CMMC Journey
CMMC certification is a long road, and it's easy to lose the plot — to polish one control while a foundational step goes undone. The CMMC Journey (shown in-app as "Your Compliance Path") turns that road into an ordered set of phases, each with a clear goal and a concrete checklist, and always surfaces the single most valuable next step to take right now.
Key concepts
Phases
Your path is divided into seven phases, worked roughly in order. Each phase has a goal, an estimated effort, and a checklist of tasks — some required, some recommended.
| # | Phase | The goal |
|---|---|---|
| 1 | Foundation & Scoping | Get your scope right before anything else |
| 2 | Control Implementation | Build the technical controls |
| 3 | Documentation & Traceability | Make everything provable |
| 4 | Internal Validation | Find gaps before the assessor does |
| 5 | Pre-Assessment Readiness | Ready to call your C3PAO |
| 6 | During Assessment | Execute cleanly |
| 7 | Post-Assessment & Certification | Close gaps and get certified |
Phase status
At any time each phase is in one of three states:
| Status | Meaning |
|---|---|
| Complete | The phase is done (or you've advanced past it) |
| Current | The phase you're working now |
| Locked | A later phase, not yet started |
Next Best Action
The journey always highlights one recommended next step — the action with the most impact on your readiness right now. It's chosen from a priority order: urgent items first (expired evidence, overdue remediation), then the guidance specific to your current phase, then upkeep like renewing soon-to-expire evidence.
Level 1 vs Level 2
If your organization is pursuing Level 1 (protecting FCI, 17 practices) rather than Level 2 (protecting CUI), the early phases are re-labeled to match that lighter scope. The overall journey shape is the same.
Using the journey
Follow your path
Open your compliance path
The journey view shows your current phase, your SPRS score, an estimate of how long to ready, and your Next Best Action front and center.
Work the current phase
Each phase lists its tasks with a done/not-done state and a short assessor insight explaining why the phase matters. Complete the required tasks to move the phase toward done.
Take the next best action
Follow the highlighted recommendation — it deep-links to exactly the screen you need (a system, an objective, an evidence item, or a remediation task).
Advance
As you complete a phase's key tasks, it turns Complete and the next phase becomes Current. Your path updates automatically.
Check readiness before an assessment
Phase 5 (Pre-Assessment Readiness) includes a set of readiness checks — concrete gates such as "no open gaps," "SSP sections complete," and "no overdue remediation." Each check passes, warns, or blocks. Clear the blockers and you're ready to engage your C3PAO.
Permissions
The journey is a read-only overview available to every role. Advancing phases and completing tasks follows the permissions of the underlying work (implementing controls, uploading evidence, and so on) — see each feature's own page.
How it works
How your current phase is determined
Your organization has one current phase. A phase counts as complete when you've either explicitly finished it or advanced past it; completing a phase stamps the date so your history is preserved. Each phase has a completion threshold — the share of its key tasks that must be done before it's considered ready to advance — so you can't skip ahead with foundational work unfinished.
How progress is measured
For each phase, DIBFI compares the tasks you've completed against that phase's checklist to produce a completion percentage and a required-tasks-remaining count. The journey combines that with live signals from the rest of the platform — your SPRS score, open gaps, overdue and upcoming remediation, and evidence that's expired or expiring — to place you on the path and choose your Next Best Action.
Where the journey draws from
The journey is a lens over the work you do everywhere else in DIBFI. Scoping pulls from your systems and asset inventory; implementation and documentation from your assessment objectives, evidence, and policies; readiness from your SSP completeness, gaps, and remediation. You don't maintain the journey separately — it reflects your real state as you work.
Related features
Assessments
Track how your organization meets each CMMC practice and objective — set an implementation status and narrative for every objective, watch them roll up into practices, your SPRS score, and your open gaps.
Self-Assessment
Work through your CMMC objectives one at a time, record a determination and narrative for each, and watch your SPRS score update live as you go.