# CMMC 2.0 Level 2 Readiness Assessment > Source: https://netray.co/tools/cmmc-2-readiness-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Answer 10 questions mapped to NIST SP 800-171 control families and get an instant CMMC Level 2 readiness score with prioritized next steps. ## Category aerospace-defense ## Tool **Kind:** assessment **Questions:** #### Have you formally scoped where Controlled Unclassified Information (CUI) lives in your environment (systems, ERP, file shares, email, shop floor)? **Help:** CMMC assessments are scoped to the CUI boundary. An undefined boundary is the single most common reason assessments stall. **Options:** ##### No - we have not identified where CUI resides **Score:** 0 ##### Partial informal inventory, not documented **Score:** 1 ##### Documented CUI data flow for most systems **Score:** 2 ##### Full documented CUI boundary with network diagrams and asset inventory **Score:** 3 #### Do you have a current System Security Plan (SSP) covering all 110 NIST SP 800-171 controls? **Options:** ##### No SSP exists **Score:** 0 ##### Outdated or template SSP not reflecting reality **Score:** 1 ##### Current SSP covering most controls **Score:** 2 ##### Current, reviewed SSP covering all 110 controls with evidence references **Score:** 3 #### Have you completed a NIST 800-171 self-assessment and submitted your score to SPRS? **Help:** A current SPRS score is already a contractual requirement under DFARS 252.204-7019/7020 for most DoD work. **Options:** ##### Never performed a self-assessment **Score:** 0 ##### Assessed informally, no SPRS submission **Score:** 1 ##### SPRS score submitted but over 12 months old **Score:** 2 ##### Current SPRS score submitted with a maintained POA&M **Score:** 3 #### Is multi-factor authentication (MFA) enforced for all users accessing systems that store or process CUI? **Options:** ##### No MFA in use **Score:** 0 ##### MFA for remote access only **Score:** 1 ##### MFA for most users, gaps on legacy or shop-floor systems **Score:** 2 ##### MFA enforced everywhere CUI is accessed, including privileged accounts **Score:** 3 #### Is CUI encrypted with FIPS-validated cryptography at rest and in transit? **Help:** CMMC Level 2 requires FIPS 140-2/140-3 validated modules, not just "encryption enabled." Many ERP and file-transfer setups fail here. **Options:** ##### No encryption standard applied **Score:** 0 ##### Encryption in transit only, validation status unknown **Score:** 1 ##### Encrypted at rest and in transit, but not all modules FIPS-validated **Score:** 2 ##### FIPS-validated encryption verified for all CUI storage and transmission **Score:** 3 #### How mature is your access control program (least privilege, role-based access, periodic access reviews)? **Options:** ##### Shared accounts and broad admin rights are common **Score:** 0 ##### Basic role separation, no periodic reviews **Score:** 1 ##### Role-based access with annual reviews **Score:** 2 ##### Least privilege enforced with quarterly access reviews and documented approvals **Score:** 3 #### Do you have a tested incident response plan that meets the DFARS 72-hour DoD reporting requirement? **Options:** ##### No incident response plan **Score:** 0 ##### Plan exists but never tested; team unaware of 72-hour rule **Score:** 1 ##### Plan tested annually, DoD reporting steps documented **Score:** 2 ##### Plan tested via tabletop exercises, DIBNet reporting rehearsed, evidence retained **Score:** 3 #### Are security events centrally logged and reviewed (SIEM or equivalent) across systems in the CUI boundary? **Options:** ##### No centralized logging **Score:** 0 ##### Logs collected but rarely reviewed **Score:** 1 ##### Central logging with periodic manual review **Score:** 2 ##### SIEM with alerting, defined retention, and documented review cadence **Score:** 3 #### Do all employees who handle CUI receive documented, role-based security awareness training? **Options:** ##### No security training program **Score:** 0 ##### One-time training at onboarding only **Score:** 1 ##### Annual general security training **Score:** 2 ##### Annual role-based training with CUI handling modules and completion records **Score:** 3 #### How prepared are you for a third-party C3PAO assessment (evidence collection, control owners, mock assessment)? **Help:** C3PAO assessors expect artifacts for every practice - policies, screenshots, configs, and interviews with named control owners. **Options:** ##### Have not started preparing **Score:** 0 ##### Aware of requirements, no evidence library **Score:** 1 ##### Evidence collected for most controls, owners assigned **Score:** 2 ##### Complete evidence library and a passed mock assessment or gap audit **Score:** 3 **Bands:** #### High Risk - Foundational Gaps **Min:** 0 **Max:** 34 **Verdict:** Your environment has fundamental gaps against CMMC Level 2 and likely against existing DFARS 7012 obligations you already carry. Contracts requiring certification will be out of reach without a structured 12-18 month remediation program. **Recommendations:** - Scope your CUI boundary first - consider an enclave to shrink the assessment footprint by 60-80% - Perform a NIST 800-171 self-assessment and submit a truthful SPRS score to avoid False Claims Act exposure - Deploy MFA and FIPS-validated encryption for CUI systems as the highest-impact quick wins - Draft an SSP and POA&M so remediation is tracked against the 110 controls - Budget realistically: mid-market manufacturers typically spend $150K-$500K reaching Level 2 #### Developing - Remediation in Progress **Min:** 35 **Max:** 64 **Verdict:** You have real foundations but material gaps remain that a C3PAO would score as failures. Most organizations at this stage need 6-12 focused months to close technical controls and build the evidence library assessors require. **Recommendations:** - Close the gap between documented policy and actual practice - assessors test both - Prioritize FIPS validation, logging coverage, and access review cadence, the three most-failed practice areas - Assign a named owner to every one of the 110 controls with quarterly evidence refreshes - Run a tabletop incident response exercise including a DIBNet reporting walkthrough - Schedule a mock assessment 4-6 months before your target C3PAO date #### Near Ready - Harden and Verify **Min:** 65 **Max:** 84 **Verdict:** You are within reach of certification. The remaining risk is evidence quality and edge cases - legacy shop-floor systems, subcontractor flowdown, and controls that work but are poorly documented. **Recommendations:** - Commission an independent gap assessment to find blind spots before the C3PAO does - Audit legacy and OT/shop-floor systems in scope - these fail disproportionately - Verify every cloud service holding CUI is FedRAMP Moderate or equivalent - Freeze your environment configuration 60 days before assessment and document change control - Book your C3PAO early - assessor capacity is constrained and lead times run 3-6 months #### Assessment Ready **Min:** 85 **Max:** 100 **Verdict:** Your program is mature and you should perform well in a formal assessment. Focus now shifts to maintaining continuous compliance and using your posture as a competitive differentiator in DoD captures. **Recommendations:** - Schedule the C3PAO assessment and run one final internal mock against the CMMC Assessment Guide - Implement continuous control monitoring so drift is caught between annual affirmations - Extend flowdown verification to subcontractors handling your CUI - Feature your certification status in proposals - primes actively screen for it - Evaluate secure on-prem AI so productivity tooling does not reopen your boundary ## Content **Intro:** This free CMMC 2.0 Level 2 readiness assessment helps defense contractors and DoD supply chain manufacturers measure how prepared they are for third-party certification. Answer 10 questions mapped to the highest-weight NIST SP 800-171 control families - scoping, access control, encryption, incident response, and assessment preparation - and receive an instant readiness score, a maturity band, and prioritized recommendations. CMMC Level 2 certification is now appearing in DoD solicitations, and primes are already screening subcontractors on SPRS scores, so knowing your position today directly affects which contracts you can bid tomorrow. **Sections:** #### How the scoring works **Body:** Each question maps to one or more NIST SP 800-171 control families and is scored 0-3, from no capability to fully implemented with evidence. Your total is converted to a percentage and matched to one of four maturity bands calibrated against what C3PAO assessors actually fail organizations on. The questions are deliberately weighted toward the areas where DIB manufacturers most often lose points in formal assessments: CUI scoping, FIPS-validated cryptography, centralized logging, and evidence quality. A high score on paper controls with weak evidence still fails a real assessment, which is why several questions ask specifically about documentation, testing, and named control owners rather than just whether a tool is deployed. #### Benchmarks from the defense industrial base **Body:** Industry data on DIB readiness is sobering and useful for calibrating your result. Use these reference points when interpreting your band: **Bullets:** - The average initial NIST 800-171 self-assessment score across the DIB is negative (roughly -20 on the -203 to 110 scale) before remediation - Mid-market manufacturers typically spend $150K-$500K and 12-18 months reaching Level 2 readiness from a standing start - The three most-failed practice areas in assessments are FIPS-validated encryption, audit logging coverage, and access control reviews - Enclave strategies that isolate CUI can reduce assessed scope, and therefore cost, by 60-80% for many manufacturers #### Interpreting your result and sequencing remediation **Body:** Treat your band as a sequencing tool, not a grade. Below 35%, resist the urge to buy tools first - scope your CUI boundary, because every dollar spent before scoping is potentially wasted on systems that could be excluded. In the 35-64% band, the priority is closing the policy-versus-practice gap and building an evidence library, since assessors interview control owners and test artifacts. Above 65%, shift to independent verification: mock assessments, legacy system audits, and cloud service FedRAMP equivalency checks. At every level, keep your SPRS score current and truthful - the Department of Justice has pursued False Claims Act cases against contractors who overstated compliance. #### How Netray helps you get certified **Body:** Netray works with aerospace and defense manufacturers at the intersection of ERP and compliance, which is where most CMMC programs get stuck - CUI does not just live in file shares, it lives in Infor SyteLine, LN, and Baan records, drawings attached to jobs, and shop-floor travelers. We help you scope your CUI boundary around your ERP reality, design enclave architectures that shrink assessment cost, implement the technical controls that most often fail (FIPS encryption, logging, MFA on legacy systems), and build the evidence library a C3PAO expects. Because we also deploy on-prem AI, we can modernize your operations without pushing CUI into non-compliant cloud tools. **Cta:** Take the assessment now and get your CMMC Level 2 readiness band with a prioritized remediation plan in under five minutes. **Faq:** #### Is CMMC Level 2 certification actually required yet? **Answer:** Yes - the CMMC final rule took effect and Level 2 requirements are being phased into DoD solicitations, with broad coverage expected across new contracts over the next three years. Practically, primes are moving faster than the mandate: many already require current SPRS scores and certification roadmaps from subcontractors during supplier onboarding, so waiting for a contract clause to force the issue means losing bids in the meantime. #### How long does it take to get ready for a C3PAO assessment? **Answer:** From a low-maturity starting point, most mid-market manufacturers need 12-18 months to remediate the 110 NIST 800-171 controls, build evidence, and pass a mock assessment. Organizations that already meet DFARS 7012 in practice can compress this to 6-9 months. Add C3PAO scheduling lead time of 3-6 months, because assessor capacity is limited relative to the number of contractors needing certification. #### Can I reduce the cost of CMMC compliance with an enclave? **Answer:** Often, yes. An enclave isolates CUI into a tightly controlled segment - a secure VDI environment, a segmented network, or a dedicated cloud tenant - so only that segment is assessed. Manufacturers who scope well commonly cut assessed asset counts by 60-80%. The trade-off is workflow friction: if engineers and planners constantly move CUI in and out of the enclave, you create both usability pain and compliance risk, so design it around real workflows including your ERP. ## Search terms cmmc 2.0 readiness assessment, cmmc level 2 self assessment, nist 800-171 gap assessment, cmmc certification checklist, cmmc compliance for manufacturers, c3pao assessment preparation, sprs score improvement --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json