Free resource
For US defense supply-chain organisations handling FCI or CUI: CMMC Level 1 (FAR 52.204-21) and Level 2 (the 110 NIST SP 800-171 requirements), with SSP and POA&M. Score each item and see where a C3PAO assessor will push.
The actual structure of the file, straight from the template we use on live engagements.
Sheet: Start here
Read this tab first, then work through the checklist. Score honestly - a 'Partly' you can see is worth more than a 'Yes' you cannot evidence. This is a working tool, not a certificate: it shows where an assessor will push, before they do.
| Topic | Detail |
|---|---|
| What this is | A readiness check for organisations in the US defense supply chain that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) - covering CMMC Level 1 (FAR 52.204-21, 15 requirements) and Level 2 (the 110 NIST SP 800-171 Rev 2 requirements). |
| How to score | Yes = in place and you can show the evidence today. Partly = it exists but is incomplete, informal or unevidenced. No = not in place. Only a clear Yes counts when it is audited. |
| Readiness, not assessment | This is an implementation and readiness tool. A CMMC Level 2 certification assessment is performed by an authorised C3PAO (Level 1 is a supplier self-assessment). Kellwick prepares you; it does not perform the certifying assessment. |
| Scope first, always | Before anything else, identify where FCI and CUI live and draw the assessment boundary. Getting scope wrong - too wide or too narrow - is the single most expensive mistake. |
Sheet: CMMC and 800-171 Readiness
Score each item. Level 1 protects FCI (15 basic requirements); Level 2 protects CUI (110 NIST SP 800-171 requirements across 14 families). The middle columns show what a pass looks like and the failure assessors see most.
| Area | Check item | What good looks like | Most common failure (the red flag) | Status (Yes / Partly / No) | Owner | Evidence / gap |
|---|---|---|---|---|---|---|
| Scope (FCI/CUI) | FCI and CUI are identified, and the assessment boundary and CUI data flows are documented | A data-flow map and boundary diagram showing every system that stores, processes or transmits CUI | Scope assumed 'the whole company' or drawn to exclude systems that clearly handle CUI | - | - | - |
| SSP | A current System Security Plan describes how each in-scope requirement is met | A living SSP mapped requirement-by-requirement to real, named controls and systems | No SSP, or one written once and never reconciled to how things actually work | - | - | - |
| POA&M | Open gaps are tracked in a Plan of Action & Milestones with owners and dates | A POA&M with realistic remediation dates, reviewed on a cadence (note: some requirements cannot be POA&M'd) | Gaps known informally but never written down, or a POA&M that never closes | - | - | - |
| Access Control (AC) | Access is limited to authorised users, processes and devices; least privilege enforced | Role-based access, periodic access reviews, and separation of duties evidenced | Shared admin accounts and access that is never reviewed or revoked | - | - | - |
Preview only. The download is a fully editable .xlsx file.
Go deeper
See how this template fits the wider readiness work, and where we pick it up on a live engagement.
Explore the related serviceMore resources