Federal Cybersecurity Compliance Checklists

How to use these checklists

Use them to organize questions—not to declare compliance.

Checklists help expose missing decisions and records. They do not replace control testing, contract analysis, government guidance, or an independent assessment.

Common foundation

Federal cybersecurity readiness

Applicable contracts, clauses, data requirements, and customer direction are identified.
Protected information types and data flows are documented.
System, facility, user, provider, and network boundaries are documented.
Security and compliance responsibilities are assigned.
Inventories are current and traceable to the documented environment.
Policies and procedures match actual operations.
Technical configurations and operational records are retained as evidence.
Findings, remediation, exceptions, and risk decisions are centrally tracked.
Changes are evaluated for security, scope, and authorization impact.

Defense Industrial Base

CMMC readiness

The required CMMC level and assessment type are confirmed for each relevant opportunity.
FCI and CUI are identified and mapped to the systems that process them.
CMMC asset categories and scope are documented.
The SSP describes current implementation.
External service-provider responsibilities and evidence are documented.
Evidence demonstrates both configuration and recurring operation.
POA&M eligibility and closure requirements are understood.
SPRS submissions and leadership affirmations are assigned and reviewed.

Open the full CMMC guide

Classified processing

DCSA RMF and authorization

DD Form 254 and classification guidance are available and current.
The facility, processing location, system mission, and classification are approved.
ISSM, ISSO, FSO, system owner, and user responsibilities are defined.
NISP eMASS access and package responsibilities are established.
The authorization boundary and all interfaces are documented.
Controls, tailoring, inheritance, assessment procedures, and evidence are traceable.
Findings and residual risk are documented for authorization decisions.
Continuous monitoring and change-control requirements are scheduled.

Open the full DCSA RMF guide

Opportunity and performance

DoD contracting readiness

SAM.gov registration and entity information are active and accurate.
Target customer, opportunity, acquisition path, and competitive position are understood.
FAR, DFARS, agency, data, cloud, security, and flowdown clauses are reviewed.
Pre-award representations and assessment requirements are confirmed.
Pricing includes the actual cost of security and compliance.
Partners and subcontractors understand their responsibilities.
Proposal claims match current capability or a funded transition plan.
Post-award onboarding, systems, reporting, and evidence processes are planned.

Open the full DoD contracting guide

Use checklists to find missing decisions—not to declare compliance.

Use them to organize questions—not to declare compliance.

Federal cybersecurity readiness

CMMC readiness

DCSA RMF and authorization

DoD contracting readiness

Official references

Build a practical plan for your actual contract, systems, and timeline.