CMMC 2.0 · Free readiness checklist

CMMC 2.0 Readiness Checklist

Find your Cybersecurity Maturity Model Certification (CMMC) level, check what still applies while Phase II is suspended, and stay ready for the outcome of the CMMC Reform Task Force review.

12 checks in 3 sections. About 15 min. It opens on this page as soon as you send the form. Last reviewed October 23, 2026.

Get the free checklist

Required

Optional email updates

Your checklist opens on this page right away. See our Privacy Policy for how we use your details.

Phase II is suspended. On July 13, 2026, the Department of War (formerly the Department of Defense, DoD) suspended CMMC Phase II, which had been due to start November 10, 2026. Phase I requirements remain: Level 1 and Level 2 self-assessments, with affirmations in the Supplier Performance Risk System (SPRS). Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 and NIST SP 800-171 Revision 2 still apply. As of October 23, 2026, no new Phase II date has been announced.

What this checklist covers

  1. Find your level 3 checks
  2. What still applies now 4 checks
  3. Stay ready 5 checks

Questions

Who is this checklist for?

Defense contractors and subcontractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

Will this checklist make us compliant or certified?

No. It is a readiness aid that helps you find gaps before you start work with an auditor or assessor. It is general guidance, not legal advice, and it does not know your specific systems.

What happens after I send the form?

The full checklist opens on this page straight away. Your ticks are saved in this browser only, and you can print the checklist or save it as a PDF.

Will you email me?

Only if you tick one of the boxes. We then send one email asking you to confirm your address, and the updates start only after you confirm. You can unsubscribe at any time. Our Privacy Policy explains how we use your details.

This checklist is a general readiness aid, not legal advice. It does not know your specific systems or environment, and completing it does not make an organization compliant or certified. Check obligations that apply to you with qualified counsel.