CMMC Level 2 Excel Spreadsheet Template with Level 1 Checklist and Scoring
This CMMC Level 2 spreadsheet tracks all 110 practices by control family, shows percent complete and lists the evidence an assessor typically asks for. Below it you will find the Level 1 checklist, how Level 1 and Level 2 scoring work, and what to put in your network and data flow diagrams.
| Control family | ID prefix | Practices | Practices met | Percent met | Typical evidence | Owner | Status | |
|---|---|---|---|---|---|---|---|---|
63.6% | ||||||||
100% | ||||||||
55.6% | ||||||||
66.7% | ||||||||
72.7% | ||||||||
33.3% | ||||||||
66.7% | ||||||||
55.6% | ||||||||
100% | ||||||||
83.3% | ||||||||
33.3% | ||||||||
50% | ||||||||
56.3% | ||||||||
71.4% |
The 14 families and 110 practices come from NIST SP 800-171 Revision 2 as used by CMMC Level 2. Counts per family are the standard counts. Verify the current assessment guide before an assessment, since scope and guidance documents are updated.
Keep CUI inside your boundary
Optional: talk through how a private on-prem AI layer can sit inside your CMMC enclave.
Optional. The tool and every export work without this. No spam.
Using the Level 2 control tracker
Set the practices met column only when you hold evidence, not when the control is merely planned. Assign an owner per family, and move the status to Verified after someone other than the owner checks the evidence. The percent column and overall total update as you edit. Export to Excel to keep a dated copy for your system security plan and POA&M. Practice level detail (for example AC.L2-3.1.1) can be added as rows if you prefer one row per practice.
CMMC Level 1 checklist and scoring
Level 1 covers 17 practices that map to the 15 basic safeguarding requirements of FAR 52.204-21, protecting Federal Contract Information. It is assessed by an annual self-assessment with an affirmation by a senior official. There is no numeric score: each practice is met or not met, and all must be met. Level 2 differs. A self or C3PAO assessment is scored against 110 with weighted deductions of 1, 3 or 5 points per unmet practice, and conditional status generally needs a score of at least 80 percent with open items closed within 180 days.
- Access control: limit access to authorized users and devices, limit to permitted transactions, control external connections, control public information
- Identification and authentication: identify and authenticate users and devices
- Media and physical: sanitize media, limit physical access, escort and log visitors, control keys and devices
- System protection: boundary protection, separate public components, flaw remediation, malicious code protection, updates and scans
Network and data flow diagram examples for a machine shop
Assessors want to see where CUI is stored, processed and transmitted. A good network diagram for a small shop shows the internet edge and firewall, a separate VLAN for the CUI enclave holding the file server and CAM workstations, a segregated shop floor VLAN for CNC controllers, wireless networks marked as in or out of scope, and any cloud service such as a government community cloud mail tenant. The data flow diagram traces a drawing from customer portal download to file share, CAM programming, DNC transfer to the machine and archival or deletion. Label every arrow with protocol and encryption.
Evidence and common mistakes
Good evidence is dated, attributable and shows the setting itself: a configuration export, a console screenshot with the date visible, a signed record. Common mistakes are listing the policy as the only evidence, leaving CNC machines out of the asset inventory, forgetting external service providers in the shared responsibility matrix, and counting a practice as met when it is only done on some of the systems in scope.
Frequently Asked Questions
How many practices are in CMMC Level 1 and Level 2?
Level 1 has 17 practices and Level 2 has 110 practices drawn from NIST SP 800-171 Revision 2. Level 2 practices are grouped into 14 families such as Access Control, Audit and Accountability and System and Communications Protection.
Is there a score for CMMC Level 1?
No numeric score is used. Each of the 17 practices is either met or not met, and you must meet all of them to affirm compliance. The SPRS style 110 point score applies to Level 2.
How do I score Level 2?
Start at 110 and subtract the point value of each unmet practice, which is 1, 3 or 5 depending on the practice. A fully compliant company scores 110. Some practices allow partial credit, so check the DoD scoring methodology for exceptions.
What should a CMMC network diagram include?
Show the scope boundary, firewalls, VLANs, systems that store or process CUI, out of scope networks, remote access paths, wireless, and external cloud services. Include IP ranges or segment names and the data flows between them.
If CUI lives in an on-prem ERP or file share, Netray can add a private AI layer inside your boundary so engineers get answers without CUI leaving your enclave.
Related Tools
CMMC Practice Evidence Tracker Worksheet
One row per practice: objectives, objectives met, evidence items, owner and weight. The sheet computes percent complete, points at risk and an estimated score.
Compliance & ContractsCMMC Asset Scoping and Categorization Worksheet
Build your in scope asset inventory by CMMC category, with quantities, documentation effort and annual tool cost so you can see what scope reduction would save.
Compliance & ContractsCMMC POA&M (Plan of Action and Milestones) Worksheet
An editable POA&M tracker for NIST 800-171 gaps with owner, status, target date, estimated cost and a running cost total.
Compliance & ContractsCost of CMMC Level 2 Third-Party Certification Calculator
Estimate one-time and yearly cost of CMMC Level 2 certification including the C3PAO assessment, readiness consulting and remediation.
More Compliance & Contracts tools
See all- CMMC Level 1 Checklist
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
- GDPR ERP Data Migration Checklist
Keep exploring
Free tools
- CMMC Level 1 Checklist (15 Practices) with Evidence TrackerAn editable worksheet of the 15 CMMC Level 1 practices with plain-English meaning, example evidence, owner and status. Export to Excel or PDF for your self-assessment.
- CMMC Level 2 Checklist WorksheetAn editable CMMC Level 2 tracking sheet with real NIST SP 800-171 practice IDs, status, evidence, owner and due date, exportable to Excel.
- CMMC Level 1 ChecklistTick through every CMMC Level 1 practice for Federal Contract Information, see example evidence for each, and finish with the annual affirmation steps.
Guides
- CMMC 2.0 for Small ManufacturersCMMC 2.0 for small manufacturers explained: Level 1 vs Level 2, the 110 NIST SP 800-171 practices, scoping your shop floor, and where ERP and CAD data fit.
- CMMC Level 2 for a Small CNC Machine Shop: What Applies and Where to StartCMMC Level 2 for small CNC machine shops: when it applies, what CUI in drawings means, the scope decisions that control cost, and how AI tools fit the boundary.
- CMMC-Compliant AI Deployment: A Practical Guide for Level 2 ContractorsCMMC-compliant AI deployment explained: how Level 2 defense contractors can run AI on CUI without expanding assessment scope. Controls, enclaves, and costs.
AI on your ERP
- CMMC Level 2 AI for ERP Without Blowing Up Your ScopeHow to deploy AI inside your CMMC 2.0 Level 2 assessment boundary without expanding CUI scope. Enclave architecture a CISO can defend to a C3PAO.
- On-prem AI for Costpoint inside a CMMC Level 2 enclaveDeploy AI beside Deltek Costpoint inside a CMMC Level 2 enclave: what to check before adding any AI tool, and how on-prem inference avoids new CUI flows.