Read this guide freely. Request download access with your name and email.
GDF records the selected resource in its lead intake and private Stats.
Open your emailed link for seven days of preparation downloads in this browser.
No marketing subscription is created. Keep completed records in controlled systems.
Gather the contract, information-flow and existing security records a CMMC or NIST SP 800-171 specialist needs to propose and scope work.
Contract managers, small-business owners, CISOs, project coordinators and IT providers
FCI/CUI safeguarding and CMMC preparation. This package does not calculate a score, award status, perform an assessment or replace the required assessor.
Current official program announcements report the July 13 2026 suspension of the CMMC Phase II transition previously scheduled for November 2026, while Phase I and safeguarding continue. The retrieved Class Deviation 2026-O0025 Revision 3 directs contracting action and retains NIST SP 800-171 Revision 2 safeguarding. Ask for the actual solicitation amendments and signed contract modifications; a website announcement does not itself rewrite the client contract.
The contract administrator should supply the incorporated clauses, dates, prescribed assessment type and written flowdowns. The specialist resolves conflicts among the actual contract, current deviations and program rules. Do not tell every contractor that a third-party certification is due on November 10 2026 or that all duties disappeared.
NIST published Revision 3 of SP 800-171 and SP 800-171A, but the reviewed CMMC program materials and 2026 implementation memo retain Revision 2 for the stated baseline. The newest publication is not automatically the correct contract criterion. Confirm the exact paired requirements and assessment methods before mapping evidence.
FCI, CUI, export-controlled information and classified information have different bases. Ask the government/customer owner about CUI categories, markings and handling. A defense customer, confidential label, CAGE code or domestic cloud region alone does not determine the required level or boundary.
Keep sensitive records and assessment artifacts in the agreed controlled environment. The preparation index should describe them and point to them. It should not become an uncontrolled copy of CUI, security protection information or export-controlled material.
Give each request to the suggested owner. Record what is available and what is unknown in the editable CSV checklist. Use a secure evidence location agreed with the recipient; the checklist is an index, not a place for passwords, real patient data or controlled technical information.
Records to find
Download the editable gathering checklist. CSV files contain plain records, without saved column widths or workbook formatting. Import as UTF-8, keep IDs as text, wrap text and widen columns before use. Blank client fields are intentional.
CM-R01 Actual contract package
Ask
Contract administrator
Gather
Solicitation, statement of work, contract, orders, incorporated clause versions, flowdowns, amendments, modifications, options and correspondence about CMMC.
Where to ask
Contract repository and prime customer
Why it may be needed
Establishes the basis for specialist scoping.
If missing or uncertain
Ask prime/contract officer through authorized client channels; record unresolved interpretations.
Customer-provided CUI categories/markings, handling instructions, FCI description, contract data lists and export/security restrictions; masked examples where permitted.
Where to ask
Program office, contract data repository
Why it may be needed
Supports the data classification and boundary discussion.
If missing or uncertain
Record who can confirm the designation; do not create a CUI designation or remove a marking.
Systems that create, receive, process, store, transmit or protect relevant information; tenant/site/network diagrams, users, interfaces and external transfers.
Where to ask
Architecture, process walkthrough and providers
Why it may be needed
Lets the specialist define candidate in-scope assets and dependencies.
If missing or uncertain
List unconfirmed paths, personal accounts and legacy systems for follow-up.
MSP/MSSP/CSP contracts, service boundaries, customer responsibility matrices, subcontractor access and existing authorization/equivalency evidence requested by the specialist.
Where to ask
Procurement, cloud providers and contract files
Why it may be needed
Clarifies inherited versus client-performed work and evidence access.
If missing or uncertain
A sales claim or FedRAMP listing does not establish the clients configured service boundary. Ask for exact service/scope and responsibility records.
Logging policy and actual coverage/retention, alert reviews, time synchronization, incident plans, existing exercises and reporting records when releasable.
Where to ask
SIEM, providers and incident repository
Why it may be needed
Prepares audit/accountability and incident-response discussions.
If missing or uncertain
Document inaccessible logs or periods; do not reconstruct or submit an incident report from this checklist.
Reference: NI01 audit and accountability, incident response; CM05
Avoids moving sensitive evidence into uncontrolled preparation files.
If missing or uncertain
Agree the route before providing CUI or detailed artifacts. If assessment hashes or retention records are required, obtain the applicable instructions.
Download the response template. A useful answer names the actual system, period, supporting record and limits. If you do not know, name the person or provider who can answer.
1. Which signed clauses and modifications tell us the required assessment type today?
Suggested responder
Client IT or system owner
Useful supporting record
Contract extracts, effective dates and unresolved conflict log.
2. Where does the customer say the CUI comes from, and which category or handling instruction supports that?
Suggested responder
Client IT or system owner
Useful supporting record
Written customer direction and a permitted masked example.
3. Can a relevant file leave the proposed enclave through email, sync, printing, support, backup or personal storage?
Suggested responder
Client IT or system owner
Useful supporting record
A diagram and one actual workflow explanation, not a speculative answer.
4. Which security services protect the environment and who operates them?
Suggested responder
Client IT or system owner
Useful supporting record
Provider scope and customer responsibility matrix.
5. What controls are planned rather than operating?
Suggested responder
Client IT or system owner
Useful supporting record
Existing SSP/POA&M version and implementation dates.
6. What records are available for the period, and which are only current snapshots?
Suggested responder
Client IT or system owner
Useful supporting record
An evidence-period inventory with gaps.
7. Has an assessment or affirmation actually been entered into SPRS?
Suggested responder
Client IT or system owner
Useful supporting record
Authorized export or receipt with the relevant identifier and scope.
8. What must the receiving specialist verify before scheduling work?
Suggested responder
Client IT or system owner
Useful supporting record
Boundary, criteria/version, provider cooperation, access and secure-evidence decisions.
Missing facts and specialist decisions
These are explicit handoff questions. Marking records Received does not resolve them. Add client-specific questions and a responsible person.
CM-Q01 What is the effect of the current suspension/deviation on this actual contract?
Ask
Contracts counsel and authorized contracting contact
Gather
Signed contract and modifications; current deviation including later changes
Resolution needed
Written contract-specific interpretation before committing to an assessment path or date.
CM-Q02 Which requirement and assessment revisions and asset boundary should the specialist use?
Ask
Receiving CMMC/NIST specialist
Gather
Contract data types, SSP, diagrams, provider services and official criteria
Resolution needed
Agreed criterion/version and scope; no score or certification inferred from the preparation inventory.
Actual contract package and current amendments are indexed.
FCI/CUI questions and boundary/provider gaps remain visible.
Security records are grouped by subject and period; planned items are labeled.
Recipient confirms assessment pathway, correct revision and handling before any formal work.
Download the record index. Use the shared walkthrough for custody, restricted records, missing information and receipt steps.
Sources for this package
Official laws/rules establish duties within their scope. Guidance explains programs; NIST supplies methods; vendor documentation describes possible product behavior. Actual contracts, facts, configuration and case orders still matter.
