Planning principle

Do not start with a checklist until the assessment objective is clear.

Define whether the organization is preparing for a CMMC self-assessment, C3PAO assessment, DIBCAC review, DCSA system authorization, security review, ATO renewal, customer audit, internal readiness assessment, or proposal representation. Each has different authorities, evidence, participants, and consequences.

Scope

Write a one-page scope statement before collecting artifacts.

ObjectiveWhat decision or result must the assessment support?
AuthorityWhich contract, rule, guide, customer, sponsor, or authorizing official governs?
BoundaryWhich systems, services, facilities, users, providers, and data flows are included?
PeriodWhat operating period must evidence demonstrate?
ParticipantsWho owns controls, evidence, interviews, demonstrations, remediation, and approvals?
DeliverablesWhat package, score, report, decision, or corrective-action record is expected?

Evidence

Collect evidence by requirement and business process.

Create an evidence index that identifies the control or requirement, implementation owner, system, artifact, date, review period, storage location, sensitivity, and validation status. Evidence should be current enough for the assessment objective and consistent with the documented environment.

People

Prepare interviewees to explain what they actually do.

Interview preparation should focus on roles, decisions, normal processes, exceptions, records, and escalation. Avoid scripts that create answers inconsistent with practice. The strongest response is a clear explanation supported by evidence and a demonstration.

Timeline

Use a readiness sequence that exposes risk early.

Week 1

Authority and scope

Confirm requirements, boundaries, participants, and deliverables.

Week 2

Implementation review

Validate controls, architecture, documentation, and operating records.

Week 3

Evidence and testing

Organize artifacts, test samples, conduct interviews, and record gaps.

Week 4+

Remediation and rehearsal

Prioritize findings, close gaps, validate changes, and rehearse the assessment.

Assessment kickoff checklist