CMMC Gap Analysis Guide

What Is a CMMC Gap Analysis?

A gap analysis compares your current state (what you have today) to your target state (CMMC level compliance) and identifies the gaps. For CMMC, this means evaluating each of the 110 (Level 2) or 171 (Level 3) practices, determining which ones you've already implemented, and flagging those that need work.

The output is a prioritized list of remediation tasks with timelines and owners. Without a structured gap analysis, you'll waste resources fixing low-impact gaps while missing critical ones, or you'll discover major gaps during assessment when it's too late to fix them.

Why Gap Analysis Is Your Critical First Step

Many contractors jump directly to remediation without proper analysis. This leads to:

• Wasted spending: Buying software or hiring consultants for problems you don't have
• Assessment failures: Discovering during the official assessment that critical gaps remain
• Unrealistic timelines: Underestimating how long implementation takes, leading to failed deadlines
• Missed priorities: Fixing minor gaps while leaving high-risk vulnerabilities unaddressed

Gap analysis forces you to understand your baseline before you commit resources. It's the roadmap that prevents detours and false starts.

DIY vs. Consultant-Led Gap Analysis Comparison

Recommendation: Use a hybrid approach. Partner with a consultant for 3-4 planning sessions, then have your internal team execute gap analysis with consultant guidance. This builds internal capability while leveraging expertise.

Step-by-Step Gap Analysis Process

Step 1: Define Scope (Weeks 1-2)

Identify what systems and data are "in scope" for CMMC. Not everything needs to be CMMC-compliant, only systems handling Controlled Unclassified Information (CUI). Scope definition determines which practices apply.

• Map all systems (servers, applications, databases)
• Identify which ones touch CUI (customer data, technical specs, proposals, pricing)
• Document CUI flows: where data enters, where it's stored, where it exits
• Define network boundary: What's connected? What's isolated?

Step 2: Asset and Control Inventory (Weeks 2-4)

Create a comprehensive list of existing controls. Walk through your network with your IT team and document:

• Hardware: Servers, firewalls, workstations, mobile devices
• Software: OS versions, patch status, antivirus, encryption tools
• Access controls: User directories, authentication methods (local accounts? MFA?), permission structures
• Monitoring: Intrusion detection, antivirus logs, audit logging
• Policies: Written documentation of security practices
• Training: Evidence of security awareness training

Gap analysis typically requires 40-60 hours of effort

Allocate a dedicated internal team (compliance officer, IT lead, operations manager) for 2-3 months part-time.

Step 3: Map Controls to CMMC Practices (Weeks 4-8)

For each CMMC practice, document your current implementation. Use this template for each:

Step 4: Identify Gaps and Risk Rate (Weeks 8-10)

For each gap, rate it using a risk matrix:

• Likelihood: How likely is this control to be exploited? (Low/Medium/High)
• Impact: If exploited, how severe? (Low/Medium/High)
• Effort: How hard is this gap to fix? (Low/Medium/High)

Example: MFA not implemented = High likelihood + High impact + Medium effort = HIGH PRIORITY

Example: Policy wording needs refinement = Low likelihood + Low impact + Low effort = LOW PRIORITY

Step 5: Build Remediation Plan & POA&M (Weeks 10-12)

Create your Plan of Action & Milestones (POA&M) listing all gaps, owners, and target completion dates:

CMMC Gap Analysis Checklist by Domain

Use this checklist to ensure you evaluate all 14 CMMC domains systematically:

Access Control (AC)

• ☐ Written access control policy exists and is current
• ☐ User accounts managed with documented procedures
• ☐ Access control lists (ACLs) enforced on all systems
• ☐ Password policies require minimum complexity and length
• ☐ Privileged access (admin accounts) monitored and logged
• ☐ Inactive accounts disabled within 90 days
• ☐ Multi-factor authentication implemented for privileged access

Awareness & Training (AT)

• ☐ Annual security awareness training mandatory for all staff
• ☐ Training completion tracked and documented
• ☐ Specialized training for system admins and security roles
• ☐ Training content covers CMMC, data protection, incident reporting
• ☐ Contractor/temporary staff receive training before access

Audit & Accountability (AU)

• ☐ Audit logging enabled on all systems
• ☐ Critical events logged (login, data access, configuration changes)
• ☐ Logs retained for at least 90 days
• ☐ Log retention policy documented
• ☐ Audit logs reviewed regularly (monthly minimum)
• ☐ Unauthorized access attempts detected and alerted

System & Communications Protection (SC)

• ☐ Firewalls implemented and configured
• ☐ Network segmentation separates CUI systems from others
• ☐ Encryption in transit (TLS) for remote access and data transmission
• ☐ VPN used for remote work access
• ☐ WiFi encrypted (WPA3 or WPA2 minimum)
• ☐ Data at rest encrypted (sensitive servers and laptops)

Incident Response (IR)

• ☐ Incident response policy documented and signed
• ☐ Incident response team identified with named leads
• ☐ Escalation procedures defined (who to notify, when)
• ☐ Investigation procedures documented
• ☐ Evidence preservation procedures documented
• ☐ Post-incident review process defined
• ☐ Incident log maintained with at least last 3 years

System Development Lifecycle (SD) - Level 3 Only

• ☐ Secure coding practices documented
• ☐ Code review process before production
• ☐ Software testing includes security testing
• ☐ Third-party libraries/components tracked and patched
• ☐ Source code repositories protected with access control

How to Prioritize Gaps: Risk-Based Approach

Not all gaps are equal. Some are showstoppers; others are nice-to-have. Use this framework to prioritize:

Common Gaps Found in Defense Contractor Environments

• Weak access controls: Shared admin accounts, no MFA, overly broad file permissions
• Patching delays: Systems running 6+ months behind on security patches
• Missing encryption: Unencrypted laptops with sensitive data, unencrypted data transmission
• Inadequate monitoring: No intrusion detection, minimal audit logging, no automated alerts
• Procedural gaps: No incident response plan, no change control process, no backup verification
• Training deficiencies: Annual training incomplete, no specialized admin training, contractors not trained
• Third-party risks: No vendor assessment process, subcontractors not subject to same controls

Most contractors can address critical gaps in 3-6 months

With dedicated resources and proper planning, average defense contractor can reach Level 1-2 readiness in 6-9 months.

Gap Analysis Cost Breakdown by Approach and Company Size

From Gap Analysis Results to POA&M to Assessment

Gap analysis feeds into your Plan of Action & Milestones (POA&M):

1. Gap Analysis (6-12 weeks): Identify all gaps, prioritize, estimate effort and cost
2. POA&M Development (2-4 weeks): Create formal remediation plan with owners, dates, and budgets
3. Remediation Execution (6-12 months): Implement fixes, track progress, update POA&M monthly
4. SSP Development (4-8 weeks): Document your controls in System Security Plan
5. Assessment Readiness (4-6 weeks): Collect evidence, prepare demo systems, brief leadership
6. C3PAO Assessment (2-3 weeks): Official CMMC assessment with accredited assessor

Key Takeaways

A rigorous gap analysis is the foundation of successful CMMC compliance. It prevents wasted spending, identifies your true baseline, and creates a realistic remediation roadmap. Whether DIY or consultant-led, the gap analysis process forces you to understand your security posture before you commit resources.