Calling a C3PAO before you are ready is the single most expensive mistake in CMMC. A failed Level 2 assessment costs you the assessment fee, the cost of a second attempt, and contract awards you cannot bid on while you re-work. The verified C3PAO assessor engagement alone runs $31,234 for a small entity and $52,056 for a larger one, so a repeat is real money. This checklist is the readiness gate. Score yourself against 14 items. If you cannot honestly check every box, do not book the assessment yet. (We provide readiness software; we are not a C3PAO and do not issue certifications.)
Why a readiness checklist matters
C3PAO outcomes are close to binary in practice: you pass and earn a three-year Level 2 certification, or you receive a conditional status that gives you a defined window to close residual gaps before being downgraded. Conditional is recoverable but costly, and many of those gaps are exactly the kind a structured pre-assessment would have caught.
The checklist below is built from the failure patterns that surface in publicly discussed C3PAO outcomes. Treat it as a gate, not a guide.
The 14-item CMMC readiness checklist
Items 1 to 4: Scope and documentation
- CUI data flow diagram. Every system, application, user, and external party that touches CUI is mapped. No dotted lines, no "unknown" boxes.
- System Security Plan (SSP) covering all 110 NIST SP 800-171 controls. Each control has an implementation statement, an evidence reference, and a named owner.
- Plan of Action and Milestones (POA&M) listing every Partially Met or Not Met control with a target close date and owner. An empty POA&M is itself a flag; assessors expect to see open items.
- Asset inventory complete. Every endpoint, server, mobile device, network device, and cloud resource in the CUI scope is enumerated with owner and configuration baseline.
Items 5 to 9: Technical controls
- Multi-factor authentication enforced on every account with access to CUI, including service accounts, admin accounts, and remote access. No exceptions.
- FIPS-validated encryption at rest and in transit on all CUI-touching systems. The cipher list and validation certificates are documented.
- Centralized logging in place. Authentication events, access to CUI, configuration changes, and security tool alerts are captured in a SIEM or equivalent, with retention that meets your policy.
- Endpoint detection and response (EDR) deployed on every CUI-touching endpoint, with alerts routed to a defined responder.
- Configuration management with documented baselines and change control. Drift is detected and either approved or remediated.
Want a fast read on how many of these items you can honestly check today? The free 2-minute gap check is a directional self-assessment, not an official SPRS score, and it points you to the work. Run the free gap check →
Items 10 to 12: Operational controls
- Incident response plan tested. A current tabletop exercise on record, with documented outcome and lessons learned.
- Security awareness training completed by all in-scope users on a recurring basis, with training records retained.
- Vendor and supply chain controls. Every subcontractor or vendor that touches CUI has flow-down clauses and documented assurance.
Items 13 to 14: Evidence and self-score
- Evidence library complete. Every implementation statement in the SSP has at least one piece of supporting evidence (screenshot, config export, log sample, policy excerpt) with date and source.
- Self-assessment score recorded. Run the DoD Assessment Methodology against your environment so you walk in with an honest number and know which controls are still open.
How to score yourself honestly
The DoD Assessment Methodology assigns point values to each of the 110 controls. The score is only honest if the evidence backs the rating. The most common failure mode is rating a control "Met" because the tool is purchased and licensed, when the evidence shows it is misconfigured or not collecting data on the in-scope systems. Confirm the current passing thresholds and scoring rules against published DoD guidance before you treat a number as a go decision.
What a conditional outcome costs you
A conditional outcome gives you a defined window to close residual gaps, and you can use the certification for contract eligibility during that window. But you commit your team to remediation under time pressure, you pay for the follow-up confirmation, and you do not get the full three-year clock until the conditional converts to a full certification. For budgeting, the verified small-entity C3PAO assessor engagement is $31,234, and the full three-year Level 2 certification cost is $104,670 for a small entity and $117,768 for a larger one. Avoiding a re-do is worth the discipline of this checklist. For a deeper budget view, see our coverage of CMMC Level 2 cost.
How AI-native readiness differs from spreadsheet readiness
Spreadsheet readiness, the legacy GRC approach, is a checklist someone walks through once a quarter. It is a snapshot of intentions, not a measurement of operating state, and a large share of the gaps that surface at assessment are drift between the spreadsheet and the live environment.
AI-native readiness is continuous. The platform observes the live environment, scores each control against current state, surfaces drift in hours rather than quarters, and pre-populates evidence with provenance. The 14-item checklist becomes a single dashboard view that updates whenever something changes, and your authorizing official approves what gets attested. That is the difference between walking into a C3PAO with a checklist you filled out two weeks ago and walking in with a live readiness picture you trust. For the path from here to the assessment date, see our CMMC certification process timeline, and if self-assessment is on the table, read CMMC self-assessment requirements.