CMMC Gap Assessment: How to Identify Compliance Gaps

Written by

A CMMC gap assessment compares an organization’s current cybersecurity practices and documentation to applicable requirements.

Start With Scope

Understand where relevant information is stored, processed and transmitted and which systems provide security protection.

Examine identity, access, endpoints, network security, configuration, logging, monitoring and data protection.

Compare actual practices with the System Security Plan, policies, procedures and supporting evidence.

Evidence can include configurations, screenshots, logs, policies, procedures, tickets and reports.

A remediation roadmap should identify dependencies, owners, technical work, policy changes and documentation updates.

A gap assessment may include Entra ID, Intune, Defender, Purview, SharePoint and OneDrive. See Microsoft 365 consulting and CMMC Microsoft 365.

A gap assessment can feed an updated SSP and POA&M.