CMMC Level 2 Checklist in Excel
CMMC Level 2 maps to the 110 security requirements in NIST SP 800-171 Rev 2. This worksheet gives you an editable tracking sheet with real practice IDs, status, evidence, owner and due date, ready to export to Excel for your assessor prep.
| Practice | Family | What it asks (paraphrased) | Status | Evidence / document | Owner | Due date | |
|---|---|---|---|---|---|---|---|
Starter list of 32 representative practices out of the 110 in NIST SP 800-171 Rev 2 (14 families). Add the remaining rows for your full scope. Practice wording is paraphrased. Use the official NIST text and the CMMC assessment guide for the exact objectives.
Keep CMMC evidence on-prem and searchable
An optional conversation about a private AI layer over your compliance documents that never leaves your network.
Optional. The tool and every export work without this. No spam.
How to use the worksheet
Start with the rows provided, set the status of each practice honestly, and name the evidence document that proves it. Add the rest of the 110 practices as new rows so every one has an owner and a date. Filter by status in Excel to produce your plan of action and milestones. Update it weekly while you remediate, and keep the evidence files in a controlled folder named after the practice ID.
What an assessor looks for
An assessor evaluates each practice against its assessment objectives using three kinds of evidence: documents, interviews and observation or testing. A status of Implemented should therefore point to a policy or procedure, to a person who can explain it, and to a system setting that can be shown live. Practices covered by an external service provider should be marked Inherited, with a shared responsibility matrix backing it up.
- Documents: policies, procedures, system security plan
- Interviews: the people who run the process daily
- Examination: configurations, logs and screenshots
- Scope: every asset that stores, processes or transmits CUI
Common mistakes
Teams often mark a practice done because a tool is installed, without a written procedure or evidence. Another is an undefined scope: if you cannot list the assets that handle CUI, you cannot assess them. Also remember that the system security plan is itself a requirement, and that unresolved practices need a POA&M entry. Check the current CMMC program rule for which practices may stay open at assessment time.
Frequently Asked Questions
How many practices are in CMMC Level 2?
CMMC Level 2 aligns to the 110 requirements of NIST SP 800-171 Rev 2, grouped in 14 families such as Access Control, Audit and Accountability, and System and Communications Protection.
Is this a complete CMMC Level 2 audit checklist?
It is a starter sheet with 32 representative practices and the column structure you need. Add the remaining practices for full coverage. It does not replace the official assessment guide or an assessor's judgement.
Should I track status per practice or per objective?
Assessors score against objectives inside each practice. Tracking at practice level is fine to start, but add notes on any objective you cannot yet show evidence for, since one missing objective means the practice is not met.
Can I use this as a self assessment?
Yes for internal readiness tracking. For a formal self assessment, follow the official scoring method and record the results as your contract requires. Use the SPRS score calculator on this site for the weighted score.
For on-prem evidence collection, Netray can build a private AI layer that answers where a practice's evidence lives across your file shares and systems without sending data to a public cloud.
Related Tools
NIST 800-171 SPRS Score Calculator
Calculate your SPRS score from the DoD Assessment Methodology: start at 110 and subtract the weight of each unmet NIST SP 800-171 requirement.
Aerospace & DefenseNIST 800-171 POA&M Worksheet
An editable plan of action and milestones for NIST SP 800-171 gaps, with owner, cost, due date, status and the SPRS points each fix recovers.
Compliance & ContractsNIST SP 800-171 System Security Plan (SSP) Template
A fill-in SSP skeleton covering system boundary, CUI data flows, roles and a control family implementation summary, ready to export and refine.
Compliance & ContractsCMMC Practice Evidence Tracker Worksheet
One row per practice: objectives, objectives met, evidence items, owner and weight. The sheet computes percent complete, points at risk and an estimated score.
Aerospace & DefenseCMMC 2.0 Level 2 Readiness Assessment
Answer 10 questions mapped to NIST SP 800-171 control families and get an instant CMMC Level 2 readiness score with prioritized next steps.
More Compliance & Contracts tools
See all- SPRS Score Recovery Timeline Calculator
- CMMC Asset Scoping and Categorization Worksheet
- CMMC Shared Responsibility Matrix Worksheet for MSPs and Cloud Providers
- CUI Banner and Dissemination Control Marking Reference
- ITAR Technical Data Handling Procedure Template
- CMMC C3PAO Assessment Day Prep Checklist
- CMMC Level 1 Checklist (15 Practices) with Evidence Tracker
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
Keep exploring
Free tools
- CMMC Level 1 ChecklistTick through every CMMC Level 1 practice for Federal Contract Information, see example evidence for each, and finish with the annual affirmation steps.
- CMMC Level 1 Checklist and Level 2 Control Tracker (Excel)A CMMC Level 2 control tracker by family with evidence examples, plus the 17 Level 1 practices and how scoring works.
- CMMC Level 1 Checklist (15 Practices) with Evidence TrackerAn editable worksheet of the 15 CMMC Level 1 practices with plain-English meaning, example evidence, owner and status. Export to Excel or PDF for your self-assessment.
Guides
- CMMC 2.0 for Small ManufacturersCMMC 2.0 for small manufacturers explained: Level 1 vs Level 2, the 110 NIST SP 800-171 practices, scoping your shop floor, and where ERP and CAD data fit.
- CMMC Level 2 for a Small CNC Machine Shop: What Applies and Where to StartCMMC Level 2 for small CNC machine shops: when it applies, what CUI in drawings means, the scope decisions that control cost, and how AI tools fit the boundary.
- CMMC-Compliant AI Deployment: A Practical Guide for Level 2 ContractorsCMMC-compliant AI deployment explained: how Level 2 defense contractors can run AI on CUI without expanding assessment scope. Controls, enclaves, and costs.
AI on your ERP
- CMMC Level 2 AI for ERP Without Blowing Up Your ScopeHow to deploy AI inside your CMMC 2.0 Level 2 assessment boundary without expanding CUI scope. Enclave architecture a CISO can defend to a C3PAO.
- On-prem AI for Costpoint inside a CMMC Level 2 enclaveDeploy AI beside Deltek Costpoint inside a CMMC Level 2 enclave: what to check before adding any AI tool, and how on-prem inference avoids new CUI flows.