CMMC Level 2Readiness check

Have you defined your CUI scope, including the cloud services and service providers that touch CUI?

If you use cloud services for CUI, have you confirmed they meet the required security standard and documented who is responsible for each control?

Have you identified where CUI is stored, processed and transmitted, and limited access to it by role and least privilege?

Do you control remote access and the use of mobile and removable devices for CUI?

Do staff and administrators receive security awareness training, including insider threat awareness?

Do you log security-relevant events on CUI systems, protect the logs and review them?

Do you maintain baseline configurations and an inventory of systems in your CUI scope, and control changes?

Do you require multi-factor authentication for privileged accounts and for remote and network access to CUI systems?

Do you have a tested incident response plan that covers detecting, reporting and handling incidents?

Is maintenance on CUI systems controlled, including remote maintenance sessions?

Do you mark, protect and sanitize media that holds CUI?

Do you screen people before they get access to CUI and revoke access when they leave or change roles?

Are physical access, visitors and devices controlled where CUI systems are kept?

Do you run risk assessments and scan for vulnerabilities in your CUI environment, and fix what you find?

Do you have a written system security plan (SSP) for your CUI environment?

Do you keep a plan of action and milestones (POA&M) for gaps you have not closed?

Do you assess your security controls periodically and monitor them continuously?

Do you have documented policies and procedures for each of the 14 control families?

Can you produce evidence, such as logs, screenshots and records, that each control operates as described?

Is your CUI environment separated from other networks, with boundary protection and deny-by-default network rules?

Is CUI encrypted in transit and at rest with FIPS-validated cryptography?

Do you patch flaws, protect against malicious code and monitor your systems for attacks?