# CMMC Level 2 Self-Assessment Checklist and Certification Checklist > Source: https://netray.co/tools/cmmc-level-2-self-assessment-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A pass/fail checklist across the 14 CMMC Level 2 control families, with the evidence to gather for each item, so you know where you stand before an assessor arrives. ## Category compliance-legal ## Industry Defense Electronics ## Audience - IT manager - Compliance manager - Defense supplier ## Tool **Kind:** checklist **Scoring Note:** Tick an item only when it is implemented and you hold dated evidence. Any unticked critical item is a likely finding. This is a planning aid, not a formal CMMC assessment. **Groups:** #### Scope and documentation (applies to all families) **Items:** **Text:** CUI data types and where they enter, live and leave are identified **Critical:** true **Text:** Assets that store, process or transmit CUI, and security protection assets, are listed **Critical:** true **Text:** Network and data flow diagrams are current **Critical:** true **Text:** A system security plan covers every one of the 110 requirements **Critical:** true External service providers and cloud services in scope are documented, with their responsibility split **Text:** A POA&M exists for any gap that the rules allow to be open **Critical:** true Your SPRS score is calculated, current and entered #### Access Control and Identification and Authentication **Items:** **Text:** Accounts are unique, named and reviewed at least annually **Critical:** true **Text:** Least privilege is applied and admin accounts are separate from daily accounts **Critical:** true **Text:** MFA is enforced for remote, privileged and network access **Critical:** true Logon lockout, session lock and idle timeout settings are enforced **Text:** Remote access goes through a managed, encrypted gateway **Critical:** true Wireless and mobile devices are authorized and encrypted Password rules, reuse limits and inactive account disabling are set CUI flow to subcontractors and external systems is controlled and approved #### Awareness, audit, configuration management **Items:** **Text:** Security and insider threat training is completed and recorded for all users **Critical:** true Role-based training exists for admins and CUI handlers **Text:** Audit logs are created, retained and tied to individual users **Critical:** true Logs are reviewed and logging failures raise an alert Clocks are synchronized across systems **Text:** Baseline configurations and hardware and software inventory are maintained **Critical:** true Changes are approved, tracked and reviewed for security impact **Text:** Unneeded ports, services and software are disabled or restricted **Critical:** true #### Incident response, maintenance, media and personnel **Items:** **Text:** A written incident response plan exists and was tested in the last year **Critical:** true **Text:** Incidents are logged and reporting to DoD follows DFARS 252.204-7012 timing **Critical:** true Maintenance is controlled, with sanitization before off-site service Remote maintenance uses MFA and sessions are closed afterwards **Text:** CUI media is marked, protected, encrypted in transport and sanitized on disposal **Critical:** true Removable media is controlled and unowned devices are prohibited **Text:** Personnel are screened before access and access is removed on termination or transfer **Critical:** true #### Physical protection, risk and security assessment **Items:** **Text:** Physical access to CUI areas is limited, logged and monitored **Critical:** true Visitors are escorted and logged Keys and badges are controlled and inventoried Safeguards cover remote and alternate work sites **Text:** A risk assessment was completed in the last year **Critical:** true **Text:** Vulnerability scans run regularly and findings are remediated by risk **Critical:** true Controls are assessed periodically and monitored continuously #### System and communications protection, and system integrity **Items:** **Text:** Boundary firewalls deny by default and are monitored **Critical:** true Public-facing components sit in a separate network segment **Text:** CUI is encrypted in transit and at rest with FIPS-validated cryptography **Critical:** true Split tunneling is prevented on VPN clients Cryptographic keys have a managed lifecycle **Text:** Patches are applied on a schedule and flaws tracked to closure **Critical:** true Malware protection is installed, updated and scanning Security advisories are monitored and acted on **Text:** Inbound and outbound traffic is monitored for attacks and unauthorized use **Critical:** true ## Content **Intro:** This checklist walks the 14 CMMC Level 2 control families in six working groups so a defense supplier can self-assess in an afternoon. Tick what you can prove with dated evidence, and the score shows where you are weakest before a C3PAO does. **Sections:** #### How to use the checklist **Body:** Work through each group with the person who owns that area: IT for access and configuration, HR for personnel security, facilities for physical protection, and quality or contracts for CUI scope. Tick an item only when you can open a record that proves it. A setting without evidence, or a policy nobody follows, should stay unticked. Critical items are the ones that most often cause findings or block a pass. #### Evidence to collect **Body:** For each tick, save evidence that shows the control works: exported policy settings, screenshots with dates, log samples, meeting minutes, training attendance and signed procedures. Assessors use examine, interview and test methods, so staff must also be able to explain what they do. Store evidence in one folder structure by control number so it can be produced quickly. **Bullets:** - Policies and procedures with version and approval date - System configuration exports and screenshots - Logs, tickets and review records showing the control in operation - Training rosters and interview-ready owners #### Reading your score **Body:** The percentage is a simple planning measure and is not the same as your SPRS score or an official assessment result. A Level 2 certification assessment expects all 110 requirements met, with only limited conditional status allowed under the CMMC program rules. Use this score to prioritize, then move gaps into a POA&M and calculate the SPRS score from the NIST SP 800-171 DoD Assessment Methodology. #### Common mistakes **Body:** The biggest errors are scoping too narrowly, relying on a managed service without documenting who does what, and treating the checklist as a one-time task. Controls such as log review, access recertification and vulnerability remediation need recurring evidence over months. Start early so you can show operation over time, not a single snapshot. **Cta:** If you want evidence and policies searchable by an assistant that runs inside your own network, Netray can build that as a private AI layer on your on-prem systems. **Faq:** #### What does a CMMC Level 2 self-assessment involve? **Answer:** You assess your environment against the 110 NIST SP 800-171 requirements, document each in an SSP, list gaps in a POA&M and calculate an SPRS score. Whether Level 2 needs a self or third-party assessment depends on the contract and CUI type. #### Is this the same as a C3PAO assessment? **Answer:** No. A C3PAO assessment is performed by an accredited third party who tests evidence against assessment objectives. This checklist helps you prepare and does not replace it. #### What should I tick if a control is partly done? **Answer:** Leave it unticked. Under the assessment methodology a requirement is either met or not met. Record the gap, assign an owner and a date, and track it in your POA&M. #### How often should I repeat the self-assessment? **Answer:** At least annually, and after significant changes such as a new ERP, cloud service or network layout. Affirmations to DoD under CMMC are also tied to ongoing compliance, so keep evidence current. ## Search terms cmmc level 2 self-assessment checklist, checklist for cmmc level 2, cmmc level 2 certification checklist, cmmc self assessment, nist 800-171 self assessment checklist, cmmc readiness checklist, cmmc level 2 evidence list --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json