# CMMC Level 2 Compliance Checklist > Source: https://netray.co/tools/cmmc-level-2-compliance-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A CMMC Level 2 requirements checklist grouped by the 14 NIST SP 800-171 domains, with the critical items flagged. Export it to PDF. ## Category aerospace-defense ## Industry Defense ## Audience - Defense suppliers - IT and compliance leads - Machine shop owners ## Tool **Kind:** checklist **Scoring Note:** This checklist condenses the intent of the 110 NIST SP 800-171 Rev 2 requirements into about 40 working items, three or so per domain. Ticking every item here does not equal a passed assessment: a C3PAO scores each of the 110 requirements against NIST SP 800-171A objectives. Use it to find the weak domains first, then work the full requirement list in your tracker. **Groups:** #### Access Control (AC) and Identification and Authentication (IA) **Items:** **Text:** Accounts are individually assigned to named users, with shared and generic accounts removed or tightly justified **Critical:** true Least privilege is enforced and privileged accounts are separate from daily-use accounts **Text:** Remote access to systems holding CUI is encrypted and routed through managed, monitored entry points **Critical:** true CUI flow is controlled: who can move it, where it can go, and how it is marked **Text:** Multifactor authentication is on for privileged, network and remote access **Critical:** true Passwords meet a documented complexity and reuse policy, and default vendor credentials are changed Wireless access is authenticated and encrypted, and mobile device connections are controlled #### Awareness and Training (AT) and Personnel Security (PS) **Items:** Every user with access to CUI systems gets security awareness training, with records kept Insider-threat indicators are covered in training Individuals are screened before CUI access is granted **Text:** Access is revoked and assets returned the same day someone leaves or transfers **Critical:** true #### Audit and Accountability (AU) and Incident Response (IR) **Items:** **Text:** Audit logs capture who did what, when, on systems that process CUI **Critical:** true Logs are protected from alteration and reviewed on a defined schedule System clocks are synchronized so logs can be correlated **Text:** A written incident response plan exists with roles, contacts and a reporting path **Critical:** true The plan has been tested at least once with a tabletop or real event, and the result is recorded You can meet the DFARS 252.204-7012 rule to report cyber incidents to DoD within 72 hours of discovery #### Configuration Management (CM), Maintenance (MA) and Media Protection (MP) **Items:** Baseline configurations are documented for servers, workstations, CNC controllers and network gear Changes are reviewed and recorded before deployment Only needed ports, services and software are enabled; allow-listing is applied where practical Maintenance tools and remote maintenance sessions are controlled and logged Equipment removed for service is sanitized of CUI first **Text:** Media holding CUI is marked, access-limited and sanitized or destroyed at end of life **Critical:** true Removable media and USB use is restricted and encrypted where CUI is stored #### Physical Protection (PE) and Risk Assessment (RA) **Items:** **Text:** Physical access to areas with CUI systems is limited, with visitors logged and escorted **Critical:** true Physical access devices such as badges and keys are managed and audited A risk assessment covering CUI systems is documented and refreshed on a set interval **Text:** Vulnerability scans run on a schedule and findings are remediated by severity **Critical:** true #### Security Assessment (CA), System and Communications Protection (SC), System and Information Integrity (SI) **Items:** **Text:** A System Security Plan describes the boundary, environment and how each requirement is met **Critical:** true **Text:** A Plan of Action and Milestones tracks every unmet requirement with owner and date **Critical:** true Controls are assessed periodically and results feed the SSP and POA&M **Text:** Network boundary protection and segmentation separate CUI systems from general and shop-floor networks **Critical:** true **Text:** CUI is encrypted in transit and at rest with FIPS-validated cryptography **Critical:** true Public-facing systems are separated from internal networks Malware protection is deployed and updated on every endpoint in scope **Text:** Security patches and flaw fixes are applied within a defined window **Critical:** true Security alerts and advisories are monitored, and email protections are in place ## Content **Intro:** This CMMC Level 2 compliance checklist groups the work by the 14 NIST SP 800-171 domains so you can see which area is behind. Tick items as you confirm them, then export the result to PDF or Excel for your team or your consultant. **Sections:** #### How to use this checklist **Body:** Start by deciding where CUI lives: which servers, laptops, file shares, ERP modules and shop-floor machines touch it. That is your assessment scope. Then walk each group and tick an item only when you can show evidence, such as a screenshot, a policy, a log export or a signed record. Items marked critical are the ones that most often fail assessments or carry heavy weight in the SPRS score. Export the finished list and attach it to your SSP working file. #### What Level 2 actually requires **Body:** CMMC Level 2 maps to the 110 security requirements in NIST SP 800-171 Rev 2, spread over 14 domains: AC, AT, AU, CM, IA, IR, MA, MP, PS, PE, RA, CA, SC and SI. Contractors handling CUI are assessed against NIST SP 800-171A objectives, either as a self-assessment or by a C3PAO depending on the contract. The program rule is in 32 CFR Part 170 and the contract clause is DFARS 252.204-7021. The checklist here is a working summary, not a replacement for the requirement text. **Bullets:** - Scope first: only assets that process, store or transmit CUI, plus the security protection assets that support them - Document second: SSP and POA&M are themselves requirements - Evidence third: assessors test, examine and interview #### Reading your results **Body:** Look at the group percentages, not the total. A shop that is strong on policies but weak on boundary protection, encryption and patching will score badly in SPRS even with most boxes ticked. Fix every unticked critical item first, then log the rest in a POA&M with owners and dates. Remember that only a limited set of requirements may sit on a POA&M at assessment time, so the aim is to close the high-value ones before the assessor arrives. #### Common mistakes **Body:** Most failures are scoping and evidence problems, not missing tools. **Bullets:** - Scoping the whole company when a CUI enclave would shrink the work - Ticking an item because a policy exists, with no proof it is operated - Forgetting the ERP, PLM and shop-floor systems that carry drawings and technical data - Ignoring the shared responsibility with your managed service or cloud provider - Treating the SSP as a one-time document instead of a living one **Cta:** If CUI sits in your ERP or document stores, we can add a private AI layer that runs inside your own enclave so queries and drawings never leave your boundary. Ask for a short architecture review. **Faq:** #### How many requirements are in CMMC Level 2? **Answer:** Level 2 aligns to the 110 requirements of NIST SP 800-171 Rev 2, grouped into 14 domains. Assessors score against the 800-171A assessment objectives, so each requirement has several objectives that need evidence. #### Does this checklist replace a C3PAO assessment? **Answer:** No. It is a self-check to find gaps early. For contracts requiring a third-party assessment, an authorized C3PAO must assess you. Use this list to prepare so that the assessment is a confirmation rather than a discovery exercise. #### Can I download the CMMC Level 2 checklist as a PDF? **Answer:** Yes. After ticking items, use the export buttons to save the checklist as PDF, Excel or Word. The export keeps your ticks, the domain grouping and the critical flags, so you can hand it to a consultant or attach it to your SSP file. #### What is the difference between this and the SPRS score? **Answer:** The checklist shows readiness by domain. The SPRS score is a number from -203 to 110 calculated by deducting weighted points for each unmet requirement and submitted to DoD. Use the checklist to find gaps, then the SPRS calculator to score them. ## Search terms cmmc level 2 compliance checklist, cmmc level 2 checklist pdf, cmmc level 2 requirements checklist, cmmc level 2 checklist, cmmc checklist by domain, nist 800-171 checklist, cmmc 2.0 level 2 requirements, cmmc readiness checklist --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json