# CMMC Level 2 Excel Spreadsheet Template with Level 1 Checklist and Scoring > Source: https://netray.co/tools/cmmc-level-1-checklist-and-level-2-control-tracker-excel > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A CMMC Level 2 control tracker by family with evidence examples, plus the 17 Level 1 practices and how scoring works. ## Category compliance-legal ## Industry Defense Manufacturing ## Region United States ## Audience - Machine shop owner - Compliance manager - IT manager ## Tool **Kind:** worksheet **Mode:** editable **Columns:** #### Control family **Key:** family **Type:** text #### ID prefix **Key:** prefix **Type:** text #### Practices **Key:** practices **Type:** number #### Practices met **Key:** met **Type:** number **Help:** Only count practices with evidence in hand #### Percent met **Key:** pct **Type:** number **Expr:** met / practices * 100 **Format:** percent #### Typical evidence **Key:** evidence **Type:** text #### Owner **Key:** owner **Type:** text #### Status **Key:** status **Type:** select **Options:** - Not started - In progress - Evidence ready - Verified **Rows:** **Family:** Access Control **Prefix:** AC **Practices:** 22 **Met:** 14 **Evidence:** Account list, role matrix, screenshots of lockout and session timeout settings, remote access policy **Owner:** IT **Status:** In progress **Family:** Awareness and Training **Prefix:** AT **Practices:** 3 **Met:** 3 **Evidence:** Training roster, insider threat module, completion records **Owner:** HR **Status:** Verified **Family:** Audit and Accountability **Prefix:** AU **Practices:** 9 **Met:** 5 **Evidence:** Log configuration exports, log review tickets, time sync settings **Owner:** IT **Status:** In progress **Family:** Configuration Management **Prefix:** CM **Practices:** 9 **Met:** 6 **Evidence:** Baseline configs, change tickets, software allow list **Owner:** IT **Status:** In progress **Family:** Identification and Authentication **Prefix:** IA **Practices:** 11 **Met:** 8 **Evidence:** MFA enrollment report, password policy export, unique user IDs **Owner:** IT **Status:** In progress **Family:** Incident Response **Prefix:** IR **Practices:** 3 **Met:** 1 **Evidence:** Incident response plan, tabletop test record, reporting contacts **Owner:** Security lead **Status:** Not started **Family:** Maintenance **Prefix:** MA **Practices:** 6 **Met:** 4 **Evidence:** Maintenance log, vendor remote session approvals, media check records **Owner:** Facilities **Status:** In progress **Family:** Media Protection **Prefix:** MP **Practices:** 9 **Met:** 5 **Evidence:** Media sanitization log, CUI marking procedure, USB control setting **Owner:** IT **Status:** In progress **Family:** Personnel Security **Prefix:** PS **Practices:** 2 **Met:** 2 **Evidence:** Screening records, termination checklist showing access removal **Owner:** HR **Status:** Verified **Family:** Physical Protection **Prefix:** PE **Practices:** 6 **Met:** 5 **Evidence:** Badge access report, visitor log, photos of locked CUI areas **Owner:** Facilities **Status:** Evidence ready **Family:** Risk Assessment **Prefix:** RA **Practices:** 3 **Met:** 1 **Evidence:** Risk assessment report, vulnerability scan results, remediation tickets **Owner:** Security lead **Status:** Not started **Family:** Security Assessment **Prefix:** CA **Practices:** 4 **Met:** 2 **Evidence:** System security plan, POA&M, periodic assessment record **Owner:** Compliance **Status:** In progress **Family:** System and Communications Protection **Prefix:** SC **Practices:** 16 **Met:** 9 **Evidence:** Firewall rule export, network diagram, FIPS validated encryption proof, CUI enclave boundary **Owner:** IT **Status:** In progress **Family:** System and Information Integrity **Prefix:** SI **Practices:** 7 **Met:** 5 **Evidence:** Patch reports, antivirus console, alert review records **Owner:** IT **Status:** In progress **Totals:** #### Total practices **Key:** practices **Agg:** sum **Format:** integer #### Total met **Key:** met **Agg:** sum **Format:** integer **Summary:** #### Overall practices met **Key:** overall **Expr:** sum_met / sum_practices * 100 **Format:** percent **Primary:** true #### Open practices **Key:** open **Expr:** sum_practices - sum_met **Format:** integer **Notes:** The 14 families and 110 practices come from NIST SP 800-171 Revision 2 as used by CMMC Level 2. Counts per family are the standard counts. Verify the current assessment guide before an assessment, since scope and guidance documents are updated. ## Content **Intro:** This CMMC Level 2 spreadsheet tracks all 110 practices by control family, shows percent complete and lists the evidence an assessor typically asks for. Below it you will find the Level 1 checklist, how Level 1 and Level 2 scoring work, and what to put in your network and data flow diagrams. **Sections:** #### Using the Level 2 control tracker **Body:** Set the practices met column only when you hold evidence, not when the control is merely planned. Assign an owner per family, and move the status to Verified after someone other than the owner checks the evidence. The percent column and overall total update as you edit. Export to Excel to keep a dated copy for your system security plan and POA&M. Practice level detail (for example AC.L2-3.1.1) can be added as rows if you prefer one row per practice. #### CMMC Level 1 checklist and scoring **Body:** Level 1 covers 17 practices that map to the 15 basic safeguarding requirements of FAR 52.204-21, protecting Federal Contract Information. It is assessed by an annual self-assessment with an affirmation by a senior official. There is no numeric score: each practice is met or not met, and all must be met. Level 2 differs. A self or C3PAO assessment is scored against 110 with weighted deductions of 1, 3 or 5 points per unmet practice, and conditional status generally needs a score of at least 80 percent with open items closed within 180 days. **Bullets:** - Access control: limit access to authorized users and devices, limit to permitted transactions, control external connections, control public information - Identification and authentication: identify and authenticate users and devices - Media and physical: sanitize media, limit physical access, escort and log visitors, control keys and devices - System protection: boundary protection, separate public components, flaw remediation, malicious code protection, updates and scans #### Network and data flow diagram examples for a machine shop **Body:** Assessors want to see where CUI is stored, processed and transmitted. A good network diagram for a small shop shows the internet edge and firewall, a separate VLAN for the CUI enclave holding the file server and CAM workstations, a segregated shop floor VLAN for CNC controllers, wireless networks marked as in or out of scope, and any cloud service such as a government community cloud mail tenant. The data flow diagram traces a drawing from customer portal download to file share, CAM programming, DNC transfer to the machine and archival or deletion. Label every arrow with protocol and encryption. #### Evidence and common mistakes **Body:** Good evidence is dated, attributable and shows the setting itself: a configuration export, a console screenshot with the date visible, a signed record. Common mistakes are listing the policy as the only evidence, leaving CNC machines out of the asset inventory, forgetting external service providers in the shared responsibility matrix, and counting a practice as met when it is only done on some of the systems in scope. **Cta:** If CUI lives in an on-prem ERP or file share, Netray can add a private AI layer inside your boundary so engineers get answers without CUI leaving your enclave. **Faq:** #### How many practices are in CMMC Level 1 and Level 2? **Answer:** Level 1 has 17 practices and Level 2 has 110 practices drawn from NIST SP 800-171 Revision 2. Level 2 practices are grouped into 14 families such as Access Control, Audit and Accountability and System and Communications Protection. #### Is there a score for CMMC Level 1? **Answer:** No numeric score is used. Each of the 17 practices is either met or not met, and you must meet all of them to affirm compliance. The SPRS style 110 point score applies to Level 2. #### How do I score Level 2? **Answer:** Start at 110 and subtract the point value of each unmet practice, which is 1, 3 or 5 depending on the practice. A fully compliant company scores 110. Some practices allow partial credit, so check the DoD scoring methodology for exceptions. #### What should a CMMC network diagram include? **Answer:** Show the scope boundary, firewalls, VLANs, systems that store or process CUI, out of scope networks, remote access paths, wireless, and external cloud services. Include IP ranges or segment names and the data flows between them. ## Search terms cmmc level 2 excel spreadsheet template, cmmc level one checklist, cmmc level 1 scoring table, cmmc level 2 control evidence examples, cmmc level 2 network diagram example, cmmc level 2 data flow diagram example, nist 800-171 spreadsheet, cmmc tracker for machine shop --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json