CMMC 2.0 · Level 2 readiness checklist

Twelve questions to ask before a CMMC Level 2 assessment.

The areas assessors open first, each with the NIST SP 800-171 requirement behind it and the evidence they will ask to see. Count the ones you can answer with a document today; the rest is your gap list.

Take the 3-minute Cyber Hygiene Test

Mapped to NIST SP 800-171 Rev 2The evidence for each itemA readiness partner, not a C3PAO

AccuSights is not a C3PAO, is not affiliated with the Cyber AB or the Department of Defense, and does not certify or guarantee certification. We prepare you for your CMMC assessment; we do not conduct it. Third-party assessments are subject to DoD and Cyber AB rules as published, which may change.

The checklist

Can you show the evidence for each of these today?

1. You know where the CUI isEvery system, folder, mailbox, laptop and supplier that receives or stores Controlled Unclassified Information, with a data-flow diagram. Evidence: the diagram and the list behind it.
2. Your assets are sortedCUI assets, security protection assets, contractor risk managed assets and specialized assets, each listed and labelled. Evidence: an asset inventory that matches the diagram.
3. A System Security Plan exists (CA.L2-3.12.4)How each of the 110 requirements is met in your environment. It cannot sit on a POA&M. Evidence: the SSP, current and signed.
4. Multi-factor authentication everywhere it is required (IA.L2-3.5.3)For privileged accounts, and for network access to any account that reaches CUI. Evidence: the MFA policy and the sign-in configuration.
5. Access by role, least privilege (AC.L2-3.1.1, 3.1.5)Accounts limited to people and devices that need them, and admin rights kept separate. Evidence: an access review dated in the last year.
6. Logs that answer who did what (AU.L2-3.3.1)Audit logs captured on in-scope systems, retained and reviewed. Evidence: the retention setting and a record of the reviews.
7. FIPS-validated encryption for CUI (SC.L2-3.13.11)At rest and in transit, with modules that carry FIPS validation, not just encryption turned on. Evidence: the module certificates for each tool.
8. Baselines and patching (CM.L2-3.4.1, SI.L2-3.14.1)A documented configuration for each kind of system and flaws fixed on a schedule. Evidence: the baseline and the patch reports.
9. An incident plan with the 72-hour report (IR.L2-3.6.1)Who decides, who reports to DoD through DIBNet within 72 hours under DFARS 252.204-7012, and a test on record. Evidence: the plan and the last exercise.
10. Training that includes insider threat (AT.L2-3.2.1, 3.2.3)Security awareness for everyone, and recognizing and reporting insider threat. Evidence: the training records.
11. Physical and media protection (PE.L2-3.10.1, MP.L2-3.8.3)Locked access to where CUI is, escorted visitors, and media sanitized before reuse or disposal. Evidence: access logs and sanitization records.
12. A score you can defend, and suppliers that matchA current SPRS score with the worksheet behind it, a POA&M with eligible items only, and the requirements flowed down to subcontractors and to any cloud provider that holds CUI. Evidence: the SPRS entry, the POA&M and the contract clauses.

Check all 110 with a gap assessment

Which packages prepare you for it

When the list turns up gaps.

CMMC Level 2 Gap Readiness Package

Defense manufacturers, engineering and design firms, and IT and service suppliers of 10 to 300 people handling CUI

From $6,000published

Details →

CMMC Self-Assessment and SPRS Score Calculation

Suppliers who need a current, defensible SPRS score now and a clear path toward Level 2 later

Fixed feescoped in 30 minutes

Details →

Mock Audit Package: SOC 2, HIPAA or CMMC

Organizations within 90 days of a SOC 2 audit, an OCR inquiry or a C3PAO assessment, and any leadership team that wants to know before it counts

Fixed feescoped in 30 minutes

Details →

Questions we get about the checklist

Is this the official CMMC checklist?

No. The official requirements are the 110 in NIST SP 800-171 Rev 2 and the assessment objectives in the CMMC Level 2 Assessment Guide. These twelve are the areas assessors open first and where most small suppliers have gaps.

If we can tick all twelve, are we ready?

You are in good shape to start, not finished. The gap assessment checks all 110 requirements at the objective level and turns the result into an SPRS score you can defend.

Which ones block conditional status?

Any 3- or 5-point requirement left open, and six requirements the rule keeps off any POA&M, the System Security Plan among them. Items 3, 4 and 7 on this list are the ones we see open most often.

What is an SPRS score?

Your NIST SP 800-171 self-assessment score posted in the Supplier Performance Risk System, as DFARS 252.204-7019 and 7020 require. The DoD method runs from 110 down to negative 203. Primes and the Department use it to judge risk, and the Justice Department has treated inflated scores as possible False Claims Act fraud.Source: DefenseScoop, 18 June 2026

Does the Phase 2 pause change the checklist?

No. The checklist maps to NIST SP 800-171 Revision 2, which DFARS 252.204-7012 requires whatever the CMMC rollout schedule. The pause only took the C3PAO certification requirement out of contracts for now; the controls, the score and the 72-hour report stay.

What do we do with the gaps we find?

Rank them by points and by effort. The quick wins usually move the SPRS score more than the large projects; the gap assessment writes that order for you.

CMMC pages: CMMC 2.0 overview · Certification path · What drives the cost · The 12-item checklist

Next step

Thirty minutes, an engineer, your twelve answers checked.

Book the call, bring your answers, and leave with which ones would hold up in an assessment and what to fix first. Or leave your details and an engineer replies within one business day.

Take the 3-minute Cyber Hygiene Test

The regulator has the final say. We help interpret, scope and get you ready; we do not certify.

3-min test