Readiness depends on being able to show how the applicable requirements are implemented across the agreed environment. An incomplete inventory, outdated implementation records or an unverified fix can all leave your team with work still to do.
Use this checklist to organise preparation and identify who needs to resolve each gap. SecureX7 supports the technical work with asset visibility, configuration assessment and AI-assisted remediation guidance.
Use the checklist with your applicable requirements
This checklist is organised around NIST SP 800-171 Revision 3 and its assessment companion, SP 800-171A Revision 3. Confirm the revision and assessment rules required by your agreement or programme before using it.
The steps below organise preparation; they do not reproduce every requirement or replace the applicable assessment procedures. Record each item as ready, action required or not applicable with a documented rationale. Give every open action an owner and review date.
Confirm obligations and ownership
1. Record the required publication, revision and assessment route. Resolve uncertainties about contractual requirements with the responsible party.
2. Assign responsibility for the readiness programme and individual requirements. Identify dependencies on shared services and suppliers.
Agree the boundary and understand the estate
3. Confirm the CUI involved and document how it enters, moves through and leaves the organisation.
4. Approve the system boundary, including relevant protection and administration components. Retain the basis for scope decisions.
5. Reconcile the asset inventory with that boundary. Review newly discovered systems, missing owners and unassessed assets. SX7 discovery and classification can support this investigation.
Check implementation and investigate technical gaps
6. Document how applicable requirements are implemented. Review the system security plan and identify evidence that supports each implementation statement.
7. Assess supported configurations against approved technical requirements. Investigate unnecessary services, account privileges, authentication settings and other relevant weaknesses. Use SX7 checks where supported and define other methods for remaining assessment questions.
8. Review vulnerability and update management evidence. Confirm how issues are identified, prioritised and resolved within the applicable requirements. A list of detected issues needs an accountable treatment process.
Prepare evidence and verify remediation
9. Gather relevant records, interviews and test results using the applicable assessment procedures. Check asset identity, assessment date, criteria and coverage for technical evidence.
10. Plan remediation for identified gaps. Use SX7 AI guidance and Work Plans to support technical planning, then test and approve changes through your established process. Check whether remediation plans are permitted by your assessment programme and under what conditions.
11. Reassess corrected systems and review the evidence before closing an action. Record any remaining limitation or exception through the appropriate decision process.
Maintain readiness after the review
12. Establish how new systems, configuration changes and revised responsibilities trigger reassessment. Schedule reviews of implementation records and outstanding actions so that preparation does not stop at the assessment date.
Follow one checklist item through to completion
Suppose the inventory review identifies a workstation inside the agreed boundary that has not received the intended configuration assessment. Your team confirms ownership, arranges assessment and investigates the resulting finding.
SX7 helps explain the supported technical weakness and plan remediation. After testing and deployment, reassessment checks the outcome. The requirement owner reviews whether the technical result and associated records answer the relevant assessment objectives before treating the item as ready.
Know what the checklist and software establish
Your team must implement the applicable controls, review evidence and resolve gaps. Assessment conclusions and any acceptance of remaining actions follow the rules of your programme.
Turn the checklist into a practical starting point
Bring an open technical item to an SX7 demonstration. See how discovery, configuration assessment and AI-assisted Work Plans could help your team investigate it and verify the improvement.