CMMC 2.0 Compliance Checklist for Defense Contractors (2026)

To prepare for CMMC 2.0 in 2026, confirm your required level and assessment type, map every place federal contract information or controlled unclassified information flows, implement the applicable safeguards, document the system, retain evidence, fix gaps, complete the required assessment and affirmation, and keep controls operating after the assessment.

What does CMMC 2.0 require in 2026?

The Cybersecurity Maturity Model Certification program connects cybersecurity requirements to Department of Defense contracts. A contractor's obligation depends on the information it handles and the language in the solicitation and contract.

The program has three levels. Level 1 addresses basic safeguarding of federal contract information, or FCI. Level 2 addresses controlled unclassified information, or CUI, using NIST Special Publication 800-171. Level 3 adds selected advanced requirements. Depending on the procurement, an organization may need a self-assessment, a Certified Third-Party Assessment Organization, or a government assessment.

Rules, contract clauses, and guidance can change. This checklist is a planning aid based on the program structure available as of September 2026, not legal advice. Verify requirements in current Department of Defense materials, 32 CFR Part 170, the solicitation, and the contract.

What should be on a CMMC 2.0 compliance checklist?

1. Confirm the required level and assessment type

Do not begin by buying tools. Begin with the actual obligation.

• [ ] Identify every current and expected DoD solicitation and contract.
• [ ] Record the stated CMMC level for each.
• [ ] Record whether self-assessment, C3PAO assessment, or government assessment is required.
• [ ] Review relevant flow-down obligations for subcontractors.
• [ ] Resolve unclear language with the contracting officer and qualified advisers.

A supplier should not select its own level based only on company size. The procurement requirement controls.

2. Identify where FCI and CUI enter, move, and leave

Create a data-flow map. Include people, endpoints, applications, cloud services, networks, facilities, external providers, and subcontractors.

• [ ] List the contracts that generate FCI or CUI.
• [ ] Identify data owners and authorized users.
• [ ] Map storage, processing, transmission, backup, and disposal.
• [ ] Include email, collaboration, support, engineering, and administrative paths.
• [ ] Record external service providers and security protection assets.

3. Reduce and define the assessment scope

Consider a controlled enclave when it fits business and contract needs. Separate CUI workflows where practical, restrict authorized identities and endpoints, control exports and remote access, and validate external-provider responsibilities. An enclave is not automatically compliant. Check identity systems, tickets, logs, backups, and support tools for hidden data paths.

4. Build a requirement-by-requirement control matrix

For Level 2, map the applicable NIST SP 800-171 requirements to real implementation. Confirm which revision the current rule and contract require rather than assuming.

5. Create and maintain the system security plan

The system security plan, or SSP, should describe the environment and how requirements are implemented. Keep it aligned with diagrams, inventories, policies, and actual configurations.

• [ ] Define system boundaries and operating environment.
• [ ] Describe implementation for applicable requirements.
• [ ] Link diagrams, inventories, and responsible roles.
• [ ] Document external dependencies.
• [ ] Establish change control for the SSP.

6. Test controls and collect objective evidence

Evidence should show both configuration and operation. A screenshot may help, but it rarely explains an entire process.

• [ ] Interview control owners.
• [ ] Inspect configurations and technical outputs.
• [ ] Observe procedures where useful.
• [ ] Link each item to the requirement and assessment objective it supports.
• [ ] Check dates, identities, scope, and approvals.

Use the applicable DoD CMMC assessment guidance and current official guides. Do not rely on a generic checklist as a substitute for assessment objectives.

7. Score honestly and remediate gaps

Perform a structured gap assessment before the formal event. For Level 2 environments, align scoring with the applicable DoD Assessment Methodology.

• [ ] Record unmet objectives and the evidence basis.
• [ ] Prioritize gaps that affect data protection or assessment eligibility.
• [ ] Assign an owner and due date.
• [ ] Retest after remediation.
• [ ] Submit required scores in the designated government system when applicable.

Do not treat a Plan of Action and Milestones, or POA&M, as permission to defer anything. The CMMC rule limits when POA&Ms may be used, may exclude particular requirements, and imposes closeout conditions. Confirm the current rules.

8. Prepare for the required assessment

• [ ] Confirm scope and logistics with the authorized assessment party.
• [ ] Make control owners available.
• [ ] Reconcile the SSP, asset inventory, network diagrams, and control matrix.

VioletX can support readiness and implementation, but it does not replace a C3PAO or government assessor when an independent assessment is required.

9. Complete affirmations and contract-specific actions

CMMC includes affirmation responsibilities. Identify the affirming official and make sure that person has enough evidence to make the statement responsibly.

Verify timing and status, close eligible POA&M items within required conditions, and preserve submission records. Seek legal advice for representations and contract interpretation.

10. Operate the program continuously

Passing an assessment is not the end of the security obligation.

• [ ] Run recurring access, vulnerability, incident, and risk activities.
• [ ] Review changes before they alter scope or control operation.
• [ ] Monitor external providers and subcontractors.
• [ ] Preserve evidence as work occurs.
• [ ] Reassess after material architecture or contract changes.

How can software and services support CMMC readiness?

VY Security is the platform. Its work queue assigns tasks across staff and approved AI agents, while its append-only proof ledger preserves actions, evidence, corrections, and approvals.

VioletX is the services arm. Its onshore specialists can help with CMMC advisory, scope analysis, readiness, implementation coordination, and related security work. That combined model gives a team both an accountable system of record and people who can help execute the plan.

Neither VY nor VioletX should be described as issuing a CMMC certification. Required independent assessments must be performed through the authorized program path. Customers also remain responsible for contract obligations and affirmations.