CMMC Gap Analysis: The Complete 2026 Step-by-Step Guide

A CMMC gap analysis is the exercise of scoring yourself against every security requirement in your target CMMC level before anyone from outside does it for you. It is not a certification, it is not an audit, and it has no official status. What it does is tell you the number you would get today, which requirements are costing you points, and how far you are from the threshold that makes you eligible for award.

Most contractors run a CMMC gap analysis backwards. They buy tooling, write policies, then discover at the assessment that six requirements they never looked at are the ones that cannot be deferred. This guide walks the method in the order an assessor works, using the requirement counts and scoring rules in the CMMC program rule itself.

What a CMMC gap analysis actually produces

A CMMC gap analysis that is worth the time produces four things, and none of them is a maturity score out of five:

• A scope boundary — the systems, people and facilities in which Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) is processed, stored or transmitted.
• A requirement-by-requirement verdict — MET, NOT MET or NOT APPLICABLE against each requirement in your level, with the point value attached.
• An evidence inventory — the artifact that proves each MET verdict, named and located.
• A remediation plan — owners, dates and the order of work, driven by point value rather than by what is easiest.

Everything else is commentary. If your gap analysis report does not let you compute a score, it has not done its job.

Know which requirement set you are measuring against

The three CMMC levels draw on three different sources, and mixing them up wastes weeks. Per § 170.14 of the program rule:

Level	Requirements	Source	Who assesses
Level 1	15	48 CFR 52.204-21(b)(1)(i) through (xv)	Annual self-assessment
Level 2	110	NIST SP 800-171 Revision 2, in full	Self-assessment or a C3PAO, depending on the contract
Level 3	24 (on top of Level 2)	Selected requirements from NIST SP 800-172 (Feb 2021), with DoD organization-defined parameters	DCMA DIBCAC

One trap is worth flagging because it has cost people real money. CMMC Level 2 is assessed against NIST SP 800-171 Revision 2, not Revision 3. Revision 3 is the current publication at NIST, but the program rule states plainly that it is not applicable to CMMC. If your gap analysis is scored against Rev 3 control numbers — the giveaway is the 03.01.01 format and the appearance of Planning, System and Services Acquisition and Supply Chain Risk Management families — you have measured the wrong thing.

Why the Phase 2 suspension changed the timing, not the work

On 13 July 2026 the Department of War suspended the transition to Phase 2 of the CMMC rollout, along with pending and future implementation milestones. A follow-up memo directed contracting officers to amend solicitations and contracts that already carried Level 2 (C3PAO) or Level 3 requirements to remove them, and a class deviation issued on 3 September 2026 binds them to it. As of late October 2026 there is no announced restart date.

Read carefully what was not suspended. DFARS 252.204-7012 still applies. Phase 1 self-assessment requirements still apply. Your Supplier Performance Risk System (SPRS) score is still what a contracting officer looks at, and it is still a representation you are making to the government. The suspension removed the near-term third-party assessment deadline; it did not remove the obligation to implement NIST SP 800-171 or the consequences of claiming a score you cannot support.

Practically, this is the best window a contractor has had in three years to do the work properly instead of against a clock. A CMMC gap analysis run now has months of slack behind it rather than weeks.

Step 1: Scope before you score

Scoring an undefined boundary produces a number that means nothing. Before you touch a single requirement, categorize every asset as a CUI asset, a Security Protection Asset, a Contractor Risk Managed Asset, a Specialized Asset or an Out-of-Scope Asset. The category drives whether the asset is assessed, documented or excluded — and getting it wrong is the single most common reason a self-assessed score collapses under third-party review. Our guide to CMMC scoping and the five asset categories covers the decision tree.

Two scoping decisions deserve a deliberate answer rather than a default:

• Enclave or enterprise? Pulling CUI into a small, hardened enclave shrinks the assessed boundary dramatically. It also means every requirement must hold inside that enclave with no leakage, which is harder to prove than it sounds.
• Where does CUI actually land? Email, engineering file shares, the ERP, the backup target, the laptop of the one engineer who works from a home office. Trace it, do not assume it.

Step 2: Score all 110 requirements the way an assessor will

The CMMC scoring methodology starts you at the full requirement count and subtracts for what is not implemented. For Level 2 that means a 110-point scale, with each unmet requirement costing 1, 3 or 5 points depending on its security impact. A score of 110 means everything is in place. A score of 70 means you are a long way out, and the gap is not evenly distributed.

Three rules for scoring honestly:

1. Partial is NOT MET. There is no half credit. A requirement implemented on nine of eleven servers is not met.
2. Score the requirement, not the intention. “We have a policy that says we do this” is not implementation unless the policy is being followed and you can show it.
3. NOT APPLICABLE needs a written rationale. It is a legitimate verdict — a requirement about wireless access has no application if you run no wireless — but an assessor will ask you to justify it, so write the justification at the time.

If you want a quick first pass before committing to the full exercise, our free CMMC gap assessment tool walks the requirements and produces a scored report you can use as the starting draft.

Step 3: Separate the gaps you can defer from the gaps you cannot

This is where a CMMC gap analysis earns its keep, and where most of them go wrong. Not every unmet requirement can go on a Plan of Action and Milestones. Section 170.21 of the rule sets hard limits:

Situation	Can it go on a POA&M?
Any requirement at Level 1	No — POA&Ms are not permitted at Level 1 at any time
A 1-point requirement at Level 2	Yes
A 3-point or 5-point requirement at Level 2	No — with one exception
SC.L2-3.13.11 CUI Encryption	Yes, but only where encryption is in use and simply is not FIPS-validated

On top of that, six Level 2 requirements can never appear on a POA&M regardless of point value:

• AC.L2-3.1.20 — External Connections
• AC.L2-3.1.22 — Control Public Information
• CA.L2-3.12.4 — System Security Plan
• PE.L2-3.10.3 — Escort Visitors
• PE.L2-3.10.4 — Physical Access Logs
• PE.L2-3.10.5 — Manage Physical Access

Two numbers follow from this. To reach a Conditional CMMC Status at Level 2 your score divided by the total requirement count must be 0.8 or better — that is 88 of 110. And a Conditional status expires if the POA&M is not closed out by assessment within 180 days of the Conditional CMMC Status Date, with no extension available. The detail is in our guide to CMMC POA&M rules and conditional Level 2 status.

So your remediation order is set for you: the never-deferrable six first, then the 5-point requirements, then 3-point, then anything needed to clear 88. Everything else can wait.

Step 4: Collect evidence, not assertions

A CMMC gap analysis that records verdicts without naming the artifact behind each one has to be redone before any real assessment. For each MET requirement, write down what you would hand over: the configuration export, the screenshot with a date, the ticket showing the review happened, the signed acknowledgement, the log sample.

Three evidence patterns fail consistently:

• Policy without practice. A documented procedure and no record of it being executed. Assessors test both.
• Evidence from one point in time. A requirement that calls for periodic review needs at least one completed cycle, not a calendar invite.
• Screenshots with no provenance. No hostname, no timestamp, no indication which system it came from.

The System Security Plan is the spine of all of this, and it is one of the six requirements you can never defer. If the SSP does not exist, nothing else you score matters yet.

Step 5: Write the remediation plan and the affirmation trail

Turn the gap list into dated, owned work. For each gap record the requirement ID, point value, the specific deficiency, the fix, the owner by name, the target date and the evidence that will prove closure. Sort by point value and by whether deferral is permitted, not by convenience.

Then decide who your Affirming Official is. The rule puts the affirmation of continuing compliance in SPRS on a named senior representative, who must affirm on achieving Conditional status, on achieving Final status, annually afterwards, and after a POA&M closeout. That person should see the gap analysis before they are asked to sign anything.

CMMC gap analysis vs CMMC assessment: the difference that matters

These get used interchangeably and they are not the same instrument.

	Gap analysis	CMMC assessment
Status	Internal, no official standing	Self-assessment or certification recorded in SPRS
Purpose	Find out where you are	Establish a CMMC Status for award eligibility
Who runs it	You, or a consultant	You (Level 1 and Level 2 self), a C3PAO (Level 2 certification), DIBCAC (Level 3)
Output	Scored gap list and remediation plan	Score, CMMC Status, POA&M if eligible, affirmation
Consequence of a bad result	Work to do	Ineligible for award; a knowingly false score carries False Claims Act exposure

The gap analysis is the cheap rehearsal. Treat it as the place to be pessimistic, because the assessment is not.

How long a CMMC gap analysis takes and what it costs

A CMMC gap analysis is cheap compared with what follows it. These are typical ranges, and they move a lot with scope, so treat them as planning figures rather than quotes:

• Small contractor, tight enclave, Level 2 (under 50 staff): typically two to four weeks of elapsed time, with roughly 40 to 80 hours of internal effort.
• Mid-size contractor, enterprise scope, Level 2: typically four to eight weeks, often 150 hours or more of internal effort across IT, HR, facilities and engineering.
• Consultant-led gap analysis: commonly quoted in the low tens of thousands of dollars for Level 2, varying widely with the number of systems and sites in scope.

The elapsed time is usually driven by evidence collection, not by scoring. Scoring 110 requirements takes days. Finding out whether the quarterly access review actually happened in Q2 takes weeks.

If you want the document set rather than the assessment, our CMMC Documentation Toolkit ships 107 templates mapped to the Level 2 requirements — the SSP, the POA&M register and the policies that sit behind the 110 — for $99, which is less than a day of consulting.

CMMC gap analysis FAQ

Do I still need a CMMC gap analysis now that Phase 2 is suspended?

Yes, if you hold or want DoD contracts that involve FCI or CUI. DFARS 252.204-7012 and the Phase 1 self-assessment requirements were explicitly unaffected by the suspension, and your SPRS score remains a representation to the government. The suspension removed a deadline, not an obligation.

What score do I need to pass?

Final CMMC Status at Level 2 requires all 110 requirements met. Conditional status requires a score of at least 88 of 110, with every deferred item eligible for a POA&M and the POA&M closed out within 180 days.

Can I do a CMMC gap analysis myself or do I need a C3PAO?

You can and should do it yourself — a gap analysis has no official status, so a C3PAO adds nothing to it beyond a second opinion. Keep the C3PAO budget for the certification assessment, where it is required.

Should I score against NIST SP 800-171 Rev 2 or Rev 3?

Revision 2. The CMMC program rule incorporates Rev 2 by reference and states that Revision 3 is not currently applicable. Rev 3 matters for your future planning, not for your score.

How often should I repeat it?

Annually at minimum, because the affirmation is annual, and additionally after any material change to scope — a new site, a new CUI-handling system, a migration, an acquisition.

Where to start this week

Draw the boundary, list the assets in their five categories, then score the 110 requirements against NIST SP 800-171 Rev 2 and write down the evidence for every MET verdict. Fix the never-deferrable six and the 5-point gaps first. That sequence is what turns a CMMC gap analysis from a document into a plan, and the suspension of Phase 2 has handed you the time to do it without shortcuts.

For the wider rollout picture and how the phases were meant to work, start with our guide to CMMC compliance and the four-phase rollout. The authoritative requirement text is in 32 CFR part 170 on eCFR.