A preview of what's inside
- Is your CUI boundary defined and documented? Everything else — budget, architecture, timeline — depends on this answer. Wrong boundary, wrong everything.
- Does DFARS 252.204-7012 actually appear in your contracts? Verify the clause before you spend. Obligation drives scope.
- Is your SPRS score real? A submitted score is a federal representation. If it wouldn't survive an objective-level review, it's exposure, not compliance.
- Is CUI encrypted with FIPS-validated cryptography? "Encrypted" and "FIPS-validated" are different answers, and assessors know the difference (§3.13.11).
- Can you produce evidence, not just policy? Configurations, logs, screenshots — organized by assessment objective. Binders don't pass assessments.
The full checklist covers every control family with the fix-late cost ranking. The form below just tells us where to send it.
Free Download
Get the full checklist.
Enter your email and the checklist is on its way. No drip campaign — one email with the document. Or email rj@indirectit.com directly.