# CMMC Practice Evidence Tracker Worksheet

> Source: https://netray.co/tools/cmmc-practice-evidence-tracker-worksheet
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

One row per practice: objectives, objectives met, evidence items, owner and weight. The sheet computes percent complete, points at risk and an estimated score.

## Category

compliance-legal

## Industry

Defense

## Audience

- Compliance lead
- IT manager
- Quality manager
- Consultant

## Tool

**Kind:** worksheet

**Mode:** editable

**Columns:**

#### Practice

**Key:** practice

**Type:** text

**Help:** For example AC.L2-3.1.1

#### Family

**Key:** family

**Type:** select

**Options:**

- AC
- AT
- AU
- CM
- IA
- IR
- MA
- MP
- PS
- PE
- RA
- CA
- SC
- SI

#### SPRS weight

**Key:** weight

**Type:** number

**Help:** 5, 3 or 1 from the DoD Assessment Methodology

#### Objectives

**Key:** objectives

**Type:** number

**Help:** Count of determination statements in NIST SP 800-171A

#### Objectives met

**Key:** met

**Type:** number

#### Evidence items

**Key:** evidence

**Type:** number

**Help:** Documents, screenshots, configs, interview notes

#### Percent met

**Key:** pct

**Type:** number

**Expr:** met / objectives * 100

**Format:** percent

#### Points at risk

**Key:** risk

**Type:** number

**Expr:** if(lt(met, objectives), weight, 0)

**Format:** integer

#### Owner

**Key:** owner

**Type:** text

#### Target date

**Key:** due

**Type:** date

**Rows:**

**Practice:** AC.L2-3.1.1

**Family:** AC

**Weight:** 5

**Objectives:** 6

**Met:** 6

**Evidence:** 5

**Owner:** IT lead

**Due:** 2026-11-15

**Practice:** IA.L2-3.5.3

**Family:** IA

**Weight:** 5

**Objectives:** 3

**Met:** 2

**Evidence:** 2

**Owner:** IT lead

**Due:** 2026-12-01

**Practice:** AU.L2-3.3.1

**Family:** AU

**Weight:** 5

**Objectives:** 2

**Met:** 1

**Evidence:** 1

**Owner:** Security

**Due:** 2026-12-15

**Practice:** MP.L2-3.8.3

**Family:** MP

**Weight:** 5

**Objectives:** 2

**Met:** 2

**Evidence:** 3

**Owner:** Facilities

**Due:** 2026-11-30

**Practice:** AT.L2-3.2.1

**Family:** AT

**Weight:** 1

**Objectives:** 3

**Met:** 3

**Evidence:** 4

**Owner:** HR

**Due:** 2026-11-01

**Practice:** PE.L2-3.10.1

**Family:** PE

**Weight:** 1

**Objectives:** 4

**Met:** 3

**Evidence:** 3

**Owner:** Facilities

**Due:** 2026-11-20

**Totals:**

#### Total objectives

**Key:** objectives

**Agg:** sum

**Format:** integer

#### Objectives met

**Key:** met

**Agg:** sum

**Format:** integer

#### Evidence items

**Key:** evidence

**Agg:** sum

**Format:** integer

#### Points at risk

**Key:** risk

**Agg:** sum

**Format:** integer

**Summary:**

#### Objective coverage

**Key:** coverage

**Expr:** sum_met / sum_objectives * 100

**Format:** percent

**Primary:** true

#### Estimated score if these rows were the only gaps

**Key:** est

**Expr:** 110 - sum_risk

**Format:** integer

**Primary:** true

**Description:** Only meaningful when every unmet practice is listed in the sheet.

#### Evidence items per objective

**Key:** evi

**Expr:** sum_evidence / sum_objectives

**Format:** decimal

**Notes:** Example rows are illustrative. Take the objective counts and weights from NIST SP 800-171A and the DoD Assessment Methodology for your own scoping. A practice is only counted as met when every objective is met, which is why points at risk use the weight when objectives met is below objectives.

## Content

**Intro:** A practice is not met because someone says so. It is met when every assessment objective has evidence an assessor can examine, interview or test. This worksheet keeps that status for each practice in one editable table and exports to Excel.

**Sections:**

#### How to use it

**Body:** Add a row for each practice in scope, all 110 for a full Level 2 view. Enter the SPRS weight, the number of assessment objectives from NIST SP 800-171A, and how many you can already prove. Count the evidence items you have collected, assign an owner and set a target date. The percent met column shows progress, and points at risk shows the weight whenever any objective is unmet. Sort by points at risk in Excel to see what to fix first. Update it weekly in the first ninety days and monthly after that.

#### Why objectives, not practices

**Body:** NIST SP 800-171A breaks each requirement into determination statements, and CMMC assessors score at that level, using the examine, interview and test methods. A practice with 5 of 6 objectives met is still not met, and it costs the full weight. That is why the points at risk formula is all or nothing, while the percent met column is for tracking effort. The evidence count helps you spot objectives with a claim but no artifacts.

**Bullets:**

- Examine: policies, configurations, logs, diagrams
- Interview: administrators and users who run the control
- Test: demonstrate the mechanism working
- Keep each artifact dated and named to the objective it supports

#### Common mistakes

**Body:** Teams often track only the practice name and a green or red status, which hides the single missing objective. Others store evidence in many places with no index. A good habit is one evidence folder per practice, named by practice ID, with the SSP section reference in the tracker. Remember that inherited controls from a cloud or managed provider still need your own evidence of how you use them, which the shared responsibility matrix worksheet covers.

**Cta:** If evidence is scattered across IT, quality and ERP, we can build a private retrieval layer that finds the artifact for each objective on your own servers.

**Faq:**

#### How many rows should I have?

**Answer:** A full Level 2 view has 110 practices across 14 families. If you are scoping only part of the environment, still track all 110, but note which assets each practice applies to.

#### Where do I find the objective counts?

**Answer:** In NIST SP 800-171A, each requirement lists determination statements lettered a, b, c and so on. Count them for each practice. The count differs by practice, so do not use an average.

#### Does percent met feed my SPRS score?

**Answer:** No. SPRS scoring is all or nothing per requirement, apart from a few with defined partial credit. Percent met is a progress measure. Points at risk is the number that maps to the score.

#### What counts as evidence?

**Answer:** Anything an assessor can examine or test: approved policies, screenshots with dates, exported configurations, log samples, training records, tickets and interview notes. Evidence should show the control is operating, not only designed.

## Search terms

cmmc evidence tracker excel, nist 800-171a assessment objectives worksheet, cmmc practice tracker, cmmc level 2 evidence spreadsheet, cmmc assessment evidence list, 800-171 implementation status tracker, cmmc readiness spreadsheet, cmmc compliance tracker template

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json