CMMC Roadmap: 12-Month Plan From Scoping to Assessment

10 min read · 2026-10-25

A CMMC roadmap is the plan that takes your company from "we handle defense contract data" to "we are ready for our CMMC assessment". It runs in six steps: confirm the level your contracts require, scope where that data lives, measure your gaps, write the system security plan, fix the gaps, then prove it with evidence. For most small and mid-size contractors aiming at Level 2, plan on about a year, and longer if you are starting with little in place.

The template below covers 12 months in six phases, each with a milestone you can check. It is written for the people who carry the work: IT managers, compliance leads, operations directors and the executive who will sign the affirmation. It stays at the planning level. Confirm the exact requirements, scoring rules and deadlines in the official CMMC program documents and with your assessor before you commit dates.

The roadmap at a glance

Goal: Your company has a defined assessment scope, a complete system security plan, every requirement implemented with evidence, and a booked assessment for the level your contracts require. Duration: 12 months

1. Confirm level and scope (Weeks 1-4)

   Know which level you need and exactly which people, systems and sites handle the contract data.

   • Pull every active and pursued DoD contract and subcontract, and check which clauses and data types they include.
   • Decide whether you handle only Federal Contract Information or also Controlled Unclassified Information, which sets your target level.
   • Map how the data arrives, where it is stored, who touches it and where it leaves, in one data flow diagram.
   • Build an asset inventory and sort each asset into the categories the official scoping guidance uses.
   • Decide whether to protect the whole company or a smaller enclave, and write down why.

   Milestone: A scoping document, data flow diagram and asset inventory signed off by the executive sponsor, with the target level stated.

2. Gap assessment (Weeks 5-10)

   Measure where you stand against every requirement in your target level.

   • Assess each requirement as met, partly met or not met, with a note on the evidence you have today.
   • Calculate your current self-assessment score with the DoD assessment methodology.
   • Group the gaps by control family, such as access control, audit and accountability, or incident response.
   • Estimate effort and the owner for each gap, and flag the ones that need purchases or outside help.

   Milestone: A gap report with the current score, the number of unmet requirements by family and an owner for each gap.

3. Plan, budget and document (Weeks 9-16)

   Turn the gap list into a funded plan and the core documents an assessor will read.

   • Write or update the system security plan so it describes how each requirement is met in your scope.
   • Open a plan of action and milestones with every gap, its owner and a target date.
   • Write the policies and procedures the requirements call for, starting with access, incident response and media handling.
   • Get budget approval for tools, cloud changes and outside support, grouped by quarter.

   Milestone: System security plan draft complete for every requirement, plan of action approved, and budget signed by leadership.

4. Remediate (Weeks 14-38)

   Close the gaps in the order that reduces the most risk and the most points.

   • Start with the high-value technical controls: multifactor authentication, encryption of the data at rest and in transit, and centralized logging.
   • Move contract data into the agreed scope, such as a dedicated cloud tenant or a separate network segment, and remove it from everywhere else.
   • Put recurring processes in place: account reviews, log reviews, vulnerability scans and patching on a schedule.
   • Train every in-scope user on handling the data and reporting incidents, and keep attendance records.
   • Update the system security plan and score each month as items close.

   Milestone: Every requirement marked as implemented in the system security plan, and the self-assessment score updated in the government reporting system.

5. Evidence and mock assessment (Weeks 36-46)

   Prove that each control works and has been running long enough to show a record.

   • Build an evidence folder per requirement: screenshots, configuration exports, logs, signed policies and meeting records.
   • Run a mock assessment with someone who did not implement the controls, using interviews, document review and live tests.
   • Fix what the mock assessment finds and record each fix in the plan of action.
   • Prepare the people an assessor will interview, from the system administrator to the receptionist who handles visitors.

   Milestone: A mock assessment report with no open findings that would stop certification, and an evidence folder for every requirement.

6. Assessment and sustainment (Weeks 44-52)

   Pass the assessment and keep the controls running afterward.

   • Book an authorized assessor early, since calendars fill up, and agree on the scope and logistics.
   • Support the assessment with a named coordinator and fast access to evidence.
   • Close any items the rules allow to remain open after assessment within the required window.
   • Set a calendar for ongoing checks and the yearly affirmation by a senior official.

   Milestone: Assessment completed, results posted, and a sustainment calendar with owners for every recurring control.

Common mistakes to avoid

• Starting with tool purchases before scoping wastes budget on systems that may be out of scope, so finish the data flow diagram and asset inventory first.
• Treating CMMC as an IT project leaves policy, training and physical controls behind, so assign HR, facilities and contracts owners from the start.
• Scoping the whole company by default makes the work far larger than it needs to be, so compare an enclave option before you decide.
• Writing a system security plan that describes how things should work, not how they do, falls apart in interviews, so write it from what is configured today.
• Collecting evidence the month before the assessment shows controls that have barely run, so set up recurring reviews early and keep their records.
• Assuming your MSP covers everything leaves gaps nobody owns, so write a responsibility list for every requirement and get their evidence.

Frequently asked questions

How long does it take to get CMMC Level 2 ready?

It depends on your scope, how much of NIST SP 800-171 you already meet and the help you have. Many small and mid-size contractors plan for around a year from scoping to assessment. Starting with little in place, or with a large scope, can take longer.

What is the first step in a CMMC roadmap?

Confirm the level your contracts require, then scope where the contract data lives. Without a clear scope, every later step is guesswork. A data flow diagram and an asset inventory are the core outputs.

What documents does a CMMC assessment look at?

Expect the system security plan, policies and procedures, the asset inventory, network and data flow diagrams, and evidence that each control works, such as logs, configurations and training records. Your assessor will confirm what they need. Interviews and live tests are part of it too.

Can a small company do CMMC without a consultant?

Many small companies handle Level 1 on their own. For Level 2, a common approach is to run the project internally and bring in outside help for the gap assessment, technical fixes or a mock assessment. Whatever you choose, keep an internal owner who understands the plan.

What happens after you pass a CMMC assessment?

You keep the controls running, close any allowed open items within the required window, and make the yearly affirmation. Reassessment follows the cycle set for your level. Keep the sustainment calendar and evidence folders current so the next assessment is not a rebuild.

Generate this roadmap with AI