CMMC Practice Evidence Tracker Worksheet
A practice is not met because someone says so. It is met when every assessment objective has evidence an assessor can examine, interview or test. This worksheet keeps that status for each practice in one editable table and exports to Excel.
| Practice | Family | SPRS weight | Objectives | Objectives met | Evidence items | Percent met | Points at risk | Owner | Target date | |
|---|---|---|---|---|---|---|---|---|---|---|
100% | 0 | |||||||||
66.7% | 5 | |||||||||
50% | 5 | |||||||||
100% | 0 | |||||||||
100% | 0 | |||||||||
75% | 1 |
Example rows are illustrative. Take the objective counts and weights from NIST SP 800-171A and the DoD Assessment Methodology for your own scoping. A practice is only counted as met when every objective is met, which is why points at risk use the weight when objectives met is below objectives.
Evidence retrieval for your assessment
Optional: see how a private retrieval layer can map documents and configurations to objectives. Not required to use the sheet.
Optional. The tool and every export work without this. No spam.
How to use it
Add a row for each practice in scope, all 110 for a full Level 2 view. Enter the SPRS weight, the number of assessment objectives from NIST SP 800-171A, and how many you can already prove. Count the evidence items you have collected, assign an owner and set a target date. The percent met column shows progress, and points at risk shows the weight whenever any objective is unmet. Sort by points at risk in Excel to see what to fix first. Update it weekly in the first ninety days and monthly after that.
Why objectives, not practices
NIST SP 800-171A breaks each requirement into determination statements, and CMMC assessors score at that level, using the examine, interview and test methods. A practice with 5 of 6 objectives met is still not met, and it costs the full weight. That is why the points at risk formula is all or nothing, while the percent met column is for tracking effort. The evidence count helps you spot objectives with a claim but no artifacts.
- Examine: policies, configurations, logs, diagrams
- Interview: administrators and users who run the control
- Test: demonstrate the mechanism working
- Keep each artifact dated and named to the objective it supports
Common mistakes
Teams often track only the practice name and a green or red status, which hides the single missing objective. Others store evidence in many places with no index. A good habit is one evidence folder per practice, named by practice ID, with the SSP section reference in the tracker. Remember that inherited controls from a cloud or managed provider still need your own evidence of how you use them, which the shared responsibility matrix worksheet covers.
Frequently Asked Questions
How many rows should I have?
A full Level 2 view has 110 practices across 14 families. If you are scoping only part of the environment, still track all 110, but note which assets each practice applies to.
Where do I find the objective counts?
In NIST SP 800-171A, each requirement lists determination statements lettered a, b, c and so on. Count them for each practice. The count differs by practice, so do not use an average.
Does percent met feed my SPRS score?
No. SPRS scoring is all or nothing per requirement, apart from a few with defined partial credit. Percent met is a progress measure. Points at risk is the number that maps to the score.
What counts as evidence?
Anything an assessor can examine or test: approved policies, screenshots with dates, exported configurations, log samples, training records, tickets and interview notes. Evidence should show the control is operating, not only designed.
If evidence is scattered across IT, quality and ERP, we can build a private retrieval layer that finds the artifact for each objective on your own servers.
Related Tools
SPRS Score Recovery Timeline Calculator
Enter your open 5, 3 and 1 point gaps and your monthly closure rate. See your score by month, months to reach 88 and the score at the 180 day POA&M window.
Compliance & ContractsCMMC Shared Responsibility Matrix Worksheet for MSPs and Cloud Providers
Record who implements each practice, where the evidence lives and what share is yours. Useful when an MSP, MSSP or cloud service provider runs part of your CUI environment.
Compliance & ContractsCMMC C3PAO Assessment Day Prep Checklist
A four part checklist covering documents, evidence, people and logistics before a third party assessor arrives, with the items that sink assessments marked critical.
Compliance & ContractsCMMC Asset Scoping and Categorization Worksheet
Build your in scope asset inventory by CMMC category, with quantities, documentation effort and annual tool cost so you can see what scope reduction would save.
More Compliance & Contracts tools
See all- CUI Banner and Dissemination Control Marking Reference
- ITAR Technical Data Handling Procedure Template
- CMMC Level 2 Checklist Worksheet
- CMMC Level 1 Checklist (15 Practices) with Evidence Tracker
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
Keep exploring
Free tools
- CMMC Level 2 Checklist WorksheetAn editable CMMC Level 2 tracking sheet with real NIST SP 800-171 practice IDs, status, evidence, owner and due date, exportable to Excel.
- CMMC Level 1 Checklist (15 Practices) with Evidence TrackerAn editable worksheet of the 15 CMMC Level 1 practices with plain-English meaning, example evidence, owner and status. Export to Excel or PDF for your self-assessment.
- CMMC Level 1 Checklist and Level 2 Control Tracker (Excel)A CMMC Level 2 control tracker by family with evidence examples, plus the 17 Level 1 practices and how scoring works.
Guides
- AI-Powered Defense Manufacturing ComplianceEnsure defense manufacturing compliance with AI. Automated ITAR, DFARS, CMMC, and export control management for defense contractors and subcontractors.
- How to Price CMMC and Compliance Costs Into Defense QuotesHow defense subcontractors recover CMMC, NIST 800-171 and ITAR compliance costs in quotes: overhead rates, allowability, fixed-price risk and margin protection.
- On-Prem AI for Defense Contractors: The Complete Deployment GuideOn-prem AI for defense contractors: deploy LLMs and AI agents inside your CMMC and ITAR boundary. Architecture, hardware costs, timelines, and vendor options.