# CMMC Level 2 Checklist in Excel > Source: https://netray.co/tools/cmmc-level-2-checklist-excel-worksheet > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer An editable CMMC Level 2 tracking sheet with real NIST SP 800-171 practice IDs, status, evidence, owner and due date, exportable to Excel. ## Category compliance-legal ## Industry Defense ## Audience - IT manager - Quality manager - Compliance owner ## Tool **Kind:** worksheet **Mode:** editable **Columns:** #### Practice **Key:** id **Type:** text **Help:** NIST SP 800-171 Rev 2 requirement number #### Family **Key:** family **Type:** select **Options:** - AC - AT - AU - CM - IA - IR - MA - MP - PS - PE - RA - CA - SC - SI #### What it asks (paraphrased) **Key:** topic **Type:** text #### Status **Key:** status **Type:** select **Options:** - Not started - In progress - Implemented - Inherited from provider - Not applicable #### Evidence / document **Key:** evidence **Type:** text #### Owner **Key:** owner **Type:** text #### Due date **Key:** due **Type:** date **Rows:** #### Limit system access to authorized users, processes and devices **Id:** 3.1.1 **Family:** AC **Status:** Implemented **Evidence:** Access control policy, AD user export **Owner:** IT manager **Due:** 2026-11-15 #### Limit access to the transactions and functions users are permitted to run **Id:** 3.1.2 **Family:** AC **Status:** In progress **Evidence:** Role matrix **Owner:** IT manager **Due:** 2026-12-01 #### Control the flow of CUI per approved authorizations **Id:** 3.1.3 **Family:** AC **Status:** Not started **Owner:** Network lead **Due:** 2026-12-15 #### Apply least privilege including privileged accounts **Id:** 3.1.5 **Family:** AC **Status:** In progress **Evidence:** Admin account review **Owner:** IT manager **Due:** 2026-12-01 #### Monitor and control remote access sessions **Id:** 3.1.12 **Family:** AC **Status:** Not started **Owner:** Network lead **Due:** 2027-01-10 #### Control CUI posted or processed on publicly accessible systems **Id:** 3.1.22 **Family:** AC **Status:** Implemented **Evidence:** Web publishing procedure **Owner:** Marketing lead **Due:** 2026-11-30 #### Make managers and users aware of security risks and policies **Id:** 3.2.1 **Family:** AT **Status:** In progress **Evidence:** Training records **Owner:** HR **Due:** 2026-12-10 #### Train personnel to carry out their security duties **Id:** 3.2.2 **Family:** AT **Status:** Not started **Owner:** HR **Due:** 2027-01-15 #### Create and retain system audit logs to monitor unlawful activity **Id:** 3.3.1 **Family:** AU **Status:** In progress **Evidence:** Log retention settings **Owner:** IT manager **Due:** 2026-12-20 #### Trace user actions to individual users **Id:** 3.3.2 **Family:** AU **Status:** In progress **Evidence:** Unique account policy **Owner:** IT manager **Due:** 2026-12-20 #### Establish and maintain baseline configurations and inventories **Id:** 3.4.1 **Family:** CM **Status:** Not started **Owner:** IT manager **Due:** 2027-01-31 #### Establish and enforce security configuration settings **Id:** 3.4.2 **Family:** CM **Status:** Not started **Owner:** IT manager **Due:** 2027-01-31 #### Identify system users, processes and devices **Id:** 3.5.1 **Family:** IA **Status:** Implemented **Evidence:** Account naming standard **Owner:** IT manager **Due:** 2026-11-15 #### Use multifactor authentication for local, network and privileged access **Id:** 3.5.3 **Family:** IA **Status:** In progress **Evidence:** MFA rollout plan **Owner:** IT manager **Due:** 2026-12-01 #### Establish an incident handling capability **Id:** 3.6.1 **Family:** IR **Status:** Not started **Owner:** Compliance owner **Due:** 2027-01-15 #### Track, document and report incidents **Id:** 3.6.2 **Family:** IR **Status:** Not started **Owner:** Compliance owner **Due:** 2027-01-15 #### Perform maintenance on systems **Id:** 3.7.1 **Family:** MA **Status:** Implemented **Evidence:** Maintenance log **Owner:** IT manager **Due:** 2026-11-30 #### Sanitize or destroy media containing CUI before disposal or reuse **Id:** 3.8.3 **Family:** MP **Status:** In progress **Evidence:** Disposal procedure **Owner:** IT manager **Due:** 2026-12-15 #### Screen individuals before authorizing access to CUI **Id:** 3.9.1 **Family:** PS **Status:** Implemented **Evidence:** Hiring checklist **Owner:** HR **Due:** 2026-11-15 #### Limit physical access to systems and facilities to authorized individuals **Id:** 3.10.1 **Family:** PE **Status:** Implemented **Evidence:** Badge access list **Owner:** Facilities **Due:** 2026-11-15 #### Periodically assess risk to operations, assets and individuals **Id:** 3.11.1 **Family:** RA **Status:** Not started **Owner:** Compliance owner **Due:** 2027-02-15 #### Scan for vulnerabilities periodically and when new ones are identified **Id:** 3.11.2 **Family:** RA **Status:** In progress **Evidence:** Scanner schedule **Owner:** IT manager **Due:** 2026-12-31 #### Periodically assess security controls for effectiveness **Id:** 3.12.1 **Family:** CA **Status:** Not started **Owner:** Compliance owner **Due:** 2027-02-28 #### Develop and implement plans of action to correct deficiencies **Id:** 3.12.2 **Family:** CA **Status:** In progress **Evidence:** POA&M draft **Owner:** Compliance owner **Due:** 2026-12-15 #### Develop, document and update system security plans **Id:** 3.12.4 **Family:** CA **Status:** In progress **Evidence:** SSP draft v0.3 **Owner:** Compliance owner **Due:** 2026-12-15 #### Monitor, control and protect communications at system boundaries **Id:** 3.13.1 **Family:** SC **Status:** Implemented **Evidence:** Firewall rule review **Owner:** Network lead **Due:** 2026-11-30 #### Use cryptography to protect CUI in transit **Id:** 3.13.8 **Family:** SC **Status:** In progress **Evidence:** TLS configuration scan **Owner:** Network lead **Due:** 2026-12-20 #### Employ FIPS-validated cryptography when protecting CUI **Id:** 3.13.11 **Family:** SC **Status:** Not started **Owner:** Network lead **Due:** 2027-01-31 #### Protect the confidentiality of CUI at rest **Id:** 3.13.16 **Family:** SC **Status:** In progress **Evidence:** Disk encryption report **Owner:** IT manager **Due:** 2026-12-31 #### Identify, report and correct system flaws in a timely manner **Id:** 3.14.1 **Family:** SI **Status:** In progress **Evidence:** Patch policy **Owner:** IT manager **Due:** 2026-12-15 #### Provide protection from malicious code at appropriate locations **Id:** 3.14.2 **Family:** SI **Status:** Implemented **Evidence:** EDR deployment report **Owner:** IT manager **Due:** 2026-11-15 **Totals:** #### Practices tracked **Key:** id **Agg:** count **Format:** integer **Notes:** Starter list of 32 representative practices out of the 110 in NIST SP 800-171 Rev 2 (14 families). Add the remaining rows for your full scope. Practice wording is paraphrased. Use the official NIST text and the CMMC assessment guide for the exact objectives. ## Content **Intro:** CMMC Level 2 maps to the 110 security requirements in NIST SP 800-171 Rev 2. This worksheet gives you an editable tracking sheet with real practice IDs, status, evidence, owner and due date, ready to export to Excel for your assessor prep. **Sections:** #### How to use the worksheet **Body:** Start with the rows provided, set the status of each practice honestly, and name the evidence document that proves it. Add the rest of the 110 practices as new rows so every one has an owner and a date. Filter by status in Excel to produce your plan of action and milestones. Update it weekly while you remediate, and keep the evidence files in a controlled folder named after the practice ID. #### What an assessor looks for **Body:** An assessor evaluates each practice against its assessment objectives using three kinds of evidence: documents, interviews and observation or testing. A status of Implemented should therefore point to a policy or procedure, to a person who can explain it, and to a system setting that can be shown live. Practices covered by an external service provider should be marked Inherited, with a shared responsibility matrix backing it up. **Bullets:** - Documents: policies, procedures, system security plan - Interviews: the people who run the process daily - Examination: configurations, logs and screenshots - Scope: every asset that stores, processes or transmits CUI #### Common mistakes **Body:** Teams often mark a practice done because a tool is installed, without a written procedure or evidence. Another is an undefined scope: if you cannot list the assets that handle CUI, you cannot assess them. Also remember that the system security plan is itself a requirement, and that unresolved practices need a POA&M entry. Check the current CMMC program rule for which practices may stay open at assessment time. **Cta:** For on-prem evidence collection, Netray can build a private AI layer that answers where a practice's evidence lives across your file shares and systems without sending data to a public cloud. **Faq:** #### How many practices are in CMMC Level 2? **Answer:** CMMC Level 2 aligns to the 110 requirements of NIST SP 800-171 Rev 2, grouped in 14 families such as Access Control, Audit and Accountability, and System and Communications Protection. #### Is this a complete CMMC Level 2 audit checklist? **Answer:** It is a starter sheet with 32 representative practices and the column structure you need. Add the remaining practices for full coverage. It does not replace the official assessment guide or an assessor's judgement. #### Should I track status per practice or per objective? **Answer:** Assessors score against objectives inside each practice. Tracking at practice level is fine to start, but add notes on any objective you cannot yet show evidence for, since one missing objective means the practice is not met. #### Can I use this as a self assessment? **Answer:** Yes for internal readiness tracking. For a formal self assessment, follow the official scoring method and record the results as your contract requires. Use the SPRS score calculator on this site for the weighted score. ## Search terms cmmc level 2 checklist excel, cmmc level 2 audit checklist, cmmc level 2 compliance checklist pdf, cmmc level 2 documentation templates, cmmc level 2 scoring template, cmmc level 2 self assessment tool, cmmc level 2 assessment guide, nist 800-171 checklist excel --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json