Home / Resources

Prepare for assessment planning.

Use this checklist to organize scope, people and evidence before a C3PAO discovery call.

1. Requirement: Identify the customer clause, required assessment path, applicable revision and deadline.
2. Scope: List the organizations, locations, users, systems and service providers involved.
3. Information flow: Document where sensitive information enters, is used, is stored and leaves.
4. System description: Keep your SSP, diagrams, inventories and responsibilities consistent with the actual environment.
5. Evidence: Map each applicable requirement and objective to records, demonstrations and knowledgeable owners.
6. Open work: Identify gaps honestly. Confirm whether any proposed POA&M treatment is permitted by the applicable assessment process.
7. People and access: Arrange interviews, demonstrations and secure evidence access. Do not upload CUI into public site forms.
8. Engagement: Confirm impartiality, scope, dates and information-handling arrangements before assessment work begins.

This checklist supports planning; it does not determine readiness or certification.

Use your browser’s Print command to save this checklist as a PDF.