Cybersecurity Maturity Model Certification (CMMC)
Assessment Scoping Questionnaire

First Name*

Last Name*

Email*

Phone Number*

Client Company:*

Primary Contact:*

Assessment Timeline:

Requested Start Date*

Requested Completion Date:*

Is the desired completion date firm, or is there flexibility to adjust if needed?*

What is your organization’s size (e.g., number of employees, locations)?*

Who is the primary point of contact for cybersecurity or compliance efforts (name, title, email, phone)?*

Scope Definition

Does your organization currently handle Controlled Unclassified Information (CUI)?*

Yes or No

If yes, describe the type of CUI handled:

What is the estimated volume of CUI processed, stored, or transmitted annually?*

Total Amount (e.g. 1 GB, 1-10 GB, not sure/unable to estimate)

Which systems, networks, or processes currently interact with CUI?*

Devices, servers, and locations where CUI is stored and transmitted.

Do you have subcontractors or subsidiaries that will need CMMC compliance?*

If yes, please fill out a questionnaire for each entity.

Current Security Posture

Do you have an Information Security Policy, Privacy Policy, Acceptable Use Policy, and Security Operations Manual? List any other related Information Security Policies you have.*

Answer or N/A?

Have you performed a NIST SP 800-171 self-assessment?*

Answer or N/A

When was your last Risk Assessment completed?*

Answer or N/A?

When was your last Vulnerability Test / Penetration Test?*

Answer or N/A?

Do you maintain a Plan of Actions & Milestones (POA&M) or a corporate document which outlines findings from your security assessments along with target remediation dates?*

Answer or N/A?

Do you have an active incident response plan?*

Yes or No

Network and Infrastructure

How many physical locations does your organization operate from? *

Count or N/A

Do you use on-premises, cloud, or hybrid infrastructure?*

On-Premises / Cloud / Hybrid

What are your primary cloud service providers (if applicable)?

Do you use any third-party managed services?*

Yes or no. If yes, list the services

Cybersecurity Practices

Do you have security awareness training in place for all employees? If so, how frequently is it conducted?*

Answer or N/A?

Do you have a System Security Plan (SSP)?*

Answer or N/A

Is Multi-Factor Authentication (MFA) implemented?*

Yes or no. If yes, for which systems?

How is access to CUI restricted (e.g. role-based access control)?*

Do you maintain data backup and recovery capabilities?*

Yes or no

Additional Notes

Are there any specific challenges or concerns your organization faces regarding CMMC compliance?

Please add any additional comments or concerns below:

Who should we thank for referring you to our team (e.g. current Paragon customer, C3PAO Marketplace)?

Cybersecurity Maturity Model Certification (CMMC) Assessment Scoping Questionnaire

Scope Definition

Current Security Posture

Network and Infrastructure

Cybersecurity Practices

Additional Notes

Cybersecurity Maturity Model Certification (CMMC)
Assessment Scoping Questionnaire