and implementation memorandum.

inDirectIT · CMMC Phase Checklist · indirectit.com

Which phase are we in?

NOW Phase 1 Nov 2025

Self-assessment required.

Phase 2 Suspended

Former November 2026 transition paused.

Later phases Under review

Await revised official guidance.

Your contract Review terms

Confirm amendments and modifications.

0 of 12 done

This Week

Facts first. None of this costs money — it costs an afternoon.

Pull your active contracts. Confirm which carry DFARS 252.204-7012 / 7019 / 7020.
Check SPRS. Do you have a current score and affirmation on file?
Locate your SSP. Confirm that it documents the assessed environment; an absent SSP prevents a valid Basic Assessment.
Ask your primes what they'll require and when.

This Month

Scope and score. This is where the real work starts.

Define where CUI actually lives. Discovery beats guessing — document the actual CUI flows and security dependencies.
Run an honest 110-control self-assessment. Use the free calculator for a planning estimate; validate each result against evidence.
Close the SSP gate — a real, current System Security Plan.
List your gaps by point weight. 5s first.

This Quarter

Close gaps and commit to a posture before the calendar decides for you.

Close the 5-point gaps: MFA everywhere, FIPS-validated crypto, logging, boundary protection.
Confirm your assessment path — check the required level and any amendments or modifications with your contracting officer.
Book the readiness work while assessor capacity exists.
Put evidence capture on a schedule — screenshots, configs, logs mapped to objectives.

This checklist is the companion to The CMMC Deadline Playbook — the full phase-in timeline, what primes are doing right now, and the complete 90-day plan.

Read the full 90-day plan →

Free Download

Get the PDF + the phase-alert series.

We'll email you the printable checklist plus a short series of practical CMMC emails as phase deadlines approach — unsubscribe anytime. Or email rj@indirectit.com directly.