CMMC Level 2 Self-Assessment Checklist and Certification Checklist
This checklist walks the 14 CMMC Level 2 control families in six working groups so a defense supplier can self-assess in an afternoon. Tick what you can prove with dated evidence, and the score shows where you are weakest before a C3PAO does.
0 of 46 items complete
24 critical items still open - these are the highest-risk gaps.
Scope and documentation (applies to all families)
Access Control and Identification and Authentication
Awareness, audit, configuration management
Incident response, maintenance, media and personnel
Physical protection, risk and security assessment
System and communications protection, and system integrity
Tick an item only when it is implemented and you hold dated evidence. Any unticked critical item is a likely finding. This is a planning aid, not a formal CMMC assessment.
Need a second pair of eyes on your readiness?
Optional expert review of your checklist result and where an on-prem AI layer could ease evidence work.
Optional. The tool and every export work without this. No spam.
How to use the checklist
Work through each group with the person who owns that area: IT for access and configuration, HR for personnel security, facilities for physical protection, and quality or contracts for CUI scope. Tick an item only when you can open a record that proves it. A setting without evidence, or a policy nobody follows, should stay unticked. Critical items are the ones that most often cause findings or block a pass.
Evidence to collect
For each tick, save evidence that shows the control works: exported policy settings, screenshots with dates, log samples, meeting minutes, training attendance and signed procedures. Assessors use examine, interview and test methods, so staff must also be able to explain what they do. Store evidence in one folder structure by control number so it can be produced quickly.
- Policies and procedures with version and approval date
- System configuration exports and screenshots
- Logs, tickets and review records showing the control in operation
- Training rosters and interview-ready owners
Reading your score
The percentage is a simple planning measure and is not the same as your SPRS score or an official assessment result. A Level 2 certification assessment expects all 110 requirements met, with only limited conditional status allowed under the CMMC program rules. Use this score to prioritize, then move gaps into a POA&M and calculate the SPRS score from the NIST SP 800-171 DoD Assessment Methodology.
Common mistakes
The biggest errors are scoping too narrowly, relying on a managed service without documenting who does what, and treating the checklist as a one-time task. Controls such as log review, access recertification and vulnerability remediation need recurring evidence over months. Start early so you can show operation over time, not a single snapshot.
Frequently Asked Questions
What does a CMMC Level 2 self-assessment involve?
You assess your environment against the 110 NIST SP 800-171 requirements, document each in an SSP, list gaps in a POA&M and calculate an SPRS score. Whether Level 2 needs a self or third-party assessment depends on the contract and CUI type.
Is this the same as a C3PAO assessment?
No. A C3PAO assessment is performed by an accredited third party who tests evidence against assessment objectives. This checklist helps you prepare and does not replace it.
What should I tick if a control is partly done?
Leave it unticked. Under the assessment methodology a requirement is either met or not met. Record the gap, assign an owner and a date, and track it in your POA&M.
How often should I repeat the self-assessment?
At least annually, and after significant changes such as a new ERP, cloud service or network layout. Affirmations to DoD under CMMC are also tied to ongoing compliance, so keep evidence current.
If you want evidence and policies searchable by an assistant that runs inside your own network, Netray can build that as a private AI layer on your on-prem systems.
Related Tools
CMMC Level 2 Controls List (All 110 Requirements)
All 110 NIST SP 800-171 Rev 2 requirements that make up CMMC Level 2, grouped into 14 families, with a shop-floor example and typical evidence for each.
Aerospace & DefenseNIST 800-171 SPRS Score Calculator
Calculate your SPRS score from the DoD Assessment Methodology: start at 110 and subtract the weight of each unmet NIST SP 800-171 requirement.
Compliance & ContractsCMMC POA&M (Plan of Action and Milestones) Worksheet
An editable POA&M tracker for NIST 800-171 gaps with owner, status, target date, estimated cost and a running cost total.
Compliance & ContractsCMMC C3PAO Assessment Day Prep Checklist
A four part checklist covering documents, evidence, people and logistics before a third party assessor arrives, with the items that sink assessments marked critical.
Aerospace & DefenseCMMC 2.0 Level 2 Readiness Assessment
Answer 10 questions mapped to NIST SP 800-171 control families and get an instant CMMC Level 2 readiness score with prioritized next steps.
More Compliance & Contracts tools
See all- NIST SP 800-171 Rev 2 Control Families Reference
- Defense Electronics Certificate of Conformance Template
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
Keep exploring
Free tools
- CMMC Level 1 Checklist and Level 2 Control Tracker (Excel)A CMMC Level 2 control tracker by family with evidence examples, plus the 17 Level 1 practices and how scoring works.
- CMMC Level 2 Checklist WorksheetAn editable CMMC Level 2 tracking sheet with real NIST SP 800-171 practice IDs, status, evidence, owner and due date, exportable to Excel.
- CMMC Level 1 Checklist (15 Practices) with Evidence TrackerAn editable worksheet of the 15 CMMC Level 1 practices with plain-English meaning, example evidence, owner and status. Export to Excel or PDF for your self-assessment.
Guides
- CMMC 2.0 for Small ManufacturersCMMC 2.0 for small manufacturers explained: Level 1 vs Level 2, the 110 NIST SP 800-171 practices, scoping your shop floor, and where ERP and CAD data fit.
- CMMC Level 2 for a Small CNC Machine Shop: What Applies and Where to StartCMMC Level 2 for small CNC machine shops: when it applies, what CUI in drawings means, the scope decisions that control cost, and how AI tools fit the boundary.
- CMMC-Compliant AI Deployment: A Practical Guide for Level 2 ContractorsCMMC-compliant AI deployment explained: how Level 2 defense contractors can run AI on CUI without expanding assessment scope. Controls, enclaves, and costs.
AI on your ERP
- CMMC Level 2 AI for ERP Without Blowing Up Your ScopeHow to deploy AI inside your CMMC 2.0 Level 2 assessment boundary without expanding CUI scope. Enclave architecture a CISO can defend to a C3PAO.
- On-prem AI for Costpoint inside a CMMC Level 2 enclaveDeploy AI beside Deltek Costpoint inside a CMMC Level 2 enclave: what to check before adding any AI tool, and how on-prem inference avoids new CUI flows.