This article provides a seven-step checklist to help defense contractors prepare for CMMC compliance, from identifying stakeholders to budgeting for certification costs.
Why it matters: CMMC compliance increasingly determines which contracts a business can win, and assessment requirements continue to evolve. A clear checklist keeps your organization audit-ready no matter what changes next.
Key Takeaways:
- CMMC compliance follows a seven-step path: This checklist walks defense contractors through stakeholder alignment, gap analysis, assessment planning, and documentation to prepare for CMMC.
- Assessment requirements are evolving, not disappearing: The Department of War paused third-party certification for review in July 2026, but self-assessment and underlying security standards remain mandatory.
- Deltek Costpoint GCCM supports CMMC readiness: Government contractors like Applied Insight and ASRC Federal rely on built-in audit controls in Costpoint to support compliance.
"For years, cybersecurity in government contracting was a checkbox exercise. Now it determines who can compete in the defense market. Firms without strong security and regulatory readiness risk losing access to valuable opportunities."
— Chuck Brooks, President, Brooks Consulting International & Adjunct Faculty, Georgetown University
What is the CMMC?
CMMC is a certification program that verifies and confirms compliance with cybersecurity controls required of Department of Defense contractors. The DoD refers to this contractor community as the Defense Industrial Base, or DIB.
CMMC seeks to safeguard controlled unclassified information (CUI) by standardizing verification of the implementation of NIST SP 800-171 security controls by government contractors.
CMMC Levels
- Level 1 focuses on foundational security controls and will be required of every DIB contract that handles federal contract information (FCI). This requires annual self-assessment.
- Level 2 confirms implementation of cybersecurity controls from NIST SP 800-171 and will be required for all contractors and suppliers who store, process, or transmit covered defense information (CDI), which is also CUI. This can be a self-assessment OR a third-party assessment from a C3PAO, depending on the type of CDI/CUI expected to be part of the contract.
- Level 3 includes all requirements from Level 2, plus additional controls from NIST SP 800-172 and will be required for all DIB contractors who work with the most sensitive types of CDI – including controlled technical information (CTI). This requires assessment from the Department of Defense (DoD).
Update: CMMC Phase 2 Suspended on July 13, 2026
The Department of War's CIO suspended the CMMC Phase 2 rollout and opened a 60-day program review, informed by an industry Request for Information due August 14, 2026. Here is what that does and doesn't change.
- Paused: New Level 2 (C3PAO) and Level 3 (DIBCAC) third-party assessment requirements. Existing contracts that already carry them are being amended to remove them. No waivers are being issued, since there is nothing left to waive.
- Not paused: NIST SP 800-171 Rev 2 self-assessment, DFARS 252.204-7012, and FAR 52.204-21 all remain fully enforceable, as does CMMC Level 1 (Self) and Level 2 (Self).
For the full breakdown, see Deltek's article CMMC Suspended: Why the CMMC Phase 2 Pause Does Not Mean Stop.
Multi-Tiered Compliance Approach
Not all businesses handle mission-critical, sensitive data when working with the DoD. As a result, CMMC compliance requirements are divided into three levels: foundational, advanced, or expert.
If you've contracted with the DoD as a prime or subcontractor since 2017, you should already be aware of the requirements of implementing the NIST SP 800-171 security controls under DFARS 252.204-7012. If you have already done so, that puts you right on pace toward CMMC compliance.
NOTE: If you utilize a software or service provider that will handle or store CDI/CUI received or created as part of your DoD contract, be sure to confirm that your cloud service provider can support DFARS 252.204-7012 compliance requirements before your CMMC Level 2 or Level 3 assessment.
Understanding the Compliance Ecosystem
CMMC encompasses a community of affiliated organizations, government contractors, and third-party assessors committed to securing government data and ensuring accuracy and compliance of all parties involved.
While the goal is for certification for the DIB contractor community, the process to get here involves collective coordination across many organizations, including:
- Advisors: Registered Practitioners (RPs) and Registered Practitioner Organizations (RPOs)
- Assessors: Certified CMMC Professionals (CCPs) and Certified CMMC Assessors (CCAs, CLAs)
- Official CMMC Certification Publishers: Licensed Publishing Partners (LPPs)
- Educators/Trainers: CMMC Licensed Training Providers (LTPs)
- Certified CMMC Instructors
- CMMC Third-Party Assessment Organizations
CMMC Compliance Checklist
This CMMC compliance checklist gives your organization a head start on CMMC readiness. It covers seven steps, from identifying stakeholders to budgeting for certification costs, and holds up whether Phase 2 resumes as-is or under reformed rules.
CMMC is complex, and your specific requirements depend on your contracts and the data you handle. We recommend consulting a Certified CMMC Professional, a Certified Third-Party Assessment Organization (C3PAO), or other Registered Practitioner accredited by the Cyber AB for guidance specific to your organization.
"Treat compliance as a capability, not a cost center. There's tons of data to back this up, whether it's CMMC, some other cybersecurity requirement, or just protecting your own intellectual property. The gap between firms that are doing this and firms that aren't is widening."
— Michael Greenman, Senior Manager, Deltek
On the Deltek Podcast
1. Identify Internal Stakeholders
Include internal or outsourced IT, information security, and legal teams.
2. Conduct a Gap Analysis Against NIST SP 800-171
Compare your current security controls against the 110 security requirements (within 320 assessment objectives) within NIST SP 800-171. This gap analysis shows exactly which controls you still need to implement before a Level 2 assessment.
This step matters even more now: with third-party certification paused, self-assessment against NIST SP 800-171 is the primary compliance check the government relies on.
3. Plan Ahead for the Type of Assessment You Will Need
While contractors can self-assess for Level 1 certification, these self-assessments must be certified at the executive level. Some Level 2 certifications are eligible for self-assessment, but that will depend on the requirements of the contract (which may vary). In most cases, contractors will need to undergo assessments by certified third-party assessment organizations (C3PAOs). Level 3 certification will be required to undergo a government-led assessment every three years.
"Companies should be aware that the C3PAO ecosystem is not yet prepared to handle the number of late adopters."
— Eric Crusius, Partner, Hunter Andrews Kurth LLP
2026 Deltek Clarity GovCon report
4. Utilize Resources from the Cyber AB
The Cyber AB is the entity contracted by the DoD with accrediting the C3PAOs that conduct CMMC Assessments of companies within the DIB, though ISACA serves as the credentialing authority responsible for training and certifying assessors and instructors. The Cyber AB maintains a variety of resources for those seeking certification, including a marketplace listing the entities and individuals who are qualified to provide assessments or consult on certification strategies. You can find these resources at cyberab.org.
5. Consider Any Existing Obligations to Submit a Self-Assessment
Different CMMC certification levels and other contractual requirements may require you to have already submitted a self-assessment of your cybersecurity controls to the Supplier Performance Risk System (SPRS). Additionally, many prime contractors and business partners are pushing hard for early score submission to avoid any future concerns.
With third-party assessment certification paused, self-assessment and the accuracy of what you submit to SPRS is now the operative compliance record, and a false attestation carries False Claims Act risk exposure.
6. Budget for CMMC Compliance Costs
CMMC compliance isn't a one-time expense. Plan for ongoing investment in infrastructure, cybersecurity tooling, training, and continuous monitoring, and build these costs into your indirect rate structure rather than tracking them per contract.
Third-party assessment costs may shift while Phase 2 is under review, but NIST SP 800-171 self-assessment, documentation, and remediation costs continue regardless of the review's outcome.
7. Maintain Records of Compliance Throughout the Process
Maintain ongoing documentation of every security control, review, and submission throughout the process.
A System Security Plan and POA&M are still expected artifacts under self-assessment. Self-assessment doesn't mean informal assessment, and documentation is now your primary evidence of compliance in the absence of a third-party check.
"And, of course, with compliance and government, document, document, document — what are your policies and procedures, who is responsible for what, what data do you have, what systems does it touch, who has access to that information, who has levels of authority regarding that information."
— Shenê Commodore, CEO, Commodore Consulting
on the Deltek Podcast
Deltek Remains Committed to CMMC
Deltek is the intelligent platform built for high-stakes work, including supporting the compliance demands government contractors face under CMMC.
Deltek Costpoint GCCM is purpose-built for government contractors and other regulated industries, with governance and control built in, not bolted on.
For contractors who need to take complete control of their business operations from anywhere at any time, Deltek offers two industry-trusted solutions for managing their entire Enterprise Resource Planning (ERP) delivery.
- Deltek Costpoint GovCon Cloud (GCC) offers secure data hosting for Federal Contract Information (FCI) and non-DoD Controlled Unclassified Information (CUI).
- Deltek Costpoint GovCon Cloud Moderate (GCCM) can handle even greater compliance needs, supporting: CMMC Level 2/3 compliance, ITAR compliance, Covered Defense Information (CDI), and Controlled Technical Information (CTI). Costpoint GCCM is FedRAMP Moderate Equivalent and is listed on the FedRAMP Marketplace.
"Deltek Costpoint helps us reach our compliance goals with our federal customers."
— Janette Case, Accounting Supervisor, Applied Insight
Deltek built industry-standard security controls into its cloud infrastructure as the foundation for CMMC compliance. That obligation hasn't moved with the Phase 2 suspension, and neither has Deltek's commitment to it as Costpoint GCCM continues to support DFARS 252.204-7012 and NIST SP 800-171 Rev 2 requirements regardless of the outcome from the CMMC Reform Task Force findings.
Guide
Get Your CMMC Readiness Guide
See what changed in CMMC, what Phase 2 means for your contracts, and how to close compliance gaps before your audit.
Frequently Asked Questions
A CMMC compliance checklist is a step-by-step list of actions a defense contractor takes to prepare for Cybersecurity Maturity Model Certification. It typically covers identifying stakeholders, assessing current controls, choosing the right assessment type, and documenting compliance. Following one helps contractors avoid gaps before a certification review.
CMMC compliance requires implementing the security controls tied to your required maturity level, most commonly the 110 requirements in NIST SP 800-171 Rev 2 for Level 2 certification. Contractors also need documented policies, a system security plan, and a self-assessment or third-party C3PAO assessment (depending on Level and type of CUI). Requirements scale with the sensitivity of the data you handle.
Costs vary widely by organization size and current security maturity. In Deltek’s 2026 Clarity GovCon survey, 46% of contractors reported CMMC compliance costs of $100,000 to $249,000 to date, and 37% expect three-year costs to exceed $500,000. These cost figures encompass the preparation work for CMMC, not just the assessment itself. Budgeting for CMMC as an ongoing operating cost, not a one-time project, is realistic for most defense contractors.
CMMC compliance is complex but manageable with the right plan. The difficulty depends on your required maturity level, the current state of your security controls, and whether you need a self-assessment or a C3PAO assessment. Contractors who start with a gap analysis against NIST SP 800-171 typically find the process more predictable.
Level 1 covers foundational security controls for contractors handling Federal Contract Information. Level 2 verifies compliance against the 110 security requirements in NIST SP 800-171 and applies to contractors handling Controlled Unclassified Information. Level 3 adds the most stringent controls for the most sensitive CUI and requires a government-led assessment.
As of July 13, 2026, the Department of War (DoD) suspended the CMMC Phase 2 third-party assessment requirement, launching a 60-day review of the program. Phase 1 self-assessment obligations remain in place, and DFARS 252.204-7012 requirements are unaffected. New solicitations can currently require only Level 1 (Self) or Level 2 (Self) CMMC certifications.
Any Defense Industrial Base contractor or subcontractor that handles Federal Contract Information or Controlled Unclassified Information on a DoD contract needs to comply with CMMC 2.0. The required maturity level depends on the type and sensitivity of data in your specific contract.
A C3PAO is a Certified Third-Party Assessment Organization accredited by the Cyber AB to conduct official CMMC assessments. Most contractors handling prioritized CUI will need a C3PAO assessment. Self-assessment certifications are allowed on some CMMC Level 2 certifications, but all Level 1 certifications are self-assessed.
During the current Phase 2 review, program offices cannot add new C3PAO or DIBCAC requirements to solicitations, so most contractors will rely on self-assessment until the review concludes.
No. The suspension pauses the third-party assessment mechanism, not the underlying security obligation, and a false self-attestation still carries False Claims Act liability. The DoD’s last comparable review, in 2021, took roughly nine months to produce CMMC 2.0, so contractors who let their programs lapse risk a scramble when requirements resume.
Program offices cannot require Level 2 (C3PAO) or Level 3 (DIBCAC) third-party assessments in new solicitations until further notice, and contracts that already required them are being amended to remove that requirement. No waivers are being issued, since there’s nothing left to waive under the lower self-assessment tiers.
It’s a Department of War task force conducting a 60-day, top-to-bottom review of the CMMC program, informed by a public Request for Information with industry comments due August 14, 2026. Its recommendations could reshape assessment requirements, so contractors have a rare window to help shape what comes next.
