I am trying to obtain CMMC Level 1 compliance which contains 17 requirements defined in FAR 52.204-21. My question is: what all do I need other than policies and procedures in order to submit the self-assessment? I have policies and procedures aligning with the 17 requirements in the FAR clause, and of course everything written and stated is implemented in my environment. I also have an SSP defining how we adhere to the 17 controls. Do I need anything else to prepare for the self-assessment and/or any future audits? Do I need a POA&M?

Any help is greatly appreciated!