An assessor asks for these before testing a single control. If one is missing or more than a year old, start there. Requirement numbers are from NIST SP 800-171 Rev 2.
System Security Plan
How your company meets each of the 110 requirements, and where your CUI boundary is. The assessor reads it first and tests against it. 3.12.4
Plan of Action and Milestones
Every requirement you don't meet yet, the fix and the date. It has to match the score you posted in SPRS. 3.12.2
Policies and Procedures
A written policy and procedure for each of the 14 requirement families, approved and dated, that your people actually follow.
Network and CUI Boundary Diagram
Where CUI enters, where it's stored and where it leaves. It sets which systems and people are in scope for the assessment.
Asset Inventory
Every system, device and cloud service that stores, processes or sends CUI, with its owner and configuration. 3.4.1
Access List
Who can reach CUI, what they can do with it and why their job needs it. 3.1.1, 3.1.2
Incident Response Plan and Last Test
Who does what when something goes wrong, plus the record of the last time you tested the plan. 3.6.1, 3.6.3
Security Training Records
Proof that everyone in scope completed security awareness training, with dates. 3.2.1, 3.2.2
Vulnerability Scans and Fixes
Recent scan results and the record of what you fixed and when. 3.11.2, 3.11.3
SPRS Submission and Signed Affirmation
Your posted score and the affirmation a senior official signs. The assessor checks the score against your plan. DFARS 252.204-7019, 32 CFR 170.16