The CMMC Phase Checklist

Reviewed October 6, 2026: the planned November 10, 2026 Phase II expansion is suspended. Phase I self-assessment requirements and DFARS safeguarding duties remain. Check your solicitation, contract, and amendments before choosing an assessment path. Sources: official CMMC status and implementation memorandum.

inDirectIT · CMMC Phase Checklist · indirectit.com

Which phase are we in?

NOW Phase 1 Nov 2025

Self-assessment required.

Phase 2 Suspended

Former November 2026 transition paused.

Later phases Under review

Await revised official guidance.

Your contract Review terms

Confirm amendments and modifications.

0 of 12 done

This Week

Start with the facts. None of this costs money, only an afternoon.

Pull your active contracts. Confirm which carry DFARS 252.204-7012 / 7019 / 7020.
Check SPRS. Do you have a current score and affirmation on file?
Locate your SSP. Confirm that it documents the assessed environment; an absent SSP prevents a valid Basic Assessment.
Ask your primes what they'll require and when.

This Month

This month you set your scope and your score, which is where the real work starts.

Define where CUI actually lives. Run discovery instead of guessing, and document the actual CUI flows and security dependencies.
Run an honest 110-control self-assessment. Use the free calculator for a planning estimate; validate each result against evidence.
Close the SSP gate with a real, current System Security Plan.
List your gaps by point weight. 5s first.

This Quarter

Close gaps and commit to a posture before the calendar decides for you.

Close the 5-point gaps: MFA everywhere, FIPS-validated crypto, logging, boundary protection.
Confirm your assessment path. Check the required level and any amendments or modifications with your contracting officer.
Book the readiness work while assessor capacity exists.
Put evidence capture on a schedule: screenshots, configs, and logs mapped to objectives.

This checklist is the companion to The CMMC Deadline Playbook, which has the full phase-in timeline, what primes are doing right now, and the complete 90-day plan.

Read the full 90-day plan →

Free Download

Get the PDF + the phase-alert series.

We'll email you the printable checklist and, as phase deadlines approach, a short series of practical CMMC emails you can unsubscribe from anytime. You can also email rj@indirectit.com directly.