CMMC Level 2 & CUI Enclave Readiness Checklist

Who this checklist is for

Defense contractors and subcontractors that handle Controlled Unclassified Information (CUI) and expect a CMMC Level 2 requirement in upcoming DoD contracts, including teams deciding whether to scope CUI into a dedicated enclave.

What's inside

The checklist is a one-page PDF with ten controls. Each has a Pass / Gap box so you can mark it up in a team meeting:

1. CUI enclave boundary. Keep CAD, ERP, and contract files that contain CUI inside a defined enclave so you can shrink the assessment scope.
2. Cloud hosting for CUI (DFARS 252.204-7012). Confirm that CUI email, files, and collaboration live in a cloud offering that meets the FedRAMP Moderate baseline or equivalent, such as Microsoft 365 GCC High.
3. FIPS-validated cryptography (SC.L2-3.13.11). Use FIPS 140-2/140-3 validated modules for disk encryption, VPN tunnels, and data in transit.
4. Phishing-resistant MFA (IA.L2-3.5.3). Require MFA, preferably FIDO2 hardware keys or Windows Hello for Business, for privileged and non-privileged access to CUI.
5. System Security Plan and POA&M. Maintain an SSP covering all 110 requirements and the 320 NIST SP 800-171A assessment objectives, and close any POA&M items within 180 days.
6. An SPRS score you can defend. Base the score you post in SPRS on evidence, not intent. Inaccurate self-attestations have led to False Claims Act settlements.
7. 24/7 monitoring and 72-hour incident reporting. Watch enclave endpoints and identity logs, and be able to report cyber incidents to DoD via DIBNet within 72 hours.
8. Engineering workload hardening. Apply application allowlisting, removable-media controls, and network segmentation to CAD/CAM, ERP, and shop-floor systems.
9. Vulnerability scanning and remediation (RA.L2-3.11.2). Scan regularly and patch critical, known-exploited vulnerabilities quickly, keeping reports as assessment evidence.
10. Protected backups with restore tests (MP.L2-3.8.9). Protect the confidentiality of CUI backups with encryption and immutability, and prove restores on a schedule.

How to read it

• The 72-hour DIBNet reporting requirement comes from DFARS 252.204-7012(c).
• DFARS 7012 requires cloud services that store or process CUI to meet the FedRAMP Moderate baseline or equivalent. GCC High is a common way to meet it, not the only one.
• Scoring follows the DoD Assessment Methodology: 110 points maximum, -203 minimum. Use our SPRS Score Worksheet to calculate yours.
• Patch timelines like "within 24 hours" are Emry's recommended targets, not a regulatory deadline.

Download

Download the PDF checklist (1 page) →

Related resources

• SPRS Score Worksheet for NIST SP 800-171 (Excel + PDF)
• CMMC compliance for defense contractors
• All resources