CMMC Level 2 Compliance Checklist
This CMMC Level 2 compliance checklist groups the work by the 14 NIST SP 800-171 domains so you can see which area is behind. Tick items as you confirm them, then export the result to PDF or Excel for your team or your consultant.
0 of 37 items complete
14 critical items still open - these are the highest-risk gaps.
Access Control (AC) and Identification and Authentication (IA)
Awareness and Training (AT) and Personnel Security (PS)
Audit and Accountability (AU) and Incident Response (IR)
Configuration Management (CM), Maintenance (MA) and Media Protection (MP)
Physical Protection (PE) and Risk Assessment (RA)
Security Assessment (CA), System and Communications Protection (SC), System and Information Integrity (SI)
This checklist condenses the intent of the 110 NIST SP 800-171 Rev 2 requirements into about 40 working items, three or so per domain. Ticking every item here does not equal a passed assessment: a C3PAO scores each of the 110 requirements against NIST SP 800-171A objectives. Use it to find the weak domains first, then work the full requirement list in your tracker.
Private AI inside your CUI boundary
Optional: a short review of how an on-prem AI layer can sit inside your CMMC enclave without moving CUI out.
Optional. The tool and every export work without this. No spam.
How to use this checklist
Start by deciding where CUI lives: which servers, laptops, file shares, ERP modules and shop-floor machines touch it. That is your assessment scope. Then walk each group and tick an item only when you can show evidence, such as a screenshot, a policy, a log export or a signed record. Items marked critical are the ones that most often fail assessments or carry heavy weight in the SPRS score. Export the finished list and attach it to your SSP working file.
What Level 2 actually requires
CMMC Level 2 maps to the 110 security requirements in NIST SP 800-171 Rev 2, spread over 14 domains: AC, AT, AU, CM, IA, IR, MA, MP, PS, PE, RA, CA, SC and SI. Contractors handling CUI are assessed against NIST SP 800-171A objectives, either as a self-assessment or by a C3PAO depending on the contract. The program rule is in 32 CFR Part 170 and the contract clause is DFARS 252.204-7021. The checklist here is a working summary, not a replacement for the requirement text.
- Scope first: only assets that process, store or transmit CUI, plus the security protection assets that support them
- Document second: SSP and POA&M are themselves requirements
- Evidence third: assessors test, examine and interview
Reading your results
Look at the group percentages, not the total. A shop that is strong on policies but weak on boundary protection, encryption and patching will score badly in SPRS even with most boxes ticked. Fix every unticked critical item first, then log the rest in a POA&M with owners and dates. Remember that only a limited set of requirements may sit on a POA&M at assessment time, so the aim is to close the high-value ones before the assessor arrives.
Common mistakes
Most failures are scoping and evidence problems, not missing tools.
- Scoping the whole company when a CUI enclave would shrink the work
- Ticking an item because a policy exists, with no proof it is operated
- Forgetting the ERP, PLM and shop-floor systems that carry drawings and technical data
- Ignoring the shared responsibility with your managed service or cloud provider
- Treating the SSP as a one-time document instead of a living one
Frequently Asked Questions
How many requirements are in CMMC Level 2?
Level 2 aligns to the 110 requirements of NIST SP 800-171 Rev 2, grouped into 14 domains. Assessors score against the 800-171A assessment objectives, so each requirement has several objectives that need evidence.
Does this checklist replace a C3PAO assessment?
No. It is a self-check to find gaps early. For contracts requiring a third-party assessment, an authorized C3PAO must assess you. Use this list to prepare so that the assessment is a confirmation rather than a discovery exercise.
Can I download the CMMC Level 2 checklist as a PDF?
Yes. After ticking items, use the export buttons to save the checklist as PDF, Excel or Word. The export keeps your ticks, the domain grouping and the critical flags, so you can hand it to a consultant or attach it to your SSP file.
What is the difference between this and the SPRS score?
The checklist shows readiness by domain. The SPRS score is a number from -203 to 110 calculated by deducting weighted points for each unmet requirement and submitted to DoD. Use the checklist to find gaps, then the SPRS calculator to score them.
If CUI sits in your ERP or document stores, we can add a private AI layer that runs inside your own enclave so queries and drawings never leave your boundary. Ask for a short architecture review.
Related Tools
NIST 800-171 SPRS Score Calculator
Calculate your SPRS score from the DoD Assessment Methodology: start at 110 and subtract the weight of each unmet NIST SP 800-171 requirement.
Aerospace & DefenseCMMC 2.0 Level 2 Readiness Assessment
Answer 10 questions mapped to NIST SP 800-171 control families and get an instant CMMC Level 2 readiness score with prioritized next steps.
Compliance & ContractsCMMC POA&M (Plan of Action and Milestones) Worksheet
An editable POA&M tracker for NIST 800-171 gaps with owner, status, target date, estimated cost and a running cost total.
Compliance & ContractsCMMC Practice Evidence Tracker Worksheet
One row per practice: objectives, objectives met, evidence items, owner and weight. The sheet computes percent complete, points at risk and an estimated score.
Compliance & ContractsNIST SP 800-171 System Security Plan (SSP) Template
A fill-in SSP skeleton covering system boundary, CUI data flows, roles and a control family implementation summary, ready to export and refine.
More Aerospace & Defense tools
See all- CMMC Level 2 SSP Example for a Machine Shop
- ITAR Compliance Checklist for Manufacturers
- DFARS 252.204-7012 Compliance Self-Assessment
- AS9100 Audit Readiness Checklist
- Export Control Screening Checklist
- Defense Contractor AI Readiness Assessment
- Counterfeit Parts Risk Assessment (AS5553)
- Aerospace Supplier Scorecard
- First Article Inspection (AS9102) Checklist
Keep exploring
Free tools
- CMMC Level 2 Checklist WorksheetAn editable CMMC Level 2 tracking sheet with real NIST SP 800-171 practice IDs, status, evidence, owner and due date, exportable to Excel.
- CMMC Level 2 Controls List (All 110 Requirements)All 110 NIST SP 800-171 Rev 2 requirements that make up CMMC Level 2, grouped into 14 families, with a shop-floor example and typical evidence for each.
- CMMC 2.0 Level 2 Readiness AssessmentAnswer 10 questions mapped to NIST SP 800-171 control families and get an instant CMMC Level 2 readiness score with prioritized next steps.
ERP fixes and how-tos
- Format Codes in Infor LN: Data Formats and MasksWhat format codes and display formats mean in Infor LN, how domains use them to show numbers, dates and codes, and how to change a format without breaking data.
- On-Prem vs Cloud ERP AI for Regulated ManufacturersHow CIOs at ITAR, CMMC, and export-controlled manufacturers should weigh on-prem versus cloud AI for their ERP, including what actually needs to stay on-prem and what does not.
- Costpoint Cloud or On-Prem for a Contractor Handling CUI?Deciding between Deltek Costpoint cloud and self-hosted for a defense contractor with CUI: scope, shared responsibility, cost, control, what to verify.
Guides
- CMMC 2.0 for Small ManufacturersCMMC 2.0 for small manufacturers explained: Level 1 vs Level 2, the 110 NIST SP 800-171 practices, scoping your shop floor, and where ERP and CAD data fit.
- CMMC Level 2 for a Small CNC Machine Shop: What Applies and Where to StartCMMC Level 2 for small CNC machine shops: when it applies, what CUI in drawings means, the scope decisions that control cost, and how AI tools fit the boundary.
- AI-Powered Defense Manufacturing ComplianceEnsure defense manufacturing compliance with AI. Automated ITAR, DFARS, CMMC, and export control management for defense contractors and subcontractors.
AI on your ERP
- On-prem AI for Costpoint inside a CMMC Level 2 enclaveDeploy AI beside Deltek Costpoint inside a CMMC Level 2 enclave: what to check before adding any AI tool, and how on-prem inference avoids new CUI flows.
- CMMC Level 2 AI for ERP Without Blowing Up Your ScopeHow to deploy AI inside your CMMC 2.0 Level 2 assessment boundary without expanding CUI scope. Enclave architecture a CISO can defend to a C3PAO.