A preview of what's inside
- Is your CUI boundary defined and documented? Your budget, architecture, and timeline all depend on this answer, so a wrong boundary throws off everything after it.
- Does DFARS 252.204-7012 actually appear in your contracts? Verify the clause before you spend anything, because the obligation sets the scope.
- Is your SPRS score real? A submitted score is a federal representation, so a score that wouldn't survive an objective-level review is legal exposure.
- Is CUI encrypted with FIPS-validated cryptography? "Encrypted" and "FIPS-validated" are different answers, and assessors know the difference (§3.13.11).
- Can you produce evidence to back your policies? Assessors want configurations, logs, and screenshots organized by assessment objective; a policy binder alone won't pass.
The full checklist covers every control family and ranks each item by the cost of fixing it late. The form below only tells us where to send it.
Free Download
Get the full checklist.
Enter your email and we'll send the checklist in one email, with no drip campaign after it. You can also email rj@indirectit.com directly.